@codyswann/lisa 4.74.2 → 4.74.3

package/cdk/create-only/.github/workflows/deploy.yml

@@ -20,6 +20,16 @@ on:
       - main
   workflow_dispatch:
     inputs:
+      rollback_commit:
+        description: 'Commit SHA to deploy for a deliberate rollback; leave empty for the run commit'
+        required: false
+        default: ''
+        type: string
+      force_stale_deploy:
+        description: "Allow a deliberate rollback to this run's old commit (may overwrite a newer deployment)"
+        required: false
+        default: false
+        type: boolean
       environment:
         description: 'Environment to deploy to'
         required: true
@@ -34,6 +44,53 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # Re-runs retain their original SHA. Refuse an old run before release or deployment.
+  validate_deploy_commit:
+    name: 🚦 Validate Deployment Commit
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.rollback_commit || github.sha }}
+      # Check the actual checkout again on job-only retries; earlier jobs may not rerun.
+      - name: 🚦 Refuse stale deployment
+        shell: bash
+        env:
+          DEPLOY_BRANCH: ${{ github.event_name == 'workflow_dispatch' && inputs.environment || github.ref_name }}
+          DEPLOY_EVENT: ${{ github.event_name }}
+          FORCE_STALE_DEPLOY: ${{ github.event_name == 'workflow_dispatch' && inputs.force_stale_deploy == true }}
+        run: |
+          set -euo pipefail
+          DEPLOY_SHA=$(git rev-parse HEAD)
+          TARGET_REF="refs/heads/$DEPLOY_BRANCH"
+          if ! git check-ref-format "$TARGET_REF"; then
+            echo "::error::Invalid deployment branch: $DEPLOY_BRANCH. Choose an existing branch."
+            exit 1
+          fi
+          if ! REMOTE=$(git ls-remote --exit-code --heads origin "$TARGET_REF"); then
+            echo "::error::Cannot read the current tip of $DEPLOY_BRANCH. Nothing will be deployed. Check repository access and the branch name, then retry."
+            exit 1
+          fi
+          read -r TIP RESOLVED_REF <<< "$REMOTE"
+          if [[ ! "$TIP" =~ ^[0-9a-f]{40}$ ]] || [ "$RESOLVED_REF" != "$TARGET_REF" ]; then
+            echo "::error::Could not verify the current tip of $DEPLOY_BRANCH. Nothing will be deployed."
+            exit 1
+          fi
+          if [ "$DEPLOY_SHA" = "$TIP" ]; then
+            echo "✅ Deployment commit $DEPLOY_SHA is the current tip of $DEPLOY_BRANCH."
+            exit 0
+          fi
+          if [ "$DEPLOY_EVENT" = "workflow_dispatch" ] && [ "$FORCE_STALE_DEPLOY" = "true" ]; then
+            echo "::warning title=Deliberate stale deployment::Deploying non-tip commit $DEPLOY_SHA to $DEPLOY_BRANCH; the current branch tip is $TIP. force_stale_deploy was explicitly enabled."
+            echo "### ⚠️ Deliberate rollback: deploying $DEPLOY_SHA to $DEPLOY_BRANCH instead of current tip $TIP." >> "${GITHUB_STEP_SUMMARY:-/dev/stdout}"
+            exit 0
+          fi
+          echo "::error title=Stale deployment refused::This run would deploy $DEPLOY_SHA, but $DEPLOY_BRANCH is now at $TIP. This is probably a re-run of an old run and would roll the environment back. Re-run the latest deploy run for this branch, or start workflow_dispatch on the branch tip. For a deliberate rollback only, explicitly enable force_stale_deploy in a manual run."
+          exit 1
+
   # Environment setup
   determine_environment:
     name: 🌍 Determine Environment
@@ -93,7 +150,7 @@ jobs:
   pre_deploy_gates:
     name: 🚦 Pre-Deploy Gates
     uses: CodySwannGT/lisa/.github/workflows/gates.yml@main
-    needs: [determine_environment]
+    needs: [determine_environment, validate_deploy_commit]
     with:
       # Travels with the `uses:` line above — the two are one unit. Lisa's
       # reusable workflows are tracked at `@main`, so that file changes under

package/dist/core/nightly-e2e-guard-behavior-certificate.js

@@ -48,9 +48,9 @@ export const NIGHTLY_E2E_GUARD_BEHAVIOR_CERTIFICATES = Object.freeze({
     }),
     f87e6eee47ddb6416f2c639b79b96a68173c9c562999fbad98abe012ac913d28: Object.freeze({
         contractVersion: "1.9.0",
-        packageVersions: Object.freeze(["4.74.2"]),
+        packageVersions: Object.freeze(["4.74.3"]),
         provenances: Object.freeze([
-            "workspace package @codyswann/lisa@4.74.2 (typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs)",
+            "workspace package @codyswann/lisa@4.74.3 (typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs)",
         ]),
     }),
 });

