Repository navigation
Application approval: manual is validated but deploy never enforces it #106
Description
Found while writing the CI deploy guide for #89 (PR #104).
Application.spec.approval accepts automatic or manual (config/schemas/v1/application.schema.json). inventory.py parses it into DeploymentApproval and writes it into the inventory, but nothing reads it: cloudfall deploy --yes deploys an application declared approval: manual exactly as it deploys an automatic one. The example config/examples/applications/crm.yaml declares manual, and the Render importer writes "approval": "manual" for every application it imports, so imported projects look gated and aren't.
Checked on main (348ed73): the only references to DeploymentApproval outside tests are its definition in sdk/src/cloudfall/domain.py, the parse and serialisation in sdk/src/cloudfall/inventory.py, and the importer.
What would fix it
Either:
deployhonoursmanual: for example, it refuses--yesfor amanualapplication unless an approval record (the operator's decision store) names that release, so an agent or a CI job can't approve its own deploy- or the field is documented as advisory, or deprecated, and the importer stops writing it
The CI guide in #104 tells teams to use GitHub's required reviewers as the real gate meanwhile.
Activity
shipmill-romamo commentedon Oct 20, 2026
Triage: needs a decision. Confirmed on main (a9167f5):
approval: manualis parsed intoDeploymentApprovaland written into the inventory, and nothing reads it, socloudfall deploy --yestreatsmanualandautomaticthe same. The examplecrm.yamland every application the Render importer writes saymanual. Waits on your decision below.shipmill-romamo commentedon Oct 20, 2026
@romamo Decision needed: should
deployenforceapproval: manual, or should the field stop claiming a gate?deploy --yeson amanualapplication refuses unless an approval in the operator's decision store names that release, so an agent or a CI job can't approve its own deploy. That fits "Cloudfall is the conscience", but it breaks every project that declaresmanualand deploys with--yestoday, the example and imported projects included. It needs a spec and a Breaking changelog entrymanualis a declaration for the operator and the CI environment's reviewers, and the importer keeps writing it. No user breaks, but the record still carries a field that gates nothingReply here with a number or your own answer; shipmill takes this up on the tick after your reply.
romamo commentedon Oct 27, 2026
1
shipmill-romamo commentedon Oct 27, 2026
Triage: feature, on your answer (1).
deploy --yeson amanualapplication will refuse unless a person approved that exact release, so an agent or a CI job can't approve its own deploy. That is a new command, a new record and a breaking change for every project that declaresmanualand deploys with--yestoday, so it goes through a spec rather than a fix.The spec is in #128 (
docs/specs/008-enforce-manual-approval.md), with its acceptance criteria and the choices under "Decisions for you" in its body. Merging it is the approval, as is an answer on it that takes every recommendation, after which shipmill merges it once it is green; the build starts once it merges.On hold: the build waits on #128, the spec
Spec manual deployment approval for #106 (#128)
shipmill-romamo commentedon Oct 31, 2026
Released in v0.8.0rc14 (pre-release).
A plain install gets it with the next stable release.
If you filed this: react 👍 on this comment once it works for you, or reply if it doesn't.