From fcad24fa8685f1f8402bd34961d192061bde737a Mon Sep 17 00:00:00 2001 From: Derek Roberts Date: Mon, 20 Jul 2026 10:48:00 -0700 Subject: [PATCH 1/7] fix(ci): allow deploy cleanup on all workflow events --- .github/workflows/.deploy.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/.deploy.yml b/.github/workflows/.deploy.yml index d5f05d70..78dbde18 100644 --- a/.github/workflows/.deploy.yml +++ b/.github/workflows/.deploy.yml @@ -62,8 +62,7 @@ jobs: timeout-minutes: ${{ inputs.timeout-minutes }} steps: - uses: actions/checkout@v7 - - name: Stop pre-existing deployments on PRs (status = pending-upgrade) - if: github.event_name == 'pull_request' + - name: Stop pre-existing deployments (status = pending-upgrade) uses: bcgov/action-oc-runner@111868d1fc50db0a40417ba321d865ef5c931bbd # v1.7.0 with: oc_namespace: ${{ vars.oc_namespace }} @@ -72,7 +71,7 @@ jobs: triggers: ${{ inputs.triggers }} commands: | set -euo pipefail - # Interrupt any previous deployments (PR only) + # Interrupt any previous deployments PREVIOUS=$(helm status ${{ inputs.release_name }} -o json | jq .info.status || true) if [[ ${PREVIOUS} =~ pending ]]; then echo "Rollback triggered" From 78c5c70f4dc016d9abd356f4b02be0209a0470c7 Mon Sep 17 00:00:00 2001 From: Derek Roberts Date: Thu, 23 Jul 2026 15:00:26 -0700 Subject: [PATCH 2/7] fix(ci): rename deploy cleanup step to match any pending status --- .github/workflows/.deploy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/.deploy.yml b/.github/workflows/.deploy.yml index 78dbde18..279ee5a0 100644 --- a/.github/workflows/.deploy.yml +++ b/.github/workflows/.deploy.yml @@ -62,7 +62,7 @@ jobs: timeout-minutes: ${{ inputs.timeout-minutes }} steps: - uses: actions/checkout@v7 - - name: Stop pre-existing deployments (status = pending-upgrade) + - name: Stop pre-existing deployments (status = pending-*) uses: bcgov/action-oc-runner@111868d1fc50db0a40417ba321d865ef5c931bbd # v1.7.0 with: oc_namespace: ${{ vars.oc_namespace }} From d97b9124bba7385be90ea180c8354baa0a5f21de Mon Sep 17 00:00:00 2001 From: Derek Roberts Date: Thu, 23 Jul 2026 15:03:26 -0700 Subject: [PATCH 3/7] fix(ci): prevent helm uninstall on persistent environments during rollback fallback --- .github/workflows/.deploy.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/.deploy.yml b/.github/workflows/.deploy.yml index 279ee5a0..a5b2d50a 100644 --- a/.github/workflows/.deploy.yml +++ b/.github/workflows/.deploy.yml @@ -75,8 +75,14 @@ jobs: PREVIOUS=$(helm status ${{ inputs.release_name }} -o json | jq .info.status || true) if [[ ${PREVIOUS} =~ pending ]]; then echo "Rollback triggered" - helm rollback ${{ inputs.release_name }} || \ - helm uninstall ${{ inputs.release_name }} + if [ -n "${{ inputs.environment }}" ]; then + # Safe rollback only; never uninstall persistent environments (prod/test) + helm rollback ${{ inputs.release_name }} + else + # Fallback to uninstall permitted for ephemeral PR deployments + helm rollback ${{ inputs.release_name }} || \ + helm uninstall ${{ inputs.release_name }} + fi fi - name: Deploy From 482ebbf71d51791d53bed3dbdbc93965b7a1515a Mon Sep 17 00:00:00 2001 From: Derek Roberts Date: Thu, 23 Jul 2026 15:06:00 -0700 Subject: [PATCH 4/7] feat(ci): add helm.sh/resource-policy keep annotation to database PVC on non-PR environments --- .github/workflows/.deploy.yml | 3 +++ charts/pubcode/templates/database/templates/pvc.yml | 4 ++++ charts/pubcode/values.yaml | 1 + 3 files changed, 8 insertions(+) diff --git a/.github/workflows/.deploy.yml b/.github/workflows/.deploy.yml index a5b2d50a..925d4bc2 100644 --- a/.github/workflows/.deploy.yml +++ b/.github/workflows/.deploy.yml @@ -116,6 +116,9 @@ jobs: if [ -n "${{ inputs.params }}" ]; then PARAMS+="${{ inputs.params }}" fi + if [ -n "${{ inputs.environment }}" ]; then + PARAMS+=" --set database.pvc.keep=true" + fi echo "PARAMS: $PARAMS" echo "COMMANDS: $COMMANDS" helm upgrade $PARAMS $COMMANDS pubcode.tgz diff --git a/charts/pubcode/templates/database/templates/pvc.yml b/charts/pubcode/templates/database/templates/pvc.yml index 0fb33c53..6cdd5518 100644 --- a/charts/pubcode/templates/database/templates/pvc.yml +++ b/charts/pubcode/templates/database/templates/pvc.yml @@ -4,6 +4,10 @@ kind: PersistentVolumeClaim metadata: name: {{ .Release.Name }}-database namespace: {{ .Release.Namespace }} + {{- if .Values.database.pvc.keep }} + annotations: + "helm.sh/resource-policy": keep + {{- end }} labels: {{- include "database.labels" . | nindent 4 }} spec: diff --git a/charts/pubcode/values.yaml b/charts/pubcode/values.yaml index 5af34c8c..d2197203 100644 --- a/charts/pubcode/values.yaml +++ b/charts/pubcode/values.yaml @@ -304,3 +304,4 @@ database: size: 750Mi storageClassName: netapp-file-standard accessModes: ReadWriteMany + keep: false From 1bd9b08b1b54ed00920aa65bbde6e4d1ff50f480 Mon Sep 17 00:00:00 2001 From: Derek Roberts Date: Thu, 23 Jul 2026 15:07:03 -0700 Subject: [PATCH 5/7] feat(ci): default keep to true, overwrite to false only for PRs --- .github/workflows/.deploy.yml | 4 ++-- charts/pubcode/values.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/.deploy.yml b/.github/workflows/.deploy.yml index 925d4bc2..f6347d30 100644 --- a/.github/workflows/.deploy.yml +++ b/.github/workflows/.deploy.yml @@ -116,8 +116,8 @@ jobs: if [ -n "${{ inputs.params }}" ]; then PARAMS+="${{ inputs.params }}" fi - if [ -n "${{ inputs.environment }}" ]; then - PARAMS+=" --set database.pvc.keep=true" + if [ -z "${{ inputs.environment }}" ]; then + PARAMS+=" --set database.pvc.keep=false" fi echo "PARAMS: $PARAMS" echo "COMMANDS: $COMMANDS" diff --git a/charts/pubcode/values.yaml b/charts/pubcode/values.yaml index d2197203..8ab460fb 100644 --- a/charts/pubcode/values.yaml +++ b/charts/pubcode/values.yaml @@ -304,4 +304,4 @@ database: size: 750Mi storageClassName: netapp-file-standard accessModes: ReadWriteMany - keep: false + keep: true From 210588e52c788663d3c8f0a98e0c7b287b6187c1 Mon Sep 17 00:00:00 2001 From: Derek Roberts Date: Thu, 23 Jul 2026 15:11:56 -0700 Subject: [PATCH 6/7] fix(ci): set cancel-in-progress to false for merge workflow --- .github/workflows/merge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/merge.yml b/.github/workflows/merge.yml index 4d5721d7..5060c11b 100644 --- a/.github/workflows/merge.yml +++ b/.github/workflows/merge.yml @@ -8,7 +8,7 @@ on: concurrency: group: ${{ github.workflow }} - cancel-in-progress: true + cancel-in-progress: false permissions: {} From da359a0602876a74b49b6cee2ba81726c43b7411 Mon Sep 17 00:00:00 2001 From: Derek Roberts Date: Thu, 23 Jul 2026 15:14:27 -0700 Subject: [PATCH 7/7] feat(ci): add double-safe check and comments for database PVC retention --- .github/workflows/.deploy.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/.deploy.yml b/.github/workflows/.deploy.yml index f6347d30..9d597720 100644 --- a/.github/workflows/.deploy.yml +++ b/.github/workflows/.deploy.yml @@ -116,7 +116,10 @@ jobs: if [ -n "${{ inputs.params }}" ]; then PARAMS+="${{ inputs.params }}" fi - if [ -z "${{ inputs.environment }}" ]; then + # Force-delete database PVCs ONLY in ephemeral Pull Request (DEV) environments. + # For all persistent/formal environments (TEST, PROD, dispatches), we fall back + # to the safe default (keep: true in values.yaml) to prevent accidental data loss. + if [ -z "${{ inputs.environment }}" ] && [ "${{ github.event_name }}" = "pull_request" ]; then PARAMS+=" --set database.pvc.keep=false" fi echo "PARAMS: $PARAMS"