fix(ci): consolidate release approvals and finalise drafts (#1223)

.github/workflows/_build-image.yaml

@@ -54,7 +54,6 @@ jobs:
   meta:
     name: resolve metadata
     runs-on: ubuntu-24.04
-    environment: builds
     timeout-minutes: 5
     outputs:
       build_version: ${{ steps.vars.outputs.build_version }}
@@ -79,7 +78,6 @@ jobs:
     name: build ${{ matrix.platform }}
     needs: meta
     runs-on: ${{ matrix.runner }}
-    environment: builds
     timeout-minutes: 75
     strategy:
       fail-fast: false
@@ -120,7 +118,6 @@ jobs:
     name: merge multi-arch manifest
     needs: [meta, build]
     runs-on: ubuntu-24.04
-    environment: builds
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -180,7 +177,6 @@ jobs:
     if: ${{ inputs['finalise-release'] }}
     needs: [meta, merge]
     runs-on: ubuntu-24.04
-    environment: builds
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0

.github/workflows/build-admin.yaml

@@ -26,6 +26,11 @@ on:
         type: boolean
         required: false
         default: true
+      approval-required:
+        description: "Require the protected builds environment approval before this build runs."
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   actions: read
@@ -33,7 +38,19 @@ permissions:
   packages: write
 
 jobs:
+  approve:
+    name: approve build release
+    if: ${{ inputs['approval-required'] == true || inputs['approval-required'] == null }}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Build release approved."
+
   image:
+    needs: approve
+    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
     uses: ./.github/workflows/_build-image.yaml
     with:
       image: fluxer-admin

.github/workflows/build-api.yaml

@@ -26,6 +26,11 @@ on:
         type: boolean
         required: false
         default: true
+      approval-required:
+        description: "Require the protected builds environment approval before this build runs."
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   actions: read
@@ -33,7 +38,19 @@ permissions:
   packages: write
 
 jobs:
+  approve:
+    name: approve build release
+    if: ${{ inputs['approval-required'] == true || inputs['approval-required'] == null }}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Build release approved."
+
   image:
+    needs: approve
+    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
     uses: ./.github/workflows/_build-image.yaml
     with:
       image: fluxer-api

.github/workflows/build-app-proxy-self-hosted.yaml

@@ -26,6 +26,11 @@ on:
         type: boolean
         required: false
         default: true
+      approval-required:
+        description: "Require the protected builds environment approval before this build runs."
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   actions: read
@@ -33,7 +38,19 @@ permissions:
   packages: write
 
 jobs:
+  approve:
+    name: approve build release
+    if: ${{ inputs['approval-required'] == true || inputs['approval-required'] == null }}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Build release approved."
+
   build:
+    needs: approve
+    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
     uses: ./.github/workflows/_build-image.yaml
     with:
       image: fluxer-app-proxy-self-hosted

.github/workflows/build-app-proxy.yaml

@@ -26,6 +26,11 @@ on:
         type: boolean
         required: false
         default: true
+      approval-required:
+        description: "Require the protected builds environment approval before this build runs."
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   actions: read
@@ -36,11 +41,22 @@ env:
   GHCR_OWNER: ${{ github.repository_owner }}
 
 jobs:
-  meta:
-    name: resolve metadata
+  approve:
+    name: approve build release
+    if: ${{ inputs['approval-required'] == true || inputs['approval-required'] == null }}
     runs-on: ubuntu-24.04
     environment: builds
     timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Build release approved."
+
+  meta:
+    name: resolve metadata
+    needs: approve
+    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
     outputs:
       build_version: ${{ steps.vars.outputs.build_version }}
     steps:
@@ -62,7 +78,6 @@ jobs:
     name: build app-proxy (amd64)
     needs: meta
     runs-on: blacksmith-4vcpu-ubuntu-2404
-    environment: builds
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -123,7 +138,6 @@ jobs:
     name: build app-proxy (arm64)
     needs: meta
     runs-on: blacksmith-4vcpu-ubuntu-2404-arm
-    environment: builds
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -156,7 +170,6 @@ jobs:
     name: merge multi-arch manifest
     needs: [meta, build, build-arm64]
     runs-on: ubuntu-24.04
-    environment: builds
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -219,7 +232,6 @@ jobs:
     if: ${{ inputs['finalise-release'] != false }}
     needs: [meta, merge]
     runs-on: ubuntu-24.04
-    environment: builds
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0

.github/workflows/build-docs.yaml

@@ -26,6 +26,11 @@ on:
         type: boolean
         required: false
         default: true
+      approval-required:
+        description: "Require the protected builds environment approval before this build runs."
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   actions: read
@@ -33,7 +38,19 @@ permissions:
   packages: write
 
 jobs:
+  approve:
+    name: approve build release
+    if: ${{ inputs['approval-required'] == true || inputs['approval-required'] == null }}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Build release approved."
+
   image:
+    needs: approve
+    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
     uses: ./.github/workflows/_build-image.yaml
     with:
       image: fluxer-docs

