cpflow-deploy-review-app.yml

name: Deploy Review App to Control Plane

run-name: "Deploy Review App - PR #${{ github.event.pull_request.number || github.event.issue.number || github.event.inputs.pr_number }}"

on:
  pull_request:
    types: [opened, synchronize, reopened]
  issue_comment:
    types: [created]
  workflow_dispatch:
    inputs:
      pr_number:
        description: Pull request number to deploy
        required: true
        type: number
      reconcile_intent_run_id:
        description: Authenticated internal handoff; manual values are rejected
        required: false
        type: string

permissions:
  actions: write
  contents: read
  deployments: write
  issues: write
  pull-requests: write

jobs:
  # The reusable job exposes `image_built`; downstream jobs can read
  # `needs.deploy.outputs.image_built`. A value of `false` means this check did not validate the Docker image.
  deploy:
    # author_association is a cheap caller-side cost filter. The reusable workflow
    # still checks the commenter's current repository permission before privileged work.
    if: |
      (github.event_name == 'pull_request' &&
       github.event.pull_request.head.repo.full_name == github.repository) ||
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'issue_comment' &&
       github.event.issue.pull_request &&
       contains(fromJson('["+review-app-deploy","+review-app-deploy\n","+review-app-deploy\r\n"]'), github.event.comment.body) &&
       contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association))
    uses: shakacode/control-plane-flow/.github/workflows/cpflow-deploy-review-app.yml@6aa575780f2d9175755881b79cbb3253adbc9c1f # v6.0.1
    secrets:
      CPLN_TOKEN_STAGING: ${{ secrets.CPLN_TOKEN_STAGING }}
      REVIEW_APP_DOCKER_BUILD_SECRETS: ${{ secrets.REVIEW_APP_DOCKER_BUILD_SECRETS }}
      DOCKER_BUILD_SSH_KEY: ${{ secrets.DOCKER_BUILD_SSH_KEY }}