Skip to content

feat(ci): require tagged releases for prod deploy #1417

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lemald wants to merge 1 commit into
base: master
Choose a base branch
from
+52 −3
Open

feat(ci): require tagged releases for prod deploy #1417

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions .github/workflows/deploy-ecs.yml → .github/workflows/deploy-lower-env.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
name: Deploy to ECS
name: Deploy to lower environment (dev etc)

permissions: {}

on:
schedule:
Expand All @@ -12,11 +14,21 @@ on:
push:
branches: master

permissions:
contents: read
concurrency:
group: deploy-${{ inputs.environment }}
cancel-in-progress: true

jobs:
check-env:
name: Fail if production environment
if: ${{ inputs.environment == 'prod' }}
runs-on: ubuntu-latest
steps:

@rudiejd rudiejd Jul 31, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could you just remove prod from the list of options in the deploy drop-down? I am not seeing where that is configured

@lemald lemald Jul 31, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately. no - the dropdown is of type environment and there's no way to exclude specific environments from the list. This approach is based largely off of what RTR does, so you can refer to the setup there to see where my approach came from.

- run: |
echo "Failing intentionally. Please use the 'Deploy to production' workflow."
exit 1
call-workflow:
if: ${{ inputs.environment != 'prod' }}
permissions:
contents: read
id-token: write # needed for AWS OIDC authentication
Expand Down
37 changes: 37 additions & 0 deletions .github/workflows/deploy-prod.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
name: Deploy to prod

permissions: {}

on:
workflow_dispatch:
release:
types:
- released

concurrency:
group: deploy-prod
cancel-in-progress: true

jobs:
check-ref:
name: Fail if not a tag
if: ${{ !startsWith(github.ref, 'refs/tags/') }}
runs-on: ubuntu-latest
steps:
- run: |
echo "Failing intentionally. Only tags may be deployed to prod."
exit 1
call-workflow:
if: ${{ startsWith(github.ref, 'refs/tags/') }}
permissions:
id-token: write # Needed to access ECR and ECS
contents: read # Needed to access commit details and other repository info
uses: mbta/workflows/.github/workflows/deploy-ecs.yml@c76e5ccd9556fbea52bc41548f7ceed5985ad775 # v5.1.0
with:
app-name: arrow
environment: prod
docker-additional-tags: prod
secrets:
aws-role-arn: ${{ secrets.AWS_ROLE_ARN }}
docker-repo: ${{ secrets.DOCKER_REPO }}
slack-webhook: ${{ secrets.SLACK_WEBHOOK }}
Loading