chore: add force deploy confirmation and validate PR status in deployment workflow

saikumarrs · saikumarrs · commit cf73be5d888c · 2026-02-12T19:55:59.000+05:30
- Introduced `force_deploy_confirmation` input to allow bypassing all PR checks during deployment.
- Added a new job to check for force deploy mode and validate PR status, ensuring that deployments only proceed if PRs are ready for merging unless forced.
- Enhanced logging for better visibility during the deployment process.
diff --git a/.github/workflows/deploy-beta.yml b/.github/workflows/deploy-beta.yml
@@ -7,6 +7,11 @@ on:
         description: "Deploy to NPM"
         type: boolean
         default: false
+      force_deploy_confirmation:
+        description: "Force deploy (bypass ALL PR checks). Type 'FORCE_DEPLOY' to confirm"
+        type: string
+        default: ""
+        required: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -30,15 +35,14 @@ jobs:
     secrets:
       PAT: ${{ secrets.PAT }}
 
-  get-deploy-inputs:
-    name: Get Deploy Inputs
+  find-pr:
+    name: Find PR for Current Branch
     needs: validate-actor
     runs-on: [self-hosted, Linux, X64]
     outputs:
-      version_suffix: ${{ steps.deploy-inputs.outputs.version_suffix }}
-      beta_identifier: ${{ steps.deploy-inputs.outputs.beta_identifier }}
-      beta_identifier_for_automation_tests: ${{ steps.deploy-inputs.outputs.beta_identifier_for_automation_tests }}
-      trigger_source: ${{ format('Triggered via PR <{0}|#{1}> by <{2}|{3}>', steps.pr-info.outputs.pr_url, steps.pr-info.outputs.pr_number, format('{0}/{1}', github.server_url, github.actor), github.actor) }}
+      pr_number: ${{ steps.pr-info.outputs.pr_number }}
+      pr_url: ${{ steps.pr-info.outputs.pr_url }}
+      force_deploy_mode: ${{ steps.check-force-deploy.outputs.force_deploy_mode }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
@@ -50,76 +54,139 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Check force deploy mode
+        id: check-force-deploy
+        run: |
+          if [ "${{ inputs.force_deploy_confirmation }}" = "FORCE_DEPLOY" ]; then
+            echo "force_deploy_mode=true" >> $GITHUB_OUTPUT
+            echo "⚠️ FORCE DEPLOY MODE ENABLED - All PR validation checks will be skipped"
+          else
+            echo "force_deploy_mode=false" >> $GITHUB_OUTPUT
+          fi
+
       - name: Find PR for current branch
         id: pr-info
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const branch = context.ref.replace('refs/heads/', '');
             console.log(`Finding PRs for branch: ${branch}`);
-            
+
             const { data: pullRequests } = await github.rest.pulls.list({
               owner: context.repo.owner,
               repo: context.repo.repo,
               head: `${context.repo.owner}:${branch}`,
               base: 'develop',
               state: 'open'
             });
-            
+
             if (pullRequests.length > 0) {
               const pr = pullRequests[0];
               const prNumber = pr.number.toString();
               const prUrl = pr.html_url;
-              console.log(`Found PR #${prNumber} for branch ${branch}: https://github.com/${context.repo.owner}/${context.repo.repo}/pull/${prNumber}`);
-              
-              // Check if PR is in draft state
-              if (pr.draft) {
-                core.setFailed(`PR #${prNumber} is in draft state. Please mark it as ready for review before deploying.`);
-                return;
-              }
-              
-              // Get detailed PR information including mergeable state
-              const { data: prDetails } = await github.rest.pulls.get({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                pull_number: prNumber
-              });
-              
-              // Check if PR is mergeable and all requirements are satisfied
-              if (prDetails.mergeable === false) {
-                core.setFailed(`PR #${prNumber} is not in a mergeable state. Please resolve conflicts before deploying.`);
-                return;
-              }
-              
-              // The mergeable_state can be one of: clean, dirty, blocked, unstable, or unknown
-              // Only 'clean' means all requirements are met (checks passed, approvals received, no conflicts)
-              if (prDetails.mergeable_state !== 'clean') {
-                // Get more details about why it's not clean
-                let reason = '';
-                
-                if (prDetails.mergeable_state === 'blocked') {
-                  reason = 'required checks or approvals are missing';
-                } else if (prDetails.mergeable_state === 'dirty') {
-                  reason = 'there are merge conflicts';
-                } else if (prDetails.mergeable_state === 'unstable') {
-                  reason = 'required checks are failing';
-                } else {
-                  reason = `the mergeable state is "${prDetails.mergeable_state}"`;
-                }
-                
-                core.setFailed(`PR #${prNumber} is not ready to merge: ${reason}. Please resolve all issues before deploying.`);
-                return;
-              }
-              
-              console.log(`PR #${prNumber} is in a clean mergeable state. All requirements satisfied. Proceeding with beta deployment.`);
-              
+              console.log(`Found PR #${prNumber} for branch ${branch}: ${prUrl}`);
+
               core.setOutput('pr_number', prNumber);
               core.setOutput('pr_url', prUrl);
             } else {
               core.setFailed(`No open PR found for branch ${branch} targeting develop branch`);
-              core.setOutput('pr_number', '');
             }
 
