Merge pull request #25333 from codingdiaz/tag-based-github-env-protections

feat: support tag based policies

.changeset/short-flowers-cry.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend-module-github': minor
+---
+
+Adds support for custom tag policies when creating GitHub environments.

plugins/scaffolder-backend-module-github/api-report.md

@@ -77,6 +77,7 @@ export function createGithubEnvironmentAction(options: {
         }
       | undefined;
     customBranchPolicyNames?: string[] | undefined;
+    customTagPolicyNames?: string[] | undefined;
     environmentVariables?:
       | {
           [key: string]: string;

plugins/scaffolder-backend-module-github/src/actions/githubEnvironment.examples.test.ts

@@ -171,6 +171,7 @@ describe('github:environment:create examples', () => {
       repo: 'repository',
       environment_name: 'envname',
       name: 'main',
+      type: 'branch',
     });
 
     expect(
@@ -180,6 +181,7 @@ describe('github:environment:create examples', () => {
       repo: 'repository',
       environment_name: 'envname',
       name: '*.*.*',
+      type: 'branch',
     });
 
     expect(

plugins/scaffolder-backend-module-github/src/actions/githubEnvironment.test.ts

@@ -121,6 +121,7 @@ describe('github:environment:create', () => {
       },
     });
   });
+
   it('should work specify deploymentBranchPolicy custom', async () => {
     await action.handler({
       ...mockContext,
@@ -153,6 +154,7 @@ describe('github:environment:create', () => {
       repo: 'repository',
       environment_name: 'envname',
       name: 'main',
+      type: 'branch',
     });
     expect(
       mockOctokit.rest.repos.createDeploymentBranchPolicy,
@@ -161,6 +163,52 @@ describe('github:environment:create', () => {
       repo: 'repository',
       environment_name: 'envname',
       name: '*.*.*',
+      type: 'branch',
+    });
+  });
+
+  it('should work specify deploymentTagPolicy custom', async () => {
+    await action.handler({
+      ...mockContext,
+      input: {
+        ...mockContext.input,
+        deploymentBranchPolicy: {
+          protected_branches: false,
+          custom_branch_policies: true,
+        },
+        customTagPolicyNames: ['main', '*.*.*'],
+      },
+    });
+
+    expect(
+      mockOctokit.rest.repos.createOrUpdateEnvironment,
+    ).toHaveBeenCalledWith({
+      owner: 'owner',
+      repo: 'repository',
+      environment_name: 'envname',
+      deployment_branch_policy: {
+        protected_branches: false,
+        custom_branch_policies: true,
+      },
+    });
+
+    expect(
+      mockOctokit.rest.repos.createDeploymentBranchPolicy,
+    ).toHaveBeenCalledWith({
+      owner: 'owner',
+      repo: 'repository',
+      environment_name: 'envname',
+      name: 'main',
+      type: 'tag',
+    });
+    expect(
+      mockOctokit.rest.repos.createDeploymentBranchPolicy,
+    ).toHaveBeenCalledWith({
+      owner: 'owner',
+      repo: 'repository',
+      environment_name: 'envname',
+      name: '*.*.*',
+      type: 'tag',
     });
   });
 

plugins/scaffolder-backend-module-github/src/actions/githubEnvironment.ts

@@ -