feat(deploy)!: option to require approval for deployment builds

api/build/enqueue.go

@@ -111,5 +111,10 @@ func ShouldEnqueue(c *gin.Context, l *logrus.Entry, b *types.Build, r *types.Rep
 		}
 	}
 
+	// check if repo has deploy approval enabled
+	if b.GetEvent() == constants.EventDeploy && r.GetApproveDeploy() {
+		return false, nil
+	}
+
 	return true, nil
 }

api/repo/create.go

@@ -123,6 +123,11 @@ func CreateRepo(c *gin.Context) {
 		r.SetActive(input.GetActive())
 	}
 
+	// set approve deploy based on input (false by default)
+	if input.ApproveDeploy != nil {
+		r.SetApproveDeploy(input.GetApproveDeploy())
+	}
+
 	// set the build limit field based off the input provided
 	if input.GetBuildLimit() == 0 {
 		// default build limit to value configured by server

api/repo/update.go

@@ -169,6 +169,11 @@ func UpdateRepo(c *gin.Context) {
 		r.SetActive(input.GetActive())
 	}
 
+	if input.ApproveDeploy != nil {
+		// update approve deploy if set
+		r.SetApproveDeploy(input.GetApproveDeploy())
+	}
+
 	// set allow events based on input if given
 	if input.AllowEvents != nil {
 		r.SetAllowEvents(input.GetAllowEvents())

api/types/repo.go

@@ -37,6 +37,7 @@ type Repo struct {
 	ApprovalTimeout  *int32          `json:"approval_timeout,omitempty"`
 	InstallID        *int64          `json:"install_id,omitempty"`
 	CustomProps      *map[string]any `json:"custom_props,omitempty"`
+	ApproveDeploy    *bool           `json:"approve_deploy,omitempty"`
 }
 
 // Environment returns a list of environment variables
@@ -63,7 +64,7 @@ func (r *Repo) Environment() map[string]string {
 		"VELA_REPO_OWNER":            ToString(r.GetOwner().GetName()),
 		"VELA_REPO_INSTALL_ID":       ToString(r.GetInstallID()),
 		"VELA_REPO_CUSTOM_PROPS":     ToString(r.GetCustomProps()),
-
+		"VELA_REPO_APPROVE_DEPLOY":   ToString(r.GetApproveDeploy()),
 		// deprecated environment variables
 		"REPOSITORY_ACTIVE":       ToString(r.GetActive()),
 		"REPOSITORY_ALLOW_EVENTS": strings.Join(r.GetAllowEvents().List()[:], ","),
@@ -418,6 +419,19 @@ func (r *Repo) GetCustomProps() map[string]any {
 	return *r.CustomProps
 }
 
+// GetApproveDeploy returns the ApproveDeploy field.
+//
+// When the provided Repo type is nil, or the field within
+// the type is nil, it returns the zero value for the field.
+func (r *Repo) GetApproveDeploy() bool {
+	// return zero value if Repo type or ApproveDeploy field is nil
+	if r == nil || r.ApproveDeploy == nil {
+		return false
+	}
+
+	return *r.ApproveDeploy
+}
+
 // SetID sets the ID field.
 //
 // When the provided Repo type is nil, it
@@ -756,13 +770,27 @@ func (r *Repo) SetCustomProps(v map[string]any) {
 	r.CustomProps = &v
 }
 
+// SetApproveDeploy sets the ApproveDeploy field.
+//
+// When the provided Repo type is nil, it
+// will set nothing and immediately return.
+func (r *Repo) SetApproveDeploy(v bool) {
+	// return if Repo type is nil
+	if r == nil {
+		return
+	}
+
+	r.ApproveDeploy = &v
+}
+
 // String implements the Stringer interface for the Repo type.
 func (r *Repo) String() string {
 	return fmt.Sprintf(`{
   Active: %t,
   AllowEvents: %s,
   ApprovalTimeout: %d,
   ApproveBuild: %s,
+  ApproveDeploy: %t,
   Branch: %s,
   BuildLimit: %d,
   Clone: %s,
@@ -789,6 +817,7 @@ func (r *Repo) String() string {
 		r.GetAllowEvents().List(),
 		r.GetApprovalTimeout(),
 		r.GetApproveBuild(),
+		r.GetApproveDeploy(),
 		r.GetBranch(),
 		r.GetBuildLimit(),
 		r.GetClone(),