.github/workflows/build-gateway.yaml

@@ -26,6 +26,11 @@ on:
         type: boolean
         required: false
         default: true
+      approval-required:
+        description: "Require the protected builds environment approval before this build runs."
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   actions: read
@@ -33,7 +38,19 @@ permissions:
   packages: write
 
 jobs:
+  approve:
+    name: approve build release
+    if: ${{ inputs['approval-required'] == true || inputs['approval-required'] == null }}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Build release approved."
+
   image:
+    needs: approve
+    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
     uses: ./.github/workflows/_build-image.yaml
     with:
       image: fluxer-gateway

.github/workflows/build-gifs.yaml

@@ -26,6 +26,11 @@ on:
         type: boolean
         required: false
         default: true
+      approval-required:
+        description: "Require the protected builds environment approval before this build runs."
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   actions: read
@@ -33,7 +38,19 @@ permissions:
   packages: write
 
 jobs:
+  approve:
+    name: approve build release
+    if: ${{ inputs['approval-required'] == true || inputs['approval-required'] == null }}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Build release approved."
+
   image:
+    needs: approve
+    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
     uses: ./.github/workflows/_build-image.yaml
     with:
       image: fluxer-gifs

.github/workflows/build-marketing.yaml

@@ -26,6 +26,11 @@ on:
         type: boolean
         required: false
         default: true
+      approval-required:
+        description: "Require the protected builds environment approval before this build runs."
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   actions: read
@@ -33,7 +38,19 @@ permissions:
   packages: write
 
 jobs:
+  approve:
+    name: approve build release
+    if: ${{ inputs['approval-required'] == true || inputs['approval-required'] == null }}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Build release approved."
+
   image:
+    needs: approve
+    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
     uses: ./.github/workflows/_build-image.yaml
     with:
       image: fluxer-marketing

.github/workflows/build-media-proxy.yaml

@@ -26,6 +26,11 @@ on:
         type: boolean
         required: false
         default: true
+      approval-required:
+        description: "Require the protected builds environment approval before this build runs."
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   actions: read
@@ -33,7 +38,19 @@ permissions:
   packages: write
 
 jobs:
+  approve:
+    name: approve build release
+    if: ${{ inputs['approval-required'] == true || inputs['approval-required'] == null }}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Build release approved."
+
   image:
+    needs: approve
+    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
     uses: ./.github/workflows/_build-image.yaml
     with:
       image: fluxer-media-proxy

.github/workflows/build-messages.yaml

@@ -26,6 +26,11 @@ on:
         type: boolean
         required: false
         default: true
+      approval-required:
+        description: "Require the protected builds environment approval before this build runs."
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   actions: read
@@ -33,7 +38,19 @@ permissions:
   packages: write
 
 jobs:
+  approve:
+    name: approve build release
+    if: ${{ inputs['approval-required'] == true || inputs['approval-required'] == null }}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Build release approved."
+
   image:
+    needs: approve
+    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
     uses: ./.github/workflows/_build-image.yaml
     with:
       image: fluxer-messages

.github/workflows/build-snowflakes.yaml

@@ -26,6 +26,11 @@ on:
         type: boolean
         required: false
         default: true
+      approval-required:
+        description: "Require the protected builds environment approval before this build runs."
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   actions: read
@@ -33,7 +38,19 @@ permissions:
   packages: write
 
 jobs:
+  approve:
+    name: approve build release
+    if: ${{ inputs['approval-required'] == true || inputs['approval-required'] == null }}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Build release approved."
+
   image:
+    needs: approve
+    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
     uses: ./.github/workflows/_build-image.yaml
     with:
       image: fluxer-snowflakes

.github/workflows/build-static.yaml

@@ -26,6 +26,11 @@ on:
         type: boolean
         required: false
         default: true
+      approval-required:
+        description: "Require the protected builds environment approval before this build runs."
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   actions: read
@@ -33,7 +38,19 @@ permissions:
   packages: write
 
 jobs:
+  approve:
+    name: approve build release
+    if: ${{ inputs['approval-required'] == true || inputs['approval-required'] == null }}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Build release approved."
+
   image:
+    needs: approve
+    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
     uses: ./.github/workflows/_build-image.yaml
     with:
       image: fluxer-static

.github/workflows/build-unfurl.yaml

@@ -26,6 +26,11 @@ on:
         type: boolean
         required: false
         default: true
+      approval-required:
+        description: "Require the protected builds environment approval before this build runs."
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   actions: read
@@ -33,7 +38,19 @@ permissions:
   packages: write
 
 jobs:
+  approve:
+    name: approve build release
+    if: ${{ inputs['approval-required'] == true || inputs['approval-required'] == null }}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Build release approved."
+
   image:
+    needs: approve
+    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
     uses: ./.github/workflows/_build-image.yaml
     with:
       image: fluxer-unfurl

