fix(ci): resolve deploy environment from inputs, not github.event_name

.github/workflows/deploy-all.yml

@@ -15,6 +15,15 @@
 
 name: Deploy to All Clouds
 
+# Adding a trigger here, or a second caller of the deploy-* workflows, means
+# revisiting the `prepare` comments in deploy-azure.yml, deploy-gcp.yml and
+# deploy-aws-lambda.yml. Since #1805 those three resolve their environment from
+# `inputs.environment` and fall back on `github.event_name`, which inside a
+# reusable workflow is whatever event started THIS run. They are correct today
+# only because this workflow is their only caller, has no `push` trigger, and
+# allowlists the environment it passes. A `push:` trigger here would make
+# Azure and GCP silently resolve dev for a caller that asked for something
+# else, which is #1805 restored.
 on:
   workflow_dispatch:
     inputs:
@@ -56,13 +65,36 @@ jobs:
     steps:
       - name: Set environment
         id: set-env
+        env:
+          # This workflow is always the entry point of its own run, never a
+          # reusable one, so `github.event_name` here really is the trigger that
+          # started it. The called workflows cannot rely on that and read
+          # `inputs.environment` instead (issue #1805).
+          EVENT_NAME: ${{ github.event_name }}
+          INPUT_ENVIRONMENT: ${{ inputs.environment }}
         run: |
-          if [[ "${{ github.event_name }}" == "release" ]]; then
-            echo "environment=prod" >> $GITHUB_OUTPUT
+          set -euo pipefail
+          INPUT_ENVIRONMENT="${INPUT_ENVIRONMENT:-}"
+
+          if [ "$EVENT_NAME" = release ]; then
+            ENVIRONMENT=prod
           else
-            echo "environment=${{ inputs.environment }}" >> $GITHUB_OUTPUT
+            ENVIRONMENT="$INPUT_ENVIRONMENT"
           fi
 
+          # Every called workflow takes this value verbatim, so an empty or
+          # unknown value has to stop the fan-out here rather than reach four
+          # deployments.
+          case "$ENVIRONMENT" in
+            dev|staging|prod) ;;
+            *)
+              echo "::error::Refusing unknown environment: '$ENVIRONMENT'"
+              exit 1
+              ;;
+          esac
+
+          echo "environment=$ENVIRONMENT" >> "$GITHUB_OUTPUT"
+
       - name: Set cloud providers
         id: set-clouds
         run: |
@@ -166,8 +198,9 @@ jobs:
   # Deliberately carries no `concurrency` (#1801). The Terraform state guard is
   # the group on the called workflow's own build-and-deploy job, which runs as a
   # real job of this run and is serialized there. That group is derived from the
-  # called workflow's own `prepare` output, which is not necessarily the
-  # `environment` computed above, so do not assume the two agree.
+  # called workflow's own `prepare` output, which since #1805 is the
+  # `environment` computed above verbatim: `prepare` takes the non-empty input
+  # it is passed and fails the run rather than substituting a default.
   #
   # Putting that same group on this caller job would deadlock: this job would
   # hold the group while waiting on the inner job queued behind it. GitHub
@@ -263,7 +296,22 @@ jobs:
         run: |
           FAILED=false
 
-          if [[ "${{ needs.deploy-aws-lambda.result }}" == "failure" ]] || \
+          # determine-deployment is checked for anything other than success, not
+          # just "failure". When it stops the run the four deploy jobs are
+          # SKIPPED rather than failed, so testing only those would report "all
+          # deployments completed successfully" for a run that deployed nothing.
+          #
+          # The four deploy jobs are deliberately still tested for "failure"
+          # only. A CANCELLED run leaves them `cancelled` and reaches the
+          # success line, which is the same false report. That predates this
+          # change, so it is tracked in #1810 rather than fixed here.
+          #
+          # Note this step is the only success-by-default check in the repo. All
+          # four per-cloud `summary` jobs allowlist on `== "success"` instead,
+          # so an unenumerated result falls to their failure branch and errs
+          # safe. This denylist is the outlier, not the pattern.
+          if [[ "${{ needs.determine-deployment.result }}" != "success" ]] || \
+             [[ "${{ needs.deploy-aws-lambda.result }}" == "failure" ]] || \
              [[ "${{ needs.deploy-aws-fargate.result }}" == "failure" ]] || \
              [[ "${{ needs.deploy-gcp.result }}" == "failure" ]] || \
              [[ "${{ needs.deploy-azure.result }}" == "failure" ]]; then
@@ -272,7 +320,7 @@ jobs:
 
           if [ "$FAILED" = true ]; then
             echo "" >> $GITHUB_STEP_SUMMARY
-            echo "❌ **One or more deployments failed. Check individual job logs.**" >> $GITHUB_STEP_SUMMARY
+            echo "❌ **Deployment did not complete successfully. Check individual job logs.**" >> $GITHUB_STEP_SUMMARY
             exit 1
           else
             echo "" >> $GITHUB_STEP_SUMMARY