api/types/repo_test.go

@@ -35,6 +35,7 @@ func TestTypes_Repo_Environment(t *testing.T) {
 		"VELA_REPO_OWNER":            "octocat",
 		"VELA_REPO_INSTALL_ID":       "123",
 		"VELA_REPO_CUSTOM_PROPS":     `{"foo":"bar"}`,
+		"VELA_REPO_APPROVE_DEPLOY":   "false",
 		"REPOSITORY_ACTIVE":          "true",
 		"REPOSITORY_ALLOW_EVENTS":    "push,pull_request:opened,pull_request:synchronize,pull_request:reopened,pull_request:unlabeled,tag,comment:created,schedule,delete:branch",
 		"REPOSITORY_BRANCH":          "main",
@@ -170,6 +171,10 @@ func TestTypes_Repo_Getters(t *testing.T) {
 		if !reflect.DeepEqual(test.repo.GetCustomProps(), test.want.GetCustomProps()) {
 			t.Errorf("GetCustomProps is %v, want %v", test.repo.GetCustomProps(), test.want.GetCustomProps())
 		}
+
+		if test.repo.GetApproveDeploy() != test.want.GetApproveDeploy() {
+			t.Errorf("GetApproveDeploy is %v, want %v", test.repo.GetApproveDeploy(), test.want.GetApproveDeploy())
+		}
 	}
 }
 
@@ -219,6 +224,7 @@ func TestTypes_Repo_Setters(t *testing.T) {
 		test.repo.SetApprovalTimeout(test.want.GetApprovalTimeout())
 		test.repo.SetInstallID(test.want.GetInstallID())
 		test.repo.SetCustomProps(test.want.GetCustomProps())
+		test.repo.SetApproveDeploy(test.want.GetApproveDeploy())
 
 		if test.repo.GetID() != test.want.GetID() {
 			t.Errorf("SetID is %v, want %v", test.repo.GetID(), test.want.GetID())
@@ -315,6 +321,10 @@ func TestTypes_Repo_Setters(t *testing.T) {
 		if !reflect.DeepEqual(test.repo.GetCustomProps(), test.want.GetCustomProps()) {
 			t.Errorf("SetCustomProps is %v, want %v", test.repo.GetCustomProps(), test.want.GetCustomProps())
 		}
+
+		if test.repo.GetApproveDeploy() != test.want.GetApproveDeploy() {
+			t.Errorf("SetApproveDeploy is %v, want %v", test.repo.GetApproveDeploy(), test.want.GetApproveDeploy())
+		}
 	}
 }
 
@@ -327,6 +337,7 @@ func TestTypes_Repo_String(t *testing.T) {
   AllowEvents: %s,
   ApprovalTimeout: %d,
   ApproveBuild: %s,
+  ApproveDeploy: %t,
   Branch: %s,
   BuildLimit: %d,
   Clone: %s,
@@ -353,6 +364,7 @@ func TestTypes_Repo_String(t *testing.T) {
 		r.GetAllowEvents().List(),
 		r.GetApprovalTimeout(),
 		r.GetApproveBuild(),
+		r.GetApproveDeploy(),
 		r.GetBranch(),
 		r.GetBuildLimit(),
 		r.GetClone(),
@@ -416,6 +428,7 @@ func testRepo() *Repo {
 	r.SetApprovalTimeout(7)
 	r.SetInstallID(123)
 	r.SetCustomProps(map[string]any{"foo": "bar"})
+	r.SetApproveDeploy(false)
 
 	return r
 }

database/integration_test.go

@@ -2862,6 +2862,7 @@ func newResources() *Resources {
 	repoOne.SetApprovalTimeout(7)
 	repoOne.SetInstallID(0)
 	repoOne.SetCustomProps(map[string]any{"foo": "bar"})
+	repoOne.SetApproveDeploy(false)
 
 	repoTwo := new(api.Repo)
 	repoTwo.SetID(2)
@@ -2890,6 +2891,7 @@ func newResources() *Resources {
 	repoTwo.SetApprovalTimeout(7)
 	repoTwo.SetInstallID(0)
 	repoTwo.SetCustomProps(map[string]any{"foo": "bar"})
+	repoTwo.SetApproveDeploy(false)
 
 	buildOne := new(api.Build)
 	buildOne.SetID(1)

