pezkuwichain e4abb38757 ci: gate deploys on a GitHub Environment instead of a hand-rolled wait loop ...

Approval was implemented as a job that polled /tmp/pexsec-gates for 30 minutes
while holding a pwap-runner slot. On 2026-07-30 the request went out at 22:14,
was not seen in time, and at 22:44 the gate cancelled the deploy — #25 stayed
merged but never reached the database, and the only trace was a failed job.

Widening that timeout was the wrong fix, so this replaces the mechanism.

Deploys now gate on the `production` environment, which has SatoshiQaziMuhammed
as a required reviewer and is restricted to protected branches. GitHub holds the
run until it is approved:

  - no runner is occupied while waiting (the loop burned one for the full window)
  - the window is 30 days, not minutes, so a missed notification costs nothing
  - the approval is recorded — who approved which SHA, in deployment history
  - approval state lives outside the workflow, so a runner restart cannot lose it

telegram-gate becomes notify-deploy-pending: it sends one message and exits in
seconds, and cannot block anything. The message now links to the run rather than
carrying Approve/Cancel buttons, since approval happens in GitHub.

Only the four jobs that touch production carry the environment. Image builds and
the version bump stay ungated and run in parallel with the wait; nothing they
produce is user-visible until a deploy job runs.

2026-07-30 18:36:12 -07:00

..

workflows

ci: gate deploys on a GitHub Environment instead of a hand-rolled wait loop

2026-07-30 18:36:12 -07:00