feat(workflow): implement staging-deploy CI workflow with external approval

- Add `staging-deploy` workflow profile to default configuration
- Add `--apply` CLI argument for explicit mutation intent
- Implement strict CI mutation gates in `runner.rs` (requires `--apply`, `external` approval, and valid `deploy_context`)
- Support explicit `external` approval metadata rendering in `workflow plan` and `workflow explain`
- Add `staging-deploy` manual job to `.github/workflows/sailr-ci.yml`

Author: josh-tracey

.github/workflows/sailr-ci.yml

@@ -10,7 +10,10 @@ on:
         description: "Run experimental ci-build profile"
         required: false
         default: "false"
-
+      run_staging_deploy:
+        description: "Run staging deploy workflow"
+        required: false
+        default: "false"
 jobs:
   sailr-workflow:
     runs-on: ubuntu-latest
@@ -51,4 +54,30 @@ jobs:
 
       - name: Run experimental CI build
         run: sailr workflow run ci-build --non-interactive
+
+  staging-deploy:
+    if: github.event_name == 'workflow_dispatch' && inputs.run_staging_deploy == 'true'
+    environment: staging
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Sailr
+        run: cargo install --path .
+
+      - name: Configure kubeconfig
+        run: |
+          mkdir -p ~/.kube
+          echo "${{ secrets.STAGING_KUBECONFIG }}" > ~/.kube/config
+          chmod 600 ~/.kube/config
+
+      - name: Run staging deploy
+        run: sailr workflow run staging-deploy --non-interactive --apply
+
+      - name: Upload Sailr report
+        uses: actions/upload-artifact@v4
+        with:
+          name: sailr-staging-deploy-report
+          path: .sailr/reports/staging-deploy/latest.json
 

k8s/environments/staging/config.toml

@@ -0,0 +1,16 @@
+schema_version = "0.5.0"
+name = "staging"
+log_level = "INFO"
+domain = "staging.example.local"
+default_replicas = 1
+registry = "docker.io"
+
+[[service]]
+name = "hello-sailr"
+version = "ci"
+path = "hello-sailr"
+
+[[service]]
+name = "ci-build-hello"
+version = "ci"
+path = "examples/ci-build/hello"

sailr.workflow.toml

@@ -59,3 +59,16 @@ namespace = "default"
 approval = "none"
 apply = false
 report = "both"
+
+[workflow.staging-deploy]
+environment = "staging"
+mode = "deploy"
+interactive = false
+build = "plan"
+generate = "run"
+deploy = "run"
+deploy_context = "staging"
+namespace = "default"
+approval = "external"
+apply = true
+report = "both"

src/cli.rs

@@ -152,6 +152,9 @@ pub struct WorkflowRunArgs {
 
     #[arg(long)]
     pub dry_run: bool,
+
+    #[arg(long)]
+    pub apply: bool,
 }
 
 #[derive(Debug, Args)]

src/default_config.toml

@@ -32,3 +32,16 @@ namespace = "default"
 approval = "none"
 apply = false
 report = "both"
+
+[workflow.staging-deploy]
+environment = "staging"
+mode = "deploy"
+interactive = false
+build = "plan"
+generate = "run"
+deploy = "run"
+deploy_context = "staging"
+namespace = "default"
+approval = "external"
+apply = true
+report = "both"

src/workflow/profile.rs

@@ -754,10 +754,10 @@ mod tests {
         "#;
         let profile: WorkflowProfile = toml::from_str(toml_str).unwrap();
         let normalized = profile.normalize(false); // not CI
-        assert_eq!(normalized.interactive, true);
+        assert!(normalized.interactive);
         assert_eq!(normalized.deploy, WorkflowStepMode::Run);
         assert_eq!(normalized.approval, ApprovalMode::Prompt);
-        assert_eq!(normalized.apply, true);
+        assert!(normalized.apply);
         assert_eq!(normalized.deploy_context.as_deref(), Some("minikube"));
         assert_eq!(normalized.namespace.as_deref(), Some("default"));
     }

src/workflow/render.rs

@@ -21,6 +21,13 @@ pub fn render_workflow_plan_text(plan: &WorkflowPlan) -> String {
         out.push('\n');
     }
 