database/repo/create_test.go

@@ -40,9 +40,9 @@ func TestRepo_Engine_CreateRepo(t *testing.T) {
 
 	// ensure the mock expects the query
 	_mock.ExpectQuery(`INSERT INTO "repos"
-("user_id","hash","org","name","full_name","link","clone","branch","topics","build_limit","timeout","counter","hook_counter","visibility","private","trusted","active","allow_events","merge_queue_events","pipeline_type","previous_name","approve_build","approval_timeout","install_id","custom_props","id")
-VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26) RETURNING "id"`).
-		WithArgs(1, AnyArgument{}, "foo", "bar", "foo/bar", "", "", "", AnyArgument{}, AnyArgument{}, AnyArgument{}, AnyArgument{}, AnyArgument{}, "public", false, false, false, 0, nil, "yaml", "oldName", "", 0, 0, `{"foo":"bar"}`, 1).
+("user_id","hash","org","name","full_name","link","clone","branch","topics","build_limit","timeout","counter","hook_counter","visibility","private","trusted","active","allow_events","merge_queue_events","pipeline_type","previous_name","approve_build","approval_timeout","install_id","custom_props","approve_deploy","id")
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26,$27) RETURNING "id"`).
+		WithArgs(1, AnyArgument{}, "foo", "bar", "foo/bar", "", "", "", AnyArgument{}, AnyArgument{}, AnyArgument{}, AnyArgument{}, AnyArgument{}, "public", false, false, false, 0, nil, "yaml", "oldName", "", 0, 0, `{"foo":"bar"}`, false, 1).
 		WillReturnRows(_rows)
 
 	_sqlite := testSqlite(t)

database/repo/table.go

@@ -40,6 +40,7 @@ repos (
 	approval_timeout   INTEGER,
 	install_id         BIGINT,
 	custom_props       JSON DEFAULT NULL,
+	approve_deploy     BOOLEAN,
 	UNIQUE(full_name)
 );
 `
@@ -75,6 +76,7 @@ repos (
 	approval_timeout   INTEGER,
 	install_id         INTEGER,
 	custom_props       TEXT,
+	approve_deploy     BOOLEAN,
 	UNIQUE(full_name)
 );
 `

database/repo/update_test.go

@@ -31,16 +31,17 @@ func TestRepo_Engine_UpdateRepo(t *testing.T) {
 	_repo.SetAllowEvents(api.NewEventsFromMask(1))
 	_repo.SetApprovalTimeout(5)
 	_repo.SetCustomProps(map[string]any{"foo": "bar"})
+	_repo.SetApproveDeploy(false)
 
 	_postgres, _mock := testPostgres(t)
 
 	defer func() { _sql, _ := _postgres.client.DB(); _sql.Close() }()
 
 	// ensure the mock expects the query
 	_mock.ExpectExec(`UPDATE "repos"
-SET "user_id"=$1,"hash"=$2,"org"=$3,"name"=$4,"full_name"=$5,"link"=$6,"clone"=$7,"branch"=$8,"topics"=$9,"build_limit"=$10,"timeout"=$11,"counter"=$12,"hook_counter"=$13,"visibility"=$14,"private"=$15,"trusted"=$16,"active"=$17,"allow_events"=$18,"merge_queue_events"=$19,"pipeline_type"=$20,"previous_name"=$21,"approve_build"=$22,"approval_timeout"=$23,"install_id"=$24,"custom_props"=$25
-WHERE "id" = $26`).
-		WithArgs(1, AnyArgument{}, "foo", "bar", "foo/bar", "", "", "", AnyArgument{}, AnyArgument{}, AnyArgument{}, AnyArgument{}, AnyArgument{}, "public", false, false, false, 1, nil, "yaml", "oldName", constants.ApproveForkAlways, 5, 0, `{"foo":"bar"}`, 1).
+SET "user_id"=$1,"hash"=$2,"org"=$3,"name"=$4,"full_name"=$5,"link"=$6,"clone"=$7,"branch"=$8,"topics"=$9,"build_limit"=$10,"timeout"=$11,"counter"=$12,"hook_counter"=$13,"visibility"=$14,"private"=$15,"trusted"=$16,"active"=$17,"allow_events"=$18,"merge_queue_events"=$19,"pipeline_type"=$20,"previous_name"=$21,"approve_build"=$22,"approval_timeout"=$23,"install_id"=$24,"custom_props"=$25,"approve_deploy"=$26
+WHERE "id" = $27`).
+		WithArgs(1, AnyArgument{}, "foo", "bar", "foo/bar", "", "", "", AnyArgument{}, AnyArgument{}, AnyArgument{}, AnyArgument{}, AnyArgument{}, "public", false, false, false, 1, nil, "yaml", "oldName", constants.ApproveForkAlways, 5, 0, `{"foo":"bar"}`, false, 1).
 		WillReturnResult(sqlmock.NewResult(1, 1))
 
