583: lock repo for CI deploy