Add manual approval gate to homelab-apply workflow - #5
Merged
Conversation
Wraps the workflow_dispatch trigger in a `homelab-apply` GitHub Environment with self as required reviewer and branch policy restricted to protected branches. Forces an explicit approval click in the Actions UI before apply runs against tailnet + GitHub state. Repo-level Actions secrets are left in place so the homelab-plan PR workflow keeps working.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
github_repository_environment.homelab_applyinhomelab/github.tf— required reviewer = self, branch policy restricted to protected branches.environment: homelab-applyto the apply job in.github/workflows/homelab-apply.yml, which makes the workflow pause for approval in the Actions UI before runningtofu apply.homelab-planPR workflow needs them and env-secrets would override at apply time anyway if stronger isolation is ever wanted.The Tofu resource was already applied locally (1 add, 0 change, 0 destroy), so the gate is live on
origin/mainonce this merges.Test plan
homelab-planworkflow passes on this PR (plan should be a no-op now that the resource exists).homelab-applyfrom the Actions UI — confirm the run pauses at the apply job with a "Review deployments" prompt.