I've been struggling to understand some things related to Anchor Programs and their Keypairs, and I couldn't find answers to some dilemmas. I'm sorry if they have been discussed already and I searched incorrectly.
When I create an Anchor Program, it generates the ProgramID (hardcoded in lib.rs) for me and stores the keypair on ./target/deploy/<program_name>-keypair.json.
It also generates a .gitignore file ignoring the ./target folder (and the keypair), which is totally fine.
According to this thread, the keypair is used only for deploying the program for the first time. Upgrading a program doesn't require the keypair (as long as I am the Upgrade Authority)
What I'm failing to understand is: as the ./target folder and the keypair are not versioned, when my CI/CD runs anchor build for a change in the program, it's generating a new keypair and anchor deploy is deploying it as a new program instead of upgrading the existing one.
I'm probably missing something regarding upgrading my program in a CI/CD pipeline. If I manually put the generated keypair on ./target/deploy, the anchor build does not override it and the anchor deploy upgrades the program successfully. It also works if I pass --program-keypair keypair.json on the deploy. However I understood that upgrading the program should not rely on the keypair.
Could someone give me a light here, please? :)THanks