+    if plan.profile.approval == crate::workflow::profile::ApprovalMode::External {
+        out.push_str("Approval:\n");
+        out.push_str("  mode: external\n");
+        out.push_str("  provider: GitHub Environment\n");
+        out.push_str(&format!("  environment: {}\n\n", plan.profile.environment));
+    }
+
     out.push_str("Overall Effects:\n");
     out.push_str(&format!(
         " - Mutates Filesystem: {}\n",
@@ -111,6 +118,25 @@ pub fn render_workflow_explain_text(plan: &WorkflowPlan, task_id: &str) -> Resul
         out.push_str(&format!("Dependencies: {}\n", task.dependencies.join(", ")));
     }
 
+    if task.kind == crate::workflow::plan::WorkflowTaskKind::Deploy {
+        if plan.profile.approval == crate::workflow::profile::ApprovalMode::External {
+            out.push_str("\nApproval:\n");
+            out.push_str("  mode: external\n");
+            out.push_str("  provider: GitHub Environment\n");
+            out.push_str(&format!("  environment: {}\n", plan.profile.environment));
+        }
+
+        if let Some(ctx) = &plan.profile.deploy_context {
+            out.push_str("\nContext:\n");
+            out.push_str(&format!("  {}\n", ctx));
+        }
+
+        if let Some(ns) = &plan.profile.namespace {
+            out.push_str("\nNamespace:\n");
+            out.push_str(&format!("  {}\n", ns));
+        }
+    }
+
     out.push_str("\nSide Effects:\n");
     out.push_str(&format!(
         " - Mutates Filesystem: {}\n",

src/workflow/runner.rs

@@ -173,35 +173,47 @@ fn write_workflow_report(
 pub fn validate_workflow_safety(
     profile: &crate::workflow::profile::NormalizedWorkflowProfile,
     runner: &RunnerContext,
+    args: &crate::cli::WorkflowRunArgs,
 ) -> Result<(), String> {
     if runner.ci && profile.interactive {
         return Err("workflow cannot be interactive in CI".to_string());
     }
 
-    if runner.ci && profile.apply {
-        return Err("apply=true is not allowed in CI deploy-plan workflows".to_string());
-    }
-
     if runner.ci && profile.approval == crate::workflow::profile::ApprovalMode::Prompt {
         return Err("approval prompt cannot run in CI".to_string());
     }
 
-    if profile.deploy.is_active() {
-        if profile.deploy == crate::workflow::profile::WorkflowStepMode::Run {
-            match profile.deploy_context.as_deref() {
-                Some("none") | None => {
-                    return Err("deploy=run requires an explicit real deploy_context".to_string());
-                }
-                Some(_) => {}
-            }
+    if profile.deploy == crate::workflow::profile::WorkflowStepMode::Run {
+        let context = profile.deploy_context.as_deref();
+
+        if context.is_none() || context == Some("none") {
+            return Err("deploy=run requires an explicit real deploy_context".to_string());
         }
 
-        if runner.ci && profile.deploy == crate::workflow::profile::WorkflowStepMode::Run {
-            return Err("CI deploy workflows are not enabled in this stage".to_string());
+        if profile.environment == "production" {
+            return Err("production deploy is not enabled in this stage".to_string());
         }
 
-        if profile.deploy == crate::workflow::profile::WorkflowStepMode::Run && !profile.apply {
-            return Err("deploy = run requires apply = true".to_string());
+        if runner.ci {
+            if profile.approval != crate::workflow::profile::ApprovalMode::External {
+                return Err("CI deploy requires approval=external".to_string());
+            }
+
+            if !profile.apply {
+                return Err("CI deploy requires profile apply=true".to_string());
+            }
+
+            if !args.apply {
+                return Err("deploy=run in CI requires --apply".to_string());
+            }
+        } else {
+            if !profile.apply {
+                return Err("deploy=run requires apply=true".to_string());
+            }
+
+            if !runner.interactive && !args.apply {
+                return Err("non-interactive deploy requires --apply".to_string());
+            }
         }
     }
 