 	_sqlite := testSqlite(t)

database/testutils/api_resources.go

@@ -133,6 +133,7 @@ func APIRepo() *api.Repo {
 		ApprovalTimeout:  new(int32),
 		InstallID:        new(int64),
 		CustomProps:      new(map[string]any),
+		ApproveDeploy:    new(bool),
 	}
 }
 

database/types/repo.go

@@ -76,6 +76,7 @@ type (
 		ApprovalTimeout  sql.NullInt32   `sql:"approval_timeout"`
 		InstallID        sql.NullInt64   `sql:"install_id"`
 		CustomProps      CustomPropsJSON `sql:"custom_props"`
+		ApproveDeploy    sql.NullBool    `sql:"approve_deploy"`
 
 		Owner User `gorm:"foreignKey:UserID"`
 	}
@@ -199,6 +200,7 @@ func (r *Repo) ToAPI() *api.Repo {
 	repo.SetApprovalTimeout(r.ApprovalTimeout.Int32)
 	repo.SetInstallID(r.InstallID.Int64)
 	repo.SetCustomProps(r.CustomProps)
+	repo.SetApproveDeploy(r.ApproveDeploy.Bool)
 
 	return repo
 }
@@ -293,6 +295,7 @@ func RepoFromAPI(r *api.Repo) *Repo {
 		ApproveBuild:    sql.NullString{String: r.GetApproveBuild(), Valid: r.ApproveBuild != nil},
 		ApprovalTimeout: sql.NullInt32{Int32: r.GetApprovalTimeout(), Valid: r.ApprovalTimeout != nil},
 		InstallID:       sql.NullInt64{Int64: r.GetInstallID(), Valid: r.InstallID != nil},
+		ApproveDeploy:   sql.NullBool{Bool: r.GetApproveDeploy(), Valid: r.ApproveDeploy != nil},
 	}
 
 	if r.Topics != nil {

database/types/repo_test.go

@@ -147,6 +147,7 @@ func TestTypes_Repo_ToAPI(t *testing.T) {
 	want.SetApprovalTimeout(7)
 	want.SetInstallID(0)
 	want.SetCustomProps(map[string]any{"foo": "bar"})
+	want.SetApproveDeploy(false)
 
 	// run test
 	got := testRepo().ToAPI()
@@ -304,6 +305,7 @@ func TestTypes_RepoFromAPI(t *testing.T) {
 	r.SetApprovalTimeout(7)
 	r.SetInstallID(0)
 	r.SetCustomProps(map[string]any{"foo": "bar"})
+	r.SetApproveDeploy(false)
 
 	want := testRepo()
 	want.Owner = User{}
@@ -346,6 +348,7 @@ func testRepo() *Repo {
 		ApprovalTimeout:  sql.NullInt32{Int32: 7, Valid: true},
 		InstallID:        sql.NullInt64{Int64: 0, Valid: true},
 		CustomProps:      CustomPropsJSON{"foo": "bar"},
+		ApproveDeploy:    sql.NullBool{Bool: false, Valid: true},
 
 		Owner: *testUser(),
 	}

docker-compose.yml

@@ -76,7 +76,7 @@ services:
   # https://go-vela.github.io/docs/administration/worker/
   worker:
     container_name: worker
-    image: target/vela-worker:latest
+    image: ${VELA_WORKER_IMAGE:-target/vela-worker:latest}
     networks:
       - vela
     environment:

mock/server/repo.go

@@ -66,7 +66,8 @@ const (
   "install_id": 0,
   "custom_props": {
 	"foo": "bar"
-  }
+  },
+  "approve_deploy": false
 }`
 
 	// ReposResp represents a JSON return for one to many repos.

router/middleware/repo/repo_test.go

@@ -72,6 +72,7 @@ func TestRepo_Establish(t *testing.T) {
 	want.SetApprovalTimeout(7)
 	want.SetInstallID(0)
 	want.SetCustomProps(map[string]any{"foo": "bar"})
+	want.SetApproveDeploy(false)
 
 	got := new(api.Repo)