Deploy mode: redeem the merged PR's approval on push (v2.3.0)

[rodchalski]

What

Deploy Gate can now gate the deploy, not just the merge. On push / workflow_dispatch it:

1. Finds the PR that merged the pushed commit: GET /repos/{repo}/commits/{sha}/pulls, keeping only merged PRs whose merge_commit_sha is the pushed SHA and whose base is the pushed branch.
2. Verifies the receipt for that PR's head SHA, with the same scope (repo, prNumber, headSha, env, capability) the PR gate used.
3. Redeems it, so one approval ships once.

This is the "protected CI workflow" the PP app tells Vercel, Netlify, Railway and Fly.io users to set up; until now none worked. Running the action on push crashed: PP_PR_NUMBER is empty outside pull_request, and jq --argjson prNumber "" errors.

Fails closed

Case	Error
Direct push, or a commit no PR merged into this branch	PP_NO_MERGED_PR
PR lookup fails (e.g. missing pull-requests: read), or the response is unreadable	PP_PR_LOOKUP_FAILED
mode: deploy on a pull_request event	PP_UNSUPPORTED_EVENT
Tag ref	PP_UNSUPPORTED_REF
redeem: false or fail-on-missing: false in deploy mode	PP_INVALID_CONFIG
mode: pr without a PR	PP_NO_PR_CONTEXT (previously a jq crash)

None of these call PP. Receipt errors (RECEIPT_NOT_FOUND, RECEIPT_ALREADY_REDEEMED, RECEIPT_EXPIRED) keep their existing handling, with deploy-specific messages. RECEIPT_EXPIRED prints reapproval.approvalUrl when PP reports autoRenewEligible.

Compatibility

• mode defaults to auto. Existing pull_request workflows run in pr mode, which behaves as before.
• redeem now defaults to '', which means false in pr mode (same as the old default) and true in deploy mode. Explicit redeem: true in a PR gate is unchanged.
• Push workflows were broken before, so none of them lose working behavior.

Known limit (server side, not this PR)

Production approvals expire 15 minutes after signing, and PP refuses to renew an approval once the PR is merged. A PR merged more than 15 minutes after approval therefore fails deploy with RECEIPT_EXPIRED and has no renew path. Auto-merge avoids this. The fix belongs in the PP app's re-approval rules. INSTALL.md states the limit.

Tests

test/run-tests.sh extracts the action's run: block and runs it against stubbed gh and curl, asserting exit codes, outputs and the exact request body sent to PP. It runs in the new Test workflow.

• Locally: 69 passed, 0 failed.
• Mutation check: dropping the merge_commit_sha match, or turning off redeem in deploy mode, makes the suite fail.

Release

Not tagged. After merge: tag v2.3.0 and move v2. Note that v2 currently points at v2.1.0 (fbf265b), so moving it also ships v2.2.0's draft-PR skip to every @v2 user.

🤖 Generated with Claude Code

[github-actions]

✅ Permission Protocol: Approved
View receipt →

[permission-protocol]

🔒 Permission Protocol

✅ Approved — human authorization recorded. View receipt
Request: 40e44e27-bb10-45cb-b0d8-c80181ba9641 · Commit: 1bcb653

---

Approval brief

Affected flow: Production deployment gating on push or workflow_dispatch events.

Why this change: The action previously crashed on push events because it lacked PR context; it now supports gating the actual deploy by redeeming merged PR approvals.

What changes for users/operators: Users can now gate deployments on push to main. The action finds the merged PR, verifies its approval receipt, and redeems it to ensure one approval ships once.

Blast radius:

• Affected: Build, routing, or release behavior
• Not indicated: auth, database, billing, secrets

⚠️ What this change risks

This change modifies the core CI/CD gating logic and introduces infrastructure-level automation scripts, which are high-risk if they incorrectly block the release pipeline.

• Risk: 🔴 High — CI/CD
• Impact: If incorrect, deployments on push will fail with errors like PP_NO_MERGED_PR or PP_PR_LOOKUP_FAILED, blocking production releases even for approved code.
• Files: .github/workflows/test.yml, action.yml, test/run-tests.sh, INSTALL.md, +1 more
• Status: ✅ Approved — receipt

---

✅ View authorization receipt →

_{Authorization recorded; use the checks below as merge/deploy verification evidence.}

---

✅ Verify before authorizing

• Confirm the action.yml 'mode' input defaults to 'auto' to support both PR and push events.
• Verify the script correctly handles the 'pull-requests: read' permission requirement for PR lookup.
• Check that 'redeem: false' is explicitly rejected in deploy mode to prevent unredeemed shipping.

📋 Why was this flagged?

• The action now supports a 'deploy' mode that finds and redeems merged PR approvals on push events.
• Running the action on push previously crashed due to empty PR numbers and jq errors.
• The change introduces specific error codes like PP_NO_MERGED_PR and PP_PR_LOOKUP_FAILED for failure cases.
• A new test suite and CI workflow were added to verify the action script logic.

---

_{🔒 Permission Protocol · Decision: approved with human authorization}