Manual approval in pipeline step

[quinn]

Hi, my typical flow for CD has a "gate" between staging an prod. The pipeline is fully automated up to deploy on staging env, and a button to press to take the artifact deployed to staging and roll it out to prod.

diagram courtesy of chatgpt:

+--------+       +---------+       +---------+       +----------+  
|        |       |         |       |         |       |          |  
| Commit +------>+  Build  +------>+ Staging +------>+ Approval |  
|        |       |         |       | Deploy  |       |  Gate(*) |  
+--------+       +---------+       +---------+       +----+-----+  
                                                          |  
                                             +------------+------------+  
                                             |                         |  
                                         (Approve)                 (Reject)  
                                             |                         |  
                                             v                         v  
                                        +----+----+              +-----+-----+  
                                        |         |              |           |  
                                        | Prod    |              | Release   |  
                                        | Deploy  |              | Discarded |  
                                        |         |              |           |  
                                        +---------+              +-----------+  
  
(*) Manual Step  

i tried searching keywords like "gate" "manual" "approval" but didn't find any relevant discussions.

[suhlig]

You need something that represents the approval, which you check for with a resource. I used the presence of a git tag for this in the past, but you can probably also use a file in a git repo, S3 bucket, etc.

Your pipeline would then probably look similar to this (you have Prod Deploy where I have build-it):

Your Prod Deploy job would check for the presence of a tag (v1.2.4-approved) and kick off a new build. The Release Discarded could be implemented in the same way, e.g. looking for a tag v1.2.4-rejected. The tag_filter of the git resource would be useful for this.

The connection between two jobs can be made with a passed statement:

- name: build-it
  plan:
    - get: tagged-commits
      trigger: true
      passed: [ test-tag ]

The creation of the tag is independent of Concourse, but could be implemented as a separate job that creates the appropriate tag.

[quinn]

OK, this makes sense! thank you.

[marco-m]

Worthwhile to consider is also https://github.com/Meshcloud/gate-resource, although I have not used it so I cannot give an experience report.