GitHub ActionsのCustom Deployment Protection Ruleを理解する

name: Custom Deployment Protection Rule

on:
  push: 
    branches:
      - custom_deploy_protection
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest
    # Wait for approve from GitHub App
    environment: custom-protection
    steps:
      - uses: actions/checkout@v4
      - run: echo "Deploy to custom-protection"

name: Custom Deployment Protection Rule

on:
  push: 
    branches:
      - custom_deploy_protection
  workflow_dispatch:
    inputs:
      approve_run_id:
        description: 'run_id to approve'
        required: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    # Wait for approve from GitHub App when trigger by push
    environment: custom-protection
    if: github.event_name == 'push'
    steps:
      - uses: actions/checkout@v4
      - run: echo "Deploy to custom-protection"

  approve:
    runs-on: ubuntu-latest
    # Approve to awaiting run_id when trigger by workflow_dispatch
    if: github.event_name == 'workflow_dispatch' 
    steps:
      - uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ secrets.DEPLOYMENT_APP_ID }}
          private-key: ${{ secrets.DEPLOYMENT_APP_PRIVATE_KEY }}
      - name: Approve Deployment
        run: |
          gh api -X POST /repos/${{ github.repository }}/actions/runs/${{ github.event.inputs.approve_run_id }}/deployment_protection_rule \
            -f "environment_name=custom-protection" \
            -f "state=approved" \
            -f "comment=Approved by workflow_dispatch"
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

name: Custom Deployment Protection Rule

on:
  push: 
    branches:
      - custom_deploy_protection
  workflow_dispatch:
    inputs:
      approve_run_id:
        description: 'run_id to approve'
        required: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    # Wait for approve from GitHub App when trigger by push
    environment: custom-protection
    if: github.event_name == 'push'
    steps:
      - uses: actions/checkout@v4
      - run: echo "Deploy to custom-protection"

name: Auto Approve Custom Deployment

on:
  push: 
    branches:
      - custom_deploy_protection

jobs:
  build_dummy:
    runs-on: ubuntu-latest
    # 時間がかかるジョブを再現するためにsleepするだけ
    steps:
      - uses: actions/checkout@v4
      - run: sleep 10

  auto_approve:
    runs-on: ubuntu-latest
    # 同じコミットハッシュからトリガーされ、承認待ち状態の別のワークフローのrun_idを特定して保存する
    needs: build_dummy
    steps:
      - uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ secrets.DEPLOYMENT_APP_ID }}
          private-key: ${{ secrets.DEPLOYMENT_APP_PRIVATE_KEY }}
      - name: Find awaiting approval run_id
        id: awaiting-run
        run: |
            RUN_ID=$(gh api /repos/${{ github.repository }}/actions/workflows/custom_deploy_protection.yml/runs \
              -X GET -f head_sha=${{ github.sha }} |\
              jq -e 'first(.workflow_runs[].id)')
            echo "run_id=${RUN_ID}" >> $GITHUB_OUTPUT
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

      # 本当は gh api /repos/${{ github.repository }}/actions/runs/${RUN_ID}/pending_deployments を見て承認待ち状態かどうか判別するべきだが、
      # 今回は簡略化のために必ず承認待ち状態であると仮定してapproveする

      # 先ほど保存したrun_idに対してapproveを行う
      - name: Approve Deployment
        run: |
            gh api -X POST /repos/${{ github.repository }}/actions/runs/${{ steps.awaiting-run.outputs.run_id }}/deployment_protection_rule \
            -f "environment_name=custom-protection" \
            -f "state=approved" \
            -f "comment=Approved by workflow_dispatch"
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

gh api /repos/${{ github.repository }}/actions/workflows/custom_deploy_protection.yml/runs \
  -X GET -f head_sha=${{ github.sha }} |\
  jq -e 'first(.workflow_runs[].id)`