Repository navigation
Application approval: manual is validated but deploy never enforces it #106
Description
Found while writing the CI deploy guide for #89 (PR #104).
Application.spec.approval accepts automatic or manual (config/schemas/v1/application.schema.json). inventory.py parses it into DeploymentApproval and writes it into the inventory, but nothing reads it: cloudfall deploy --yes deploys an application declared approval: manual exactly as it deploys an automatic one. The example config/examples/applications/crm.yaml declares manual, and the Render importer writes "approval": "manual" for every application it imports, so imported projects look gated and aren't.
Checked on main (348ed73): the only references to DeploymentApproval outside tests are its definition in sdk/src/cloudfall/domain.py, the parse and serialisation in sdk/src/cloudfall/inventory.py, and the importer.
What would fix it
Either:
deployhonoursmanual: for example, it refuses--yesfor amanualapplication unless an approval record (the operator's decision store) names that release, so an agent or a CI job can't approve its own deploy- or the field is documented as advisory, or deprecated, and the importer stops writing it
The CI guide in #104 tells teams to use GitHub's required reviewers as the real gate meanwhile.
Activity
shipmill-romamo commentedon Oct 20, 2026
Triage: needs a decision. Confirmed on main (a9167f5):
approval: manualis parsed intoDeploymentApprovaland written into the inventory, and nothing reads it, socloudfall deploy --yestreatsmanualandautomaticthe same. The examplecrm.yamland every application the Render importer writes saymanual. Waits on your decision below.shipmill-romamo commentedon Oct 20, 2026
@romamo Decision needed: should
deployenforceapproval: manual, or should the field stop claiming a gate?deploy --yeson amanualapplication refuses unless an approval in the operator's decision store names that release, so an agent or a CI job can't approve its own deploy. That fits "Cloudfall is the conscience", but it breaks every project that declaresmanualand deploys with--yestoday, the example and imported projects included. It needs a spec and a Breaking changelog entrymanualis a declaration for the operator and the CI environment's reviewers, and the importer keeps writing it. No user breaks, but the record still carries a field that gates nothingReply here with a number or your own answer; shipmill takes this up on the tick after your reply.