+  validate-pr:
+    name: Validate PR Status
+    needs: find-pr
+    if: ${{ needs.find-pr.outputs.force_deploy_mode != 'true' }}
+    runs-on: [self-hosted, Linux, X64]
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        with:
+          egress-policy: audit
+
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Validate PR
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const prNumber = '${{ needs.find-pr.outputs.pr_number }}';
+
+            console.log(`Validating PR #${prNumber}...`);
+
+            // Get detailed PR information
+            const { data: prDetails } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber
+            });
+
+            // Check if PR is in draft state
+            if (prDetails.draft) {
+              core.setFailed(`PR #${prNumber} is in draft state. Please mark it as ready for review before deploying.`);
+              return;
+            }
+
+            // Check if PR is mergeable
+            if (prDetails.mergeable === false) {
+              core.setFailed(`PR #${prNumber} is not in a mergeable state. Please resolve conflicts before deploying.`);
+              return;
+            }
+
+            // Check mergeable_state
+            if (prDetails.mergeable_state !== 'clean') {
+              let reason = '';
+
+              if (prDetails.mergeable_state === 'blocked') {
+                reason = 'required checks or approvals are missing';
+              } else if (prDetails.mergeable_state === 'dirty') {
+                reason = 'there are merge conflicts';
+              } else if (prDetails.mergeable_state === 'unstable') {
+                reason = 'required checks are failing';
+              } else {
+                reason = `the mergeable state is "${prDetails.mergeable_state}"`;
+              }
+
+              core.setFailed(`PR #${prNumber} is not ready to merge: ${reason}. Please resolve all issues before deploying.`);
+              return;
+            }
+
+            console.log(`PR #${prNumber} is in a clean mergeable state. All requirements satisfied.`);
+
+  get-deploy-inputs:
+    name: Get Deploy Inputs
+    needs: [find-pr, validate-pr]
+    if: ${{ always() && needs.find-pr.result == 'success' && (needs.validate-pr.result == 'success' || needs.validate-pr.result == 'skipped') }}
+    runs-on: [self-hosted, Linux, X64]
+    outputs:
+      version_suffix: ${{ steps.deploy-inputs.outputs.version_suffix }}
+      beta_identifier: ${{ steps.deploy-inputs.outputs.beta_identifier }}
+      beta_identifier_for_automation_tests: ${{ steps.deploy-inputs.outputs.beta_identifier_for_automation_tests }}
+      trigger_source: ${{ steps.set-trigger-source.outputs.trigger_source }}
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        with:
+          egress-policy: audit
+
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Set trigger source
+        id: set-trigger-source
+        run: |
+          TRIGGER_BASE="Triggered via PR <${{ needs.find-pr.outputs.pr_url }}|#${{ needs.find-pr.outputs.pr_number }}> by <${{ github.server_url }}/${{ github.actor }}|${{ github.actor }}>"
+
+          if [ "${{ needs.find-pr.outputs.force_deploy_mode }}" = "true" ]; then
+            echo "trigger_source=${TRIGGER_BASE} [⚠️ FORCE DEPLOY]" >> $GITHUB_OUTPUT
+          else
+            echo "trigger_source=${TRIGGER_BASE}" >> $GITHUB_OUTPUT
+          fi
+
       - name: Extract deploy inputs
         id: deploy-inputs
         shell: bash
@@ -130,9 +197,9 @@ jobs:
           # - "beta.pr." is a fixed prefix indicating a beta release for a pull request.
           # - <PR_NUMBER> is the number of the pull request associated with the branch.
           # - <SHORT_COMMIT_HASH> is the first 7 characters of the commit hash for traceability.
-          echo "version_suffix=beta.pr.${{ steps.pr-info.outputs.pr_number }}.$SHA_SHORT" >> $GITHUB_OUTPUT
-          echo "beta_identifier=PR-${{ steps.pr-info.outputs.pr_number }}/$SHA_SHORT" >> $GITHUB_OUTPUT
-          echo "beta_identifier_for_automation_tests=pr-${{ steps.pr-info.outputs.pr_number }}-$SHA_SHORT" >> $GITHUB_OUTPUT
+          echo "version_suffix=beta.pr.${{ needs.find-pr.outputs.pr_number }}.$SHA_SHORT" >> $GITHUB_OUTPUT
+          echo "beta_identifier=PR-${{ needs.find-pr.outputs.pr_number }}/$SHA_SHORT" >> $GITHUB_OUTPUT
+          echo "beta_identifier_for_automation_tests=pr-${{ needs.find-pr.outputs.pr_number }}-$SHA_SHORT" >> $GITHUB_OUTPUT
 
   deploy-cdn:
     name: Deploy to CDN