.github/workflows/deploy-aws-fargate.yml

@@ -74,24 +74,29 @@ jobs:
       - name: Determine environment
         id: set-env
         env:
-          EVENT_NAME: ${{ github.event_name }}
           INPUT_ENVIRONMENT: ${{ inputs.environment }}
         run: |
           set -euo pipefail
           INPUT_ENVIRONMENT="${INPUT_ENVIRONMENT:-}"
 
-          case "$EVENT_NAME" in
-            workflow_dispatch|workflow_call) ENVIRONMENT="$INPUT_ENVIRONMENT" ;;
-            *)                               ENVIRONMENT=dev ;;
-          esac
+          # workflow_dispatch and workflow_call are this workflow's only
+          # triggers and both declare `environment` as `required: true`, so the
+          # input is the single source of truth and there is nothing to fall
+          # back to. Branching on `github.event_name` here was issue #1805:
+          # inside a reusable workflow it reports the CALLER's event and is
+          # never "workflow_call", so a release-triggered caller passing
+          # environment=prod would have mis-resolved to a `dev` default arm.
+          # deploy-all.yml hardcodes this workflow off, so the case was latent
+          # here and live only for Azure and GCP.
+          ENVIRONMENT="$INPUT_ENVIRONMENT"
 
           # workflow_dispatch constrains this to the declared `choice` options,
           # but the workflow_call input is typed as a free-form string, so the
           # allowlist is enforced here rather than assumed.
           case "$ENVIRONMENT" in
             dev|staging|prod) ;;
             *)
-              echo "::error::Refusing unknown environment: $ENVIRONMENT"
+              echo "::error::Refusing unknown environment: '$ENVIRONMENT'"
               exit 1
               ;;
           esac

.github/workflows/deploy-aws-lambda.yml

@@ -107,25 +107,39 @@ jobs:
           set -euo pipefail
           INPUT_ENVIRONMENT="${INPUT_ENVIRONMENT:-}"
 
-          # Inside a reusable workflow `github.event_name` is the CALLER's
-          # event, so it is never "workflow_call" — a caller's free-form
-          # `inputs.environment` arrives through the workflow_dispatch arm.
-          # Caveat: the `*` arm forces dev, so a push-triggered caller would
-          # have its requested environment silently ignored. deploy-all.yml
-          # triggers only on workflow_dispatch and release today.
-          case "$EVENT_NAME" in
-            release)           TARGET_ENVIRONMENT=prod ;;
-            workflow_dispatch) TARGET_ENVIRONMENT="$INPUT_ENVIRONMENT" ;;
-            *)                 TARGET_ENVIRONMENT=dev ;;
-          esac
+          # Branch on whether an environment was REQUESTED, not on the event
+          # name. Inside a reusable workflow `github.event_name` is the CALLER's
+          # event and is never "workflow_call", so no event name can identify a
+          # workflow_call invocation (issue #1805). A non-empty input is always
+          # an explicit request and wins.
+          #
+          # An empty input means none was supplied, which this workflow's own
+          # `release` and `push` triggers are the legitimate causes of; every
+          # other event stops the run. Note that `release` is inherited by a
+          # workflow_call from a release-triggered caller, so a caller passing
+          # an EMPTY environment would resolve to prod here rather than
+          # failing. deploy-all.yml is the only caller and allowlists the value
+          # it passes, so that cannot happen. Telling the two apart would need
+          # `github.job_workflow_ref`, which is not worth the machinery for an
+          # unreachable path.
+          if [ -n "$INPUT_ENVIRONMENT" ]; then
+            TARGET_ENVIRONMENT="$INPUT_ENVIRONMENT"
+          elif [ "$EVENT_NAME" = release ]; then
+            TARGET_ENVIRONMENT=prod
+          elif [ "$EVENT_NAME" = push ]; then
+            TARGET_ENVIRONMENT=dev
+          else
+            echo "::error::No environment supplied on a '$EVENT_NAME'-triggered run; refusing to guess a deployment target."
+            exit 1
+          fi
 
           # workflow_dispatch constrains this to the declared `choice` options,
           # but the workflow_call input is typed as a free-form string, so the
           # allowlist is enforced here rather than assumed.
           case "$TARGET_ENVIRONMENT" in
             dev|staging|prod) ;;
             *)
-              echo "::error::Refusing unknown environment: $TARGET_ENVIRONMENT"
+              echo "::error::Refusing unknown environment: '$TARGET_ENVIRONMENT'"
               exit 1
               ;;
           esac