@@ -239,11 +251,13 @@ impl WorkflowRunner {
         // 5. Construct BuildOptions (incorporating CLI overrides)
         let only = args
             .only
-            .map(|s| crate::builder::split_matches(Some(s)))
+            .as_ref()
+            .map(|s| crate::builder::split_matches(Some(s.clone())))
             .unwrap_or_default();
         let ignore = args
             .ignore
-            .map(|s| crate::builder::split_matches(Some(s)))
+            .as_ref()
+            .map(|s| crate::builder::split_matches(Some(s.clone())))
             .unwrap_or_default();
 
         let options = BuildOptions {
@@ -260,7 +274,7 @@ impl WorkflowRunner {
         };
 
         // 6. Safety validation
-        validate_workflow_safety(&normalized_profile, &runner_ctx)?;
+        validate_workflow_safety(&normalized_profile, &runner_ctx, &args)?;
 
         // 7. Plan Pipeline
         let planner = WorkflowPlanner::new(
@@ -602,7 +616,7 @@ mod tests {
             interactive: true,
         };
 
-        let res = validate_workflow_safety(&profile, &runner);
+        let res = validate_workflow_safety(&profile, &runner, &crate::cli::WorkflowRunArgs { profile: "test".to_string(), only: None, ignore: None, non_interactive: true, plan: false, dry_run: false, apply: false });
         assert!(res.is_err());
         assert!(res
             .unwrap_err()
@@ -640,7 +654,7 @@ mod tests {
             interactive: false,
         };
 
-        let res = validate_workflow_safety(&profile, &runner);
+        let res = validate_workflow_safety(&profile, &runner, &crate::cli::WorkflowRunArgs { profile: "test".to_string(), only: None, ignore: None, non_interactive: true, plan: false, dry_run: false, apply: false });
         assert!(res.is_err());
         // Since we added a check for apply=true in CI first, it'll hit that instead.
         // Let's just check that it fails correctly.
@@ -677,7 +691,7 @@ mod tests {
             interactive: false, // user ran with --non-interactive
         };
 
-        let res = validate_workflow_safety(&profile, &runner);
+        let res = validate_workflow_safety(&profile, &runner, &crate::cli::WorkflowRunArgs { profile: "test".to_string(), only: None, ignore: None, non_interactive: true, plan: false, dry_run: false, apply: false });
         assert!(res.is_err());
         assert!(res
             .unwrap_err()
@@ -715,10 +729,54 @@ mod tests {
             interactive: true,
         };
 
-        let res = validate_workflow_safety(&profile, &runner);
+        let res = validate_workflow_safety(&profile, &runner, &crate::cli::WorkflowRunArgs { profile: "test".to_string(), only: None, ignore: None, non_interactive: true, plan: false, dry_run: false, apply: false });
         assert!(res.is_err());
         assert!(res
             .unwrap_err()
-            .contains("deploy = run requires apply = true"));
+            .contains("deploy=run requires apply=true"));
+    }
+    #[test]
+    fn validate_safety_ci_staging_deploy_allowed() {
+        use crate::workflow::profile::{
+            ApprovalMode, NormalizedWorkflowProfile, ReportMode, WorkflowEngine, WorkflowMode,
+            WorkflowStepMode,
+        };
+
+        let profile = NormalizedWorkflowProfile {
+            name: "staging-deploy".to_string(),
+            environment: "staging".to_string(),
+            mode: WorkflowMode::Deploy,
+            engine: WorkflowEngine::Runkernel,
+            interactive: false,
+            build: WorkflowStepMode::Plan,
+            generate: WorkflowStepMode::Run,
+            deploy: WorkflowStepMode::Run,
+            test: WorkflowStepMode::Disabled,
+            verify: WorkflowStepMode::Disabled,
+            deploy_context: Some("staging".to_string()),
+            namespace: Some("default".to_string()),
+            approval: ApprovalMode::External,
+            apply: true,
+            report: ReportMode::Both,
+        };
+
+        let runner = RunnerContext {
+            kind: RunnerKind::GitHubActions,
+            ci: true,
+            interactive: false,
+        };
+
+        let args = crate::cli::WorkflowRunArgs {
+            profile: "staging-deploy".to_string(),
+            only: None,
+            ignore: None,
+            non_interactive: true,
+            plan: false,
+            dry_run: false,
+            apply: true,
+        };
+
+        let res = validate_workflow_safety(&profile, &runner, &args);
+        assert!(res.is_ok());
     }
 }