.github/workflows/build-users.yaml

@@ -26,6 +26,11 @@ on:
         type: boolean
         required: false
         default: true
+      approval-required:
+        description: "Require the protected builds environment approval before this build runs."
+        type: boolean
+        required: false
+        default: true
 
 permissions:
   actions: read
@@ -33,7 +38,19 @@ permissions:
   packages: write
 
 jobs:
+  approve:
+    name: approve build release
+    if: ${{ inputs['approval-required'] == true || inputs['approval-required'] == null }}
+    runs-on: ubuntu-24.04
+    environment: builds
+    timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Build release approved."
+
   image:
+    needs: approve
+    if: ${{ !cancelled() && (needs.approve.result == 'success' || needs.approve.result == 'skipped') }}
     uses: ./.github/workflows/_build-image.yaml
     with:
       image: fluxer-users

.github/workflows/release-all.yaml

@@ -24,11 +24,21 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  meta:
-    name: resolve metadata
+  approve:
+    name: approve release build
     runs-on: ubuntu-24.04
     environment: builds
     timeout-minutes: 5
+    steps:
+      - name: approved
+        run: echo "Release build approved."
+
+  meta:
+    name: resolve metadata
+    needs: approve
+    if: ${{ !failure() && !cancelled() }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
     outputs:
       build_version: ${{ steps.vars.outputs.build_version }}
     steps:
@@ -54,6 +64,7 @@ jobs:
     with:
       build-version: ${{ needs.meta.outputs.build_version }}
       finalise-release: false
+      approval-required: false
     secrets: inherit
 
   build_api:
@@ -62,6 +73,7 @@ jobs:
     with:
       build-version: ${{ needs.meta.outputs.build_version }}
       finalise-release: false
+      approval-required: false
     secrets: inherit
 
   build_app_proxy:
@@ -70,6 +82,7 @@ jobs:
     with:
       build-version: ${{ needs.meta.outputs.build_version }}
       finalise-release: false
+      approval-required: false
     secrets: inherit
 
   build_app_proxy_self_hosted:
@@ -78,6 +91,7 @@ jobs:
     with:
       build-version: ${{ needs.meta.outputs.build_version }}
       finalise-release: false
+      approval-required: false
     secrets: inherit
 
   build_docs:
@@ -86,6 +100,7 @@ jobs:
     with:
       build-version: ${{ needs.meta.outputs.build_version }}
       finalise-release: false
+      approval-required: false
     secrets: inherit
 
   build_gateway:
@@ -94,6 +109,7 @@ jobs:
     with:
       build-version: ${{ needs.meta.outputs.build_version }}
       finalise-release: false
+      approval-required: false
     secrets: inherit
 
   build_gifs:
@@ -102,6 +118,7 @@ jobs:
     with:
       build-version: ${{ needs.meta.outputs.build_version }}
       finalise-release: false
+      approval-required: false
     secrets: inherit
 
   build_marketing:
@@ -110,6 +127,7 @@ jobs:
     with:
       build-version: ${{ needs.meta.outputs.build_version }}
       finalise-release: false
+      approval-required: false
     secrets: inherit
 
   build_media_proxy:
@@ -118,6 +136,7 @@ jobs:
     with:
       build-version: ${{ needs.meta.outputs.build_version }}
       finalise-release: false
+      approval-required: false
     secrets: inherit
 
   build_messages:
@@ -126,6 +145,7 @@ jobs:
     with:
       build-version: ${{ needs.meta.outputs.build_version }}
       finalise-release: false
+      approval-required: false
     secrets: inherit
 
   build_snowflakes:
@@ -134,6 +154,7 @@ jobs:
     with:
       build-version: ${{ needs.meta.outputs.build_version }}
       finalise-release: false
+      approval-required: false
     secrets: inherit
 
   build_static:
@@ -142,6 +163,7 @@ jobs:
     with:
       build-version: ${{ needs.meta.outputs.build_version }}
       finalise-release: false
+      approval-required: false
     secrets: inherit
 
   build_unfurl:
@@ -150,6 +172,7 @@ jobs:
     with:
       build-version: ${{ needs.meta.outputs.build_version }}
       finalise-release: false
+      approval-required: false
     secrets: inherit
 
   build_users:
@@ -158,6 +181,7 @@ jobs:
     with:
       build-version: ${{ needs.meta.outputs.build_version }}
       finalise-release: false
+      approval-required: false
     secrets: inherit
 
   release_assets:
@@ -180,7 +204,6 @@ jobs:
       - build_unfurl
       - build_users
     runs-on: ubuntu-24.04
-    environment: builds
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
@@ -235,7 +258,6 @@ jobs:
       - build_users
       - release_assets
     runs-on: ubuntu-24.04
-    environment: builds
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0