.github/workflows/deploy-azure.yml

@@ -85,18 +85,38 @@ jobs:
           set -euo pipefail
           INPUT_ENVIRONMENT="${INPUT_ENVIRONMENT:-}"
 
-          case "$EVENT_NAME" in
-            workflow_dispatch|workflow_call) ENVIRONMENT="$INPUT_ENVIRONMENT" ;;
-            *)                               ENVIRONMENT=dev ;;
-          esac
+          # Branch on whether an environment was REQUESTED, not on the event
+          # name. Inside a reusable workflow `github.event_name` is the CALLER's
+          # event and is never "workflow_call", so no event name can identify a
+          # workflow_call invocation: a release-triggered deploy-all.yml passing
+          # environment=prod would have landed on a `dev` default arm and
+          # resolved to dev while the summary said prod (issue #1805).
+          #
+          # `inputs` is populated on workflow_dispatch and workflow_call, the
+          # only two triggers that carry an environment, so a non-empty input is
+          # always an explicit request and wins. An empty input means none was
+          # supplied: under `push` that is this workflow's own main-branch
+          # deploy and means dev, and every other event stops the run rather
+          # than guessing. A workflow_call from a push-triggered caller would
+          # read as `push` here too, since `github.event_name` is inherited, but
+          # deploy-all.yml is the only caller, has no push trigger, and
+          # allowlists the value it passes.
+          if [ -n "$INPUT_ENVIRONMENT" ]; then
+            ENVIRONMENT="$INPUT_ENVIRONMENT"
+          elif [ "$EVENT_NAME" = push ]; then
+            ENVIRONMENT=dev
+          else
+            echo "::error::No environment supplied on a '$EVENT_NAME'-triggered run; refusing to guess a deployment target."
+            exit 1
+          fi
 
           # workflow_dispatch constrains this to the declared `choice` options,
           # but the workflow_call input is typed as a free-form string, so the
           # allowlist is enforced here rather than assumed.
           case "$ENVIRONMENT" in
             dev|staging|prod) ;;
             *)
-              echo "::error::Refusing unknown environment: $ENVIRONMENT"
+              echo "::error::Refusing unknown environment: '$ENVIRONMENT'"
               exit 1
               ;;
           esac

.github/workflows/deploy-gcp.yml

@@ -72,18 +72,38 @@ jobs:
           set -euo pipefail
           INPUT_ENVIRONMENT="${INPUT_ENVIRONMENT:-}"
 
-          case "$EVENT_NAME" in
-            workflow_dispatch|workflow_call) ENVIRONMENT="$INPUT_ENVIRONMENT" ;;
-            *)                               ENVIRONMENT=dev ;;
-          esac
+          # Branch on whether an environment was REQUESTED, not on the event
+          # name. Inside a reusable workflow `github.event_name` is the CALLER's
+          # event and is never "workflow_call", so no event name can identify a
+          # workflow_call invocation: a release-triggered deploy-all.yml passing
+          # environment=prod would have landed on a `dev` default arm and
+          # resolved to dev while the summary said prod (issue #1805).
+          #
+          # `inputs` is populated on workflow_dispatch and workflow_call, the
+          # only two triggers that carry an environment, so a non-empty input is
+          # always an explicit request and wins. An empty input means none was
+          # supplied: under `push` that is this workflow's own main-branch
+          # deploy and means dev, and every other event stops the run rather
+          # than guessing. A workflow_call from a push-triggered caller would
+          # read as `push` here too, since `github.event_name` is inherited, but
+          # deploy-all.yml is the only caller, has no push trigger, and
+          # allowlists the value it passes.
+          if [ -n "$INPUT_ENVIRONMENT" ]; then
+            ENVIRONMENT="$INPUT_ENVIRONMENT"
+          elif [ "$EVENT_NAME" = push ]; then
+            ENVIRONMENT=dev
+          else
+            echo "::error::No environment supplied on a '$EVENT_NAME'-triggered run; refusing to guess a deployment target."
+            exit 1
+          fi
 
           # workflow_dispatch constrains this to the declared `choice` options,
           # but the workflow_call input is typed as a free-form string, so the
           # allowlist is enforced here rather than assumed.
           case "$ENVIRONMENT" in
             dev|staging|prod) ;;
             *)
-              echo "::error::Refusing unknown environment: $ENVIRONMENT"
+              echo "::error::Refusing unknown environment: '$ENVIRONMENT'"
               exit 1
               ;;
           esac