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAw0FpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAigSjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAw0FpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAmgSjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -175,7 +175,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "cdk/copy-overwrite/vitest.cdk.ts": "030158b11bec4f10b39585feb98f498981f307faa1fa314c7522e6def5d73c94",
     "cdk/copy-overwrite/vitest.config.ts": "c7f309d4f43d9188b9c067cb4900b2bdbacfbd28d135a6a2e6313cb0a37b030f",
     "cdk/create-only/.github/workflows/ci.yml": "a487a4f77f9bb5733e2f99f112821f2b88ac15d5274b71f6951a846693234ad9",
-    "cdk/create-only/.github/workflows/deploy.yml": "1679abd401033cfe3b83a471f32dfd6c9b98ff3705a98fc0fc8f5ceba586b2c7",
+    "cdk/create-only/.github/workflows/deploy.yml": "2d4e445d2460efe936b7b6457ac4aa4302237ea13b01969eca382e70325d73bb",
     "cdk/create-only/cdk.json": "f89030d8fe145a1dbabd59d89ddee4e16984f222d737f7fcf6b778d911e9fe40",
     "cdk/create-only/stryker.conf.json": "3490157f983d831defe56f014ffcf49c57e22381a4a180cc9facf2de0238dcf5",
     "cdk/create-only/tsconfig.local.json": "d26253827e21fd7c41d30565fe3d339675f119e00bb24c5713a01f57ccd06602",
@@ -257,7 +257,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "expo/create-only/.github/nightly-e2e-policy.json": "a6fc52bbaa7943523fba35bd1ab51d8da4b29354bf0133b47aa299b725f51e8c",
     "expo/create-only/.github/required-checks.json": "8d40acc337c42fbdfc55638dc4ab43b541b975270ecae8fffec9897c13a42884",
     "expo/create-only/.github/workflows/ci.yml": "f4a95f3895d906429b82e33bb13c77c7a2d63027634da61c249c0a800d353f44",
-    "expo/create-only/.github/workflows/deploy.yml": "68edef86a0bc9e55b049d3a2b95f3d01fba6ec3a7ca3b51de04078adb94bf529",
+    "expo/create-only/.github/workflows/deploy.yml": "d8abfa607942eb72b99d928d789befb94c2b9c18e5cb3b4a20e83392e1079566",
     "expo/create-only/.github/workflows/maestro-e2e.yml": "11e6db515412702672edea910223b808be168b3d1f9ec15c349f44f3edcff247",
     "expo/create-only/.github/workflows/nightly-e2e-bypass-reaper.yml": "6a4dc81752ef58646e78c24c421b6f2996676689fa0e20af2a94b217b73e476b",
     "expo/create-only/.github/workflows/nightly-e2e-health.yml": "560d40504494ca7d98a99dbe27535f91aceff19e8f98b51ddf9a8f24f559e535",
@@ -299,7 +299,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "harper-fabric/copy-overwrite/tsconfig.eslint.json": "63ddc31cbbdf91ba4def5f04ed76b2a8b61ced456d4472aea77a55cc037a62e1",
     "harper-fabric/copy-overwrite/tsconfig.json": "64b9f2e919160568712e2641b125aa21bec486532249a7b17e4fb2f4bb3988cc",
     "harper-fabric/copy-overwrite/vitest.config.ts": "94ee60be0e9a4b735cf1b053143751c9968465ff04fb59fbdfc252e7413ff337",
-    "harper-fabric/create-only/.github/workflows/deploy.yml": "3f6e69c9a80b6cfdd1ed8b3baaccb2925dd98c7f8d7ca1f7524d780c68b704ba",
+    "harper-fabric/create-only/.github/workflows/deploy.yml": "a60575f6d7a9434f3eb59d7b377e8430ad0ea0426ace6c2461051a4ff83c3df8",
     "harper-fabric/create-only/.github/workflows/zap-baseline.yml": "37e02f04709c11dcd7a0a65110f19def3f06a5039dbb80d31e1bc3757bb4e330",
     "harper-fabric/create-only/.zap/baseline.conf": "68aae4b1b9b5b7253b5aeb792d72b58f64e5eda1dcf8f3062bd9d77494a5a22f",
     "harper-fabric/create-only/scripts/zap-baseline.sh": "00f5a2bdf6c9ecf0d7a1c74ec629364b09bab1f79c4ea71779826288702d76aa",
@@ -341,7 +341,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "nestjs/create-only/.github/k6/thresholds/strict.json": "e121ec72de4596b95c013a8c71f03653bcdf057cf7f8d1fec6f0e13c1381867f",
     "nestjs/create-only/.github/required-checks.json": "6de377accd8355091e31ee7b3e412187d2268650ecbeb6c2cba42923c594cfc0",
