Skip to content

fix(ci): stop interpolating dispatch inputs into rollback run blocks #1641

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cristim merged 2 commits into from
Jul 28, 2026
Merged

fix(ci): stop interpolating dispatch inputs into rollback run blocks #1641

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cde6446
fix(ci): stop interpolating dispatch inputs into rollback run blocks
cristim Jul 28, 2026
f2b6529
docs(ci): drop the deleted Verify Image job from the rollback README
cristim Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions .github/workflows/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -378,9 +378,15 @@ Quickly rollback to a previous deployment version by redeploying a known-good Do
### Jobs

1. **Validate** - Validate image tag and construct image URI
2. **Verify Image** - Confirm image exists in registry
3. **Rollback** - Deploy previous image with Terraform
4. **Summary** - Create audit record
2. **Rollback** - Confirm the image exists in the registry, then deploy it with Terraform
3. **Summary** - Create audit record

Image existence is verified *inside* each rollback job rather than in a
standalone job. A separate verify job would have to assume the same cloud
deploy role while carrying no `environment:` binding, which is exactly the
ungated-but-credentialed shape that made the workflow exploitable. The
tradeoff is that a rollback to a nonexistent tag now fails after the
environment approval rather than before it.

### Triggers

Expand Down
Loading
Loading