chore: refactor gh env approval to manual workflow run#2683
Merged
Conversation
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughSplits Slack action inputs into Changes
Sequence DiagramsequenceDiagram
participant Caller as Caller Workflow
participant Reusable as reusable-deploy-k8s.yml
participant Slack as Slack Action
participant GH as GitHub API
participant K8s as Kubernetes
Caller->>Reusable: call(app, new-version, environment, approve=false, linked-workflow-run-id?)
Reusable->>Reusable: evaluate require_approval (environment/chain rule)
alt require_approval true
Reusable->>Slack: send pending-approval (app, new-version, environment, chain, linked-workflow-run-id)
Slack-->>Reusable: delivery ack
Note over Caller,Reusable: human approves by re-running with approve=true
end
Reusable->>Reusable: check approve flag & require_approval
alt deploy allowed
Reusable->>GH: create deployment (POST /repos/.../deployments)
GH-->>Reusable: deployment created
Reusable->>GH: post deployment status (success)
GH-->>Reusable: status recorded
Reusable->>K8s: perform Kubernetes rollout
K8s-->>Reusable: rollout result
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
stalniy
force-pushed
the
chore/refactor-deploy
branch
from
d0ed019 to
c32544d
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 7
🤖 Fix all issues with AI agents
In @.github/actions/slack-pending-deployment-approval/action.yml:
- Around line 64-70: The multiline gh CLI example in the reusable-deploy-k8s.yml
run command within the action.yml documentation is missing line-continuation
backslashes, causing the command to break when copied; update the snippet so
each continued line ends with a backslash (e.g., after the first gh workflow run
... \, after -f app=... \, after -f appVersion=... \, and after conditional -f
linked-workflow-run-id... \) and ensure spacing/quoting remains valid for the
conditional expansions so the command can be copied and executed as-is.
- Line 60: The Slack message references the removed input inputs.new-app-version
so it will render empty; update the template in the action.yml Slack message
line to use the current input name (or remove that placeholder) instead of ${{
inputs.new-app-version }} — locate the Slack message string that contains ${{
inputs.new-app-version }} and replace it with the correct existing input (e.g.,
${{ inputs.version }} or the actual input name used in the action inputs block)
so the message shows the intended version value.
In @.github/workflows/reusable-deploy-k8s.yml:
- Around line 109-113: The "Display linked workflow run ID" step currently
always links to the current run by using ${{ github.run_id }}; change the
summary to use the provided input ${{ inputs.linked-workflow-run-id }} instead
so the link points to the linked workflow run (i.e., build the URL with ${{
github.server_url }}/${{ github.repository }}/actions/runs/${{
inputs.linked-workflow-run-id }} and append that to $GITHUB_STEP_SUMMARY).
- Line 152: The job's if condition uses AND which blocks runs when
require_approval is 'true'; change the expression so the job runs when either an
explicit approval is provided (inputs.approve) OR no approval is required.
Replace the current line "if: (inputs.approve == 'true' || inputs.approve ==
true) && needs.deployment-prerequisites.outputs.require_approval != 'true'" with
an OR-based condition such as "if: (inputs.approve == 'true' || inputs.approve
== true) || needs.deployment-prerequisites.outputs.require_approval != 'true'"
so the job runs when approved or when require_approval is false (referencing
inputs.approve and needs.deployment-prerequisites.outputs.require_approval).
- Around line 143-147: Update the value assigned to linked-workflow-run-id so it
prefers a provided linked workflow run ID input over the current run ID: replace
the hardcoded github.run_id usage for the output key "linked-workflow-run-id"
with a GitHub Actions expression that uses the input (e.g.,
inputs.linkedWorkflowRunId or similar) when non-empty and falls back to
github.run_id otherwise; modify the YAML line setting linked-workflow-run-id to
use that conditional expression so Slack receives the linked run ID when
available.
- Around line 85-91: Add the missing workflow_call input for
linked-workflow-run-id so callers can pass it in; update the workflow_call
inputs block (where inputs like approve are defined) to include an entry named
linked-workflow-run-id with type: string (or appropriate type), required: false
(matching the workflow_dispatch definition), and a short description; ensure the
input name exactly matches 'linked-workflow-run-id' so references later in the
workflow (the usage at line 110) resolve correctly.
- Around line 246-265: The Deployments API calls using GH_TOKEN and the gh api
POSTs that create deployment and deployment statuses require explicit write
permission; add permissions: deployments: write to the deploy job (or workflow)
so the GH_TOKEN can perform the gh api -X POST "repos/$REPOSITORY/deployments"
and the subsequent statuses POST calls successfully; update the job's
permissions block (adjacent to where GH_TOKEN is used) to include deployments:
write.
c32544d to
6c5e04e
Compare
baktun14
previously approved these changes
Feb 5, 2026
stalniy
force-pushed
the
chore/refactor-deploy
branch
from
6c5e04e to
6b42a11
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In @.github/workflows/reusable-deploy-k8s.yml:
- Around line 133-134: The require_approval check includes a dead branch because
env is constructed as "${{ inputs.environment }}-${{ inputs.chain }}" so
comparing "$env" == "prod" will never match; update the conditional on the
require_approval line to test the original environment input
(inputs.environment) or to match the composed env values that indicate prod
(e.g., compare "${{ inputs.environment }}" == "prod" or test env for patterns
"prod" or "prod-" + chain), and remove the unreachable `"$env" == "prod"` check
so require_approval correctly evaluates true for production deployments.
- Around line 247-266: The deployment step uses GH_REF (constructed as `${{
inputs.app }}/v${{ inputs.appVersion }}`) directly when creating a deployment
(`gh api -X POST "repos/$REPOSITORY/deployments"`) and does not validate the
tag/ref; add a pre-check that the tag exists by calling the refs API (`gh api
repos/$REPOSITORY/git/refs/tags/{tag}`) or otherwise resolving the ref before
creating DEPLOYMENT_ID, and on failure emit a clear error and exit 1; if the ref
exists proceed to create DEPLOYMENT_ID and report the deployment status as
before.
6b42a11 to
118c47c
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.github/workflows/reusable-deploy-setup.yml:
- Around line 34-36: The gh api call that replaces TAG_NAME when it equals
"latest" can fail or return empty if there are no releases; update the block
that checks TAG_NAME and runs gh api to capture the command output into a
variable, verify it is non-empty and the command exit status succeeded, and if
it failed or returned empty log a clear error and exit non-zero; specifically
modify the conditional that sets TAG_NAME from gh api (the TAG_NAME assignment
and the gh api invocation) to perform error checking and a safe fallback or
explicit failure.
Codecov Report✔️ No coverage data to report, because files changed do not require tests or are set to ignore |
stalniy
force-pushed
the
chore/refactor-deploy
branch
from
ac2a436 to
2df8798
Compare
stalniy
force-pushed
the
chore/refactor-deploy
branch
from
2df8798 to
5813944
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Github env approval is not available for private repos. So, changing the flow, so it works in private repository as well
Summary by CodeRabbit
New Features
Improvements