Skip to content

Report merged workflow

Runs in the deploy repo when a pull request closes. A pull_request-mode bump reports its deployment to the source repo as queued — nothing is live until the bump PR merges. This workflow un-queues it: it reads the report metadata that bump-images embedded in the PR body (an invisible HTML comment carrying the client payload, environment, environment URL, and the resolved comment templates), finds the queued deployment on the source repo for the same commit and environment, and flips its status to success. It then rewrites the source pull request's staged comment as deployed, if commenting is configured.

Everything it needs travels in that PR body, which is why this workflow never checks out the deploy repo and never reads the image manifest.

Deploy repos whose images all use update_mode: commit don't need this workflow — commit-mode bumps report success and comment deployed immediately.

One gap worth knowing: a bump pull request closed without merging leaves its staged comment (and queued deployment) as they are, since this workflow only ever runs for merged PRs.

Caller example

on:
  pull_request:
    types: [closed]

jobs:
  report:
    if: >-
      github.event.pull_request.merged == true &&
      startsWith(github.event.pull_request.head.ref, 'odp-releaser/')
    uses: gulfofmaine/odp-releaser/.github/workflows/report-merged.yml@<sha-or-tag>
    secrets:
      reporter_app_id: ${{ secrets.REPORTER_APP_ID }}
      reporter_app_private_key: ${{ secrets.REPORTER_APP_PRIVATE_KEY }}
      # reporter_apps: ${{ secrets.REPORTER_APPS }}  # optional multi-org

The if: gate matches merged pull requests on the stable odp-releaser/bump-<image_name> branches that bump-images uses. A PR without embedded odp-releaser metadata is a friendly no-op (the job logs "nothing to report" and succeeds), so a broader gate is safe — the branch prefix check just avoids spinning up jobs for unrelated PRs.

If a merged bump PR's report is ever missed (e.g. the secrets weren't configured yet), re-running is safe: reporting is idempotent, reusing the existing deployment for the same commit + environment rather than creating duplicates.

Reference

Report merged bump 

uses: gulfofmaine/odp-releaser/.github/workflows/report-merged.yml@<sha-or-tag>
permissions:
  contents: read

Inputs: ¤

Name Description Default
verbosity ¤

CLI verbosity: 0=warning, 1=info (default), 2 or more=debug. Maps to the CLI's -v/-vv/-vvv flags (capped at 3).

 1

Secrets: ¤

Name Description
reporter_apps ¤

Optional JSON object mapping source owner -> {app_id, private_key} reporter app credentials, for deploy repos that report to multiple source orgs.
reporter_app_id ¤

App ID of the reporter GitHub App installed on the source repos.
reporter_app_private_key ¤

Optional private key matching reporter_app_id.
Source of gulfofmaine/odp-releaser/.github/workflows/report-merged.yml@<sha-or-tag> 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
# Reusable workflow: finish the deployment report after a bump PR merges.
#
# A pull_request-mode bump reports its deployment to the source repo as
# `queued` — nothing is live until the bump PR merges. This workflow is meant
# to be called by the deploy repo when a pull request closes: it reads the
# report metadata that `bump-images` embedded in the PR body and re-runs
# `odp-releaser report-deployment`, which finds the queued deployment on the
# source repo (same commit + environment) and flips its status to `success`.
# It then re-runs `odp-releaser comment` the same way, so the source pull
# request's `staged` comment is rewritten as `deployed`.
#
# A closed PR without embedded odp-releaser metadata is a friendly no-op, but
# gate the job on merged bump PRs anyway (see the caller example) so the job
# doesn't spin up for unrelated PRs.
#
# Minimal caller example:
#
#   on:
#     pull_request:
#       types: [closed]
#
#   jobs:
#     report:
#       if: >-
#         github.event.pull_request.merged == true &&
#         startsWith(github.event.pull_request.head.ref, 'odp-releaser/')
#       uses: gulfofmaine/odp-releaser/.github/workflows/report-merged.yml@<ref>
#       secrets:
#         reporter_app_id: ${{ secrets.REPORTER_APP_ID }}
#         reporter_app_private_key: ${{ secrets.REPORTER_APP_PRIVATE_KEY }}
#         # reporter_apps: ${{ secrets.REPORTER_APPS }}  # optional multi-org

name: Report merged bump

on:
  workflow_call:
    inputs:
      verbosity:
        description: >-
          CLI verbosity: 0=warning, 1=info (default), 2 or more=debug. Maps to
          the CLI's -v/-vv/-vvv flags (capped at 3).
        required: false
        type: number
        default: 1
    secrets:
      reporter_apps:
        description: >-
          Optional JSON object mapping source owner -> {app_id, private_key}
          reporter app credentials, for deploy repos that report to multiple
          source orgs.
        required: false
      reporter_app_id:
        description: >-
          App ID of the reporter GitHub App installed on the source repos.
        required: false
      reporter_app_private_key:
        description: Optional private key matching reporter_app_id.
        required: false

permissions: {}

jobs:
  report:
    name: Report merged bump deployment
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Install ODP Releaser
        uses: $/.github/actions/install
        with:
          cache_suffix: odp-releaser-${{ job.workflow_sha }}

      - name: Report merged deployment
        uses: $/.github/actions/report_deployment
        with:
          pr_body: ${{ github.event.pull_request.body }}
          update_mode: commit
          # Fallback "View deployment" link; an environment_url embedded in
          # the PR body at bump time wins over this.
          environment_url:
            ${{ github.server_url }}/${{ github.repository }}/commit/${{
            github.event.pull_request.merge_commit_sha }}
          verbosity: ${{ inputs.verbosity }}
          reporter_apps: ${{ secrets.reporter_apps }}
          reporter_app_id: ${{ secrets.reporter_app_id }}
          reporter_app_private_key: ${{ secrets.reporter_app_private_key }}

      - name: Flip the source pull request comment to deployed
        # Best effort: this is the second half of the same report, and a failed
        # comment must not fail the run that already recorded the deployment.
        # `update_mode: commit` because the bump has now landed — that's what
        # selects the `deployed` template over the `staged` one. Everything else
        # (templates, environment, source PR number) was embedded in the bump
        # PR body, so no deploy-repo checkout is needed here either. A PR body
        # without odp-releaser metadata, or one from a release that predates
        # comment support, is a no-op.
        continue-on-error: true
        uses: $/.github/actions/comment_on_pr
        with:
          pr_body: ${{ github.event.pull_request.body }}
          update_mode: commit
          bump_url:
            ${{ github.server_url }}/${{ github.repository }}/commit/${{
            github.event.pull_request.merge_commit_sha }}
          verbosity: ${{ inputs.verbosity }}
          reporter_apps: ${{ secrets.reporter_apps }}
          reporter_app_id: ${{ secrets.reporter_app_id }}
          reporter_app_private_key: ${{ secrets.reporter_app_private_key }}

The credentials are the same reporter app credentials bump-images uses — see GitHub App.