feat: add deploy-promote workflow for one-click branch promotion#3199
Open
feat: add deploy-promote workflow for one-click branch promotion#3199
Conversation
Adds a GitHub Actions workflow_dispatch that automates creating PRs for master→preprod and preprod→prod promotions with auto-generated changelogs and Slack notifications for prod deploys. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Removes standalone deploy-promote.yml and adds two manual jobs (promote-changelog, promote-create-pr) to the existing Continuous workflow via workflow_dispatch. Supports preprod and prod targets with auto-changelog and Slack notifications. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Fix concurrency group to avoid cancelling promote jobs on concurrent pushes - Guard jest-tests from running on workflow_dispatch events - Fix PR body heredoc indentation that broke markdown rendering Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Two manual jobs now appear in every push-to-master workflow run: - "Promote: master → preprod" (gated by promote-preprod environment) - "Promote: preprod → prod" (gated by promote-prod environment) Developers click "Review deployments" in the Actions UI to approve. Each job generates a changelog and creates a PR automatically. Prod promotions also post to Slack. Requires creating "promote-preprod" and "promote-prod" environments in repo Settings → Environments with required reviewers. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Promotion jobs belong in deploy-static.yaml since that's the workflow that runs on push to master/preprod/prod. After the staging deploy completes (detect → release → update-state → trigger-deploy), two environment-gated jobs appear: - "Promote: master → preprod" (gated by promote-preprod env) - "Promote: preprod → prod" (gated by promote-prod env) Developers click "Review deployments" to approve, then the job creates a PR with auto-generated changelog. Prod also sends Slack. Reverts continuous.yaml to its original state. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds a branch-protection job that runs before detect and enforces: - preprod: only accepts merges from master - prod: only accepts merges from preprod, unless the actor is in the HOTFIX_ALLOWED_USERS secret (comma-separated usernames) - master: no restriction - [skip ci] deploy state commits are always allowed Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Moves branch protection from deploy-static (post-push, too late) to a separate promotion-gate.yaml that runs on PRs targeting preprod/prod. Rules: - preprod: only accepts PRs from master - prod: only accepts PRs from preprod (or hotfix users) This should be set as a required status check in GitHub branch protection for preprod and prod branches — prevents the merge button from being available when the source branch is wrong. Hotfix users are configured via HOTFIX_ALLOWED_USERS secret (comma-separated GitHub usernames). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Updates promotion gate per team feedback: - preprod accepts: master, hotfix/* - prod accepts: preprod, hotfix/* - Removed per-user hotfix check (HOTFIX_ALLOWED_USERS) — who can approve is controlled by GitHub environment reviewers instead Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Extract changelog + PR creation to build/ci/generate-promotion-pr.sh (DRYs up the two promote jobs in deploy-static.yaml) - Handle empty commits: skips PR creation when branches are identical - Add merge_group trigger to promotion-gate.yaml for merge queue support - Slack notification now also skips on no-changes Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
deploy-static.yaml— after staging deploy on push to master, two manual "Review deployments" buttons appear for promoting to preprod and prodpromotion-gate.yaml— a required status check that enforces allowed merge paths (blocks invalid PRs before merge)build/ci/generate-promotion-pr.sh) auto-generates PR body with commit countsHow it works
Promotion flow (deploy-static.yaml)
deploy-staticruns: detect → release → deploy to stagingbuild/ci/generate-promotion-pr.shwhich creates a PR with auto-generated changelogdeploy-staticrun for the target environmentBranch protection (promotion-gate.yaml)
preprodorprodpreprod← onlymasterorhotfix/*;prod← onlypreprodorhotfix/*Setup needed (manual steps)
1. Create GitHub Environments
Go to repo Settings → Environments and create:
promote-preprod— add required reviewers (team members who can approve preprod deploys)promote-prod— add required reviewers (team members who can approve prod deploys)2. Add required status check
Go to repo Settings → Branches → Branch protection rules:
preprodbranch: enable "Require status checks" → add "Promotion Gate"prodbranch: enable "Require status checks" → add "Promotion Gate"3. Add Slack webhook secret
SLACK_DEPLOY_WEBHOOKsecret in repo Settings → Secrets (for prod promotion Slack notifications)Files changed
.github/workflows/deploy-static.yamltrigger-deploy.github/workflows/promotion-gate.yamlbuild/ci/generate-promotion-pr.shTest plan
promotion-gate.yamlpasses on PR frommaster→preprodpromotion-gate.yamlfails on PR fromfeature/*→preprodpromotion-gate.yamlpasses on PR fromhotfix/*→prod🤖 Generated with Claude Code