     "nestjs/create-only/.github/workflows/ci.yml": "5355a0152b04ba54bf2d207df536de18e2734429a1c030487b80aa3db0693df5",
-    "nestjs/create-only/.github/workflows/deploy.yml": "7c130d9c88170bb4b63881b4b73fa8857dfa1eddcbb38609150fea4ca53db51e",
+    "nestjs/create-only/.github/workflows/deploy.yml": "0dcef1749870398170361fe84ef85c997f6e1b63e3a7a7d068f4c42e5f0c90f8",
     "nestjs/create-only/.zap/baseline.conf": "a7cd559b014555ef2efe7a6ce129384ec376ce4d66d5bc3ae9e2f3f883172c4d",
     "nestjs/create-only/scripts/zap-baseline.sh": "9d81fdb3419753ca4ec5509e37365543d7608c7a9924635ef1acb4734cb3bbd1",
     "nestjs/create-only/tsconfig.local.json": "0b720ddad0d18f52dadf33bdc4a0aec0eb65c506bc8ebb692f880bdf31d1011d",
@@ -1209,7 +1209,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "rails/copy-overwrite/scripts/threshold-ratchet-families.mjs": "15b8dd22f25795127258cb9bf0271253bb9e285cf735177d157037a5cc4663f8",
     "rails/copy-overwrite/sgconfig.yml": "ff5b62de42eb969a851fdc53ee6932a32ffe010b567ed2c62460ed454ad2a24f",
     "rails/create-only/.github/workflows/ci.yml": "5aa2401acc1373afd0b9a114f7fd6b5904b3fcbaa2940f8eb527b2ce5ddf23f8",
-    "rails/create-only/.github/workflows/deploy.yml": "50b3266ec38a9cca83236b486b2e545a88cb67f244fd7d531db8e2680081aac4",
+    "rails/create-only/.github/workflows/deploy.yml": "68fdb813f30cfa71121a96022021f4d351e1e2497c472796c56bb8d47b9655c8",
     "rails/create-only/.mise.toml": "28be5746256a30ad2260da7d37244cc461f8963ce5d5a81ddce71b48f0ab6ef0",
     "rails/create-only/.mutant.yml": "9ee28ad14e4688e58827510eb9b7197d9a368fc670821145a08f7542e2e216d8",
     "rails/create-only/.reek.yml": "d2fca1f6367719b002ea51c76e10cb9e08b1c34991b4386696f79a1a36c6a385",
@@ -1351,7 +1351,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/run-artifact-checks.mjs": "2992d673bb3c1ebfa50bda9ed323b8410afdab2ffc925eee6eab19fcab312a90",
     "scripts/setup-deploy-key.sh": "2bed19346810b7af18a5225fd463c4d553a7bcc7b2f11a21bd47b93e6b5e1719",
     "scripts/test-intent-routing.sh": "97b9dc86cbd805df8a7fdb8c99ffab9b8c5e751ba2e84c05420b2a124f80635d",
-    "scripts/two-channel-couplings.json": "cfb9ac9f3fe7d0f8aad29ad49adfbf80fa4b83eea46558a046dbad6ceb2ff825",
+    "scripts/two-channel-couplings.json": "a77de0e72af86aafb718a0cf7161262d72aa16dfee6855e6db634203fde3ad24",
     "scripts/update-node-version.ts": "9d37599ef73d5d624751f862cda330a867f6774392c1ab045b4fc885132582e4",
     "scripts/update-test-skill-paths.mjs": "e26a3ac716c33013e22bf5223a58457452f5af2038218a0e3a51c244eab5ddc9",
     "scripts/verify-health-agentic-built.mjs": "4b0d20b2c94390ff6f5af881fc50c5c225215a282891db0b3e3d84a7e6455367",
@@ -1834,6 +1834,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "docs/bdd-scenario-matrix/bdd/features/lisa-ui-starter-settings.feature.md": true,
     "docs/bdd-scenario-matrix/bdd/features/lisa-ui-starter-sync.feature.md": true,
     "docs/ci-efficiency.md": true,
+    "docs/deploy-stale-run-guard.md": true,
     "docs/design/e2e-environment-reset-plan.md": true,
     "docs/design/e2e-wiring-contract.md": true,
     "docs/design/environment-facade-contract.md": true,
@@ -9115,6 +9116,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/config/security-pin-floors.test.ts": true,
     "tests/unit/config/shipped-mjs-roster.test.ts": true,
     "tests/unit/config/sonar-coverage-handoff.test.ts": true,
+    "tests/unit/config/stale-deploy-guard.test.ts": true,
     "tests/unit/config/synthesis-scratch-reclaim.test.ts": true,
     "tests/unit/config/template-script-toolchain.test.ts": true,
     "tests/unit/config/test-run-child-process-analyzer.test.ts": true,