How to automatically close waiting jobs related to deployment review when pull request is closed/merged?

[ghoullier]

Select Topic Area

Question

Body

A job targeting an environment with deployment review which is not approved stay in the waiting status.

When you closed or merge de the pull request theses jobs are not automatically canceled.

Using the gh cli gh run cancel <job-id> does not works to properly cancel related jobs.

[Mittelblut9]

https://stackoverflow.com/a/70452560

there are some options listed

[ghoullier]

I'm not looking for a solution to cancel previous jobs, but to cancel waiting jobs when the pr is merged. The 1. solution does not works with gh cli.

[Mittelblut9]

As of i’m researching i haven’t found any solution to that problem. I have the same problem at my projects.

Sometimes it’s just easier to ask ChatGPT. It provides the solution to create a workflow that will run when a merge request got merged or closed.

Provided code:

name: Cancel Waiting Jobs on Merge

on:
  pull_request:
    types: [closed]

  workflow_run:
    types: [requested]

jobs:
  cancel_waiting_jobs:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.merged == true }}

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v2

      - name: Get Workflow Runs
        id: get_runs
        run: |
          echo "::set-output name=runs::$(curl -sH 'Accept: application/vnd.github.v3+json' -u ${{ github.actor }}:${{ secrets.GITHUB_TOKEN }} "https://api.github.com/repos/${{ github.repository }}/actions/runs")"
        continue-on-error: true

      - name: Cancel Waiting Jobs
        run: |
          runs=${{ steps.get_runs.outputs.runs }}
          for i in $(echo "${runs}" | jq -r '.workflow_runs | map(select(.head_sha == env.GITHUB_SHA)) | .[].id'); do
            echo "Cancelling workflow run $i"
            curl -X POST -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" "https://api.github.com/repos/${{ github.repository }}/actions/runs/$i/cancel"
          done
        env:
          GITHUB_SHA: ${{ github.event.pull_request.head.sha }}

[ghoullier]

I've created a github action to solve this problem:

Action

.github/actions/reject-pending-deployments/action.yaml

name: Reject pending deployments

inputs:
  token:
    description: Github Access Token
    required: true
  environment:
    description: Environment
    required: true
  branch:
    description: Branch
    default: ${{ github.event.pull_request.head.ref }}
  preserve-latest:
    description: Preserve latest pending deployment
    default: false
  sha:
    description: Git sha1
    default: ${{ github.event.pull_request.head.sha }}

runs:
  using: "composite"
  steps:
    - id: set-jq-filter
      shell: bash
      run: |
        JQ_FILTER_NONE='.workflow_runs | .[] | .id'
        JQ_FILTER_PRESERVE_LATEST='.workflow_runs | .[] | select(.head_sha != "${{ inputs.sha }}") | .id'
        echo "JQ_FILTER='${{ inputs.preserve-latest == 'true' && '$JQ_FILTER_PRESERVE_LATEST' || '$JQ_FILTER_NONE' }}'"  >> $GITHUB_ENV

    - id: list-waiting-runs
      name: List runs with waiting status related to (${{ inputs.branch }})
      shell: bash
      run: |
        curl -L --output waiting_runs.json \
          -H "Accept: application/vnd.github+json" \
          -H "Authorization: Bearer ${{ inputs.token }}" \
          -H "X-GitHub-Api-Version: 2022-11-28" \
          https://api.github.com/repos/${{ github.repository }}/actions/runs?status=waiting&branch=${{ inputs.branch }}

    - id: reject-pending-deployments
      name: Reject all pending deployments
      shell: bash
      run: |
        cat waiting_runs.json | jq ${{ env.JQ_FILTER }} | while read run_id;do
          curl -L \
            -X POST \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: Bearer ${{ inputs.token }}" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            https://api.github.com/repos/${{ github.repository }}/actions/runs/$run_id/pending_deployments \
            -d '{"environment_ids":[${{ inputs.environment }}],"state":"rejected","comment":"Rejected by API"}'
        done

Uses

.github/workflows/on-pr-closed.yml To closes waiting deployment when a PR is merged/closed

on:
  pull_request:
    branches: [ main ]
    types: [ closed ]

name: On Pull Request Closed

jobs:
  reject-pending-deployments:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Reject pending deployments
        uses: ./.github/actions/reject-pending-deployments
        with:
          environment: <ENVIRONMENT-ID>
          token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}

.github/workflows/on-deployment-created.yml To close previous deployments when a new one is triggered

on:
  deployment:

name: On deployment created

jobs:
  reject-pending-deployments:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Reject pending deployments (preserve-latest)
        uses: ./.github/actions/reject-pending-deployments
        with:
          branch: ${{ github.event.deployment.ref }}
          environment: <ENVIRONMENT-ID>
          preserve-latest: true
          sha: ${{ github.event.deployment.sha }}
          token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}

⚠ Limitations

You have to use a personal access token to reject deployments, ${{ github.token }} and ${{ secrets.GITHUB_TOKEN }} does not works.