Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions .github/workflows/deploy-to-azure.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ on:
environment:
description: 'Environment to deploy to'
required: true
default: 'development'
default: 'develop'
type: choice
options:
- production
Expand All @@ -24,7 +24,7 @@ jobs:
run: |
case "${{ inputs.environment }}" in
testing) echo "target_env=Testing" >> $GITHUB_OUTPUT ;;
development) echo "target_env=dev" >> $GITHUB_OUTPUT ;;
develop) echo "target_env=dev" >> $GITHUB_OUTPUT ;;
staging) echo "target_env=stage" >> $GITHUB_OUTPUT ;;
production) echo "target_env=prod" >> $GITHUB_OUTPUT ;;
esac
Expand Down Expand Up @@ -63,4 +63,5 @@ jobs:
app_location: ".output/public" # App source code path
api_location: "" # Api source code path - optional
output_location: "" # Built app content directory - optional
skip_app_build: true
skip_app_build: true
production_branch: ${{ inputs.environment }}
21 changes: 21 additions & 0 deletions .github/workflows/trigger-deploy-on-merge.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
name: Trigger Deployment on Pull Request Merge
on:
pull_request:
types: [closed]
branches: [develop, staging, production, testing]
Comment on lines +4 to +5

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🔴 Critical | ⚡ Quick win

Guard the job to only run when the pull request was actually merged.

types: [closed] fires for both merged and unmerged PRs. Without an if condition, closing a PR without merging would dispatch a deployment, potentially deploying rejected code. Add a job-level merged check.

🔒 Proposed fix: add merged check to the job
 jobs:
     deploy-frontend:
+        if: github.event.pull_request.merged == true
         runs-on: ubuntu-latest

Also applies to: 11-12

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/trigger-deploy-on-merge.yml around lines 4 - 5, Add a
job-level condition to the workflow job triggered by the pull_request closed
event, requiring github.event.pull_request.merged == true; apply the same guard
to the corresponding deployment job block so unmerged PR closures cannot
dispatch deployments.

permissions:
contents: read
actions: write

jobs:
deploy-frontend:
runs-on: ubuntu-latest
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
steps:
- name: Trigger Frontend Deployment Workflow
run: |
gh workflow run deploy-to-azure.yml \
--repo ${{ github.repository }} \
--ref ${{ github.base_ref }} \
--field environment=${{ github.event.pull_request.base.ref }}
Loading