Environments: deployments, protection and an environment claim issue #59 open andymccall opened this · 1 comment
andymccall referenced by change f4e51e63582d on main ·
Done (2026-10-16 05:46): flow-core a3b6ad83 environment "prod" on a job (spec 5.3.3, job field 12). Hub e5f1189e: the job keeps its environment; its identity tokens carry environment only when the job was approved (else the log says why); /{owner}/{name}/deployments shows what each environment runs (state, run, job, approved by, when) and the history, linked from the Flow page; GET /api/v1/repos/{o}/{n}/deployments. Test: an approved deploy's token has environment prod, the page and API list it; oidc unit test without the claim. Not changed: the GCP workload identity provider's condition: it can now also require assertion.environment == "prod" (Andy's call, in oxygenhub-gcp bootstrap). Protection rules as settings follow in oxygenflow#62.
A job names an environment (environment "prod"); the hub keeps per repository a deployments page (what state each environment runs, when, from which run, approved by whom) and protection rules per environment (required approval, allowed bookmarks). The job's OIDC token gains an environment claim, issued only once the job is approved, so a cloud's trust condition can require environment == prod: no unapproved job can deploy (andymccall/oxygenhub-gcp workload identity). Builds on approval gates.