51 lines
1.4 KiB
YAML
51 lines
1.4 KiB
YAML
name: ForgeFlow rollback
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
environment:
|
|
description: Fixed ForgeFlow deployment environment
|
|
required: true
|
|
default: production
|
|
target_sha:
|
|
description: Exact previously successful commit verified by ForgeFlow
|
|
required: true
|
|
request_id:
|
|
description: ForgeFlow correlation identifier
|
|
required: true
|
|
|
|
concurrency:
|
|
group: forgeflow-${{ gitea.repository }}-${{ inputs.environment }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
rollback:
|
|
runs-on: forgeflow-production
|
|
steps:
|
|
- name: Validate rollback inputs
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
[[ "${{ inputs.environment }}" =~ ^[a-z0-9][a-z0-9._-]{0,63}$ ]] || {
|
|
echo "Invalid environment identifier" >&2
|
|
exit 64
|
|
}
|
|
[[ "${{ inputs.target_sha }}" =~ ^[0-9a-fA-F]{40,64}$ ]] || {
|
|
echo "Invalid target SHA" >&2
|
|
exit 64
|
|
}
|
|
[[ "${{ inputs.request_id }}" =~ ^[A-Za-z0-9._:-]{1,100}$ ]] || {
|
|
echo "Invalid request identifier" >&2
|
|
exit 64
|
|
}
|
|
|
|
- name: Restore exact allowlisted version
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
sudo /usr/local/bin/forgeflow-deploy \
|
|
"${{ gitea.repository }}" \
|
|
"${{ inputs.environment }}" \
|
|
"${{ inputs.target_sha }}" \
|
|
"${{ inputs.request_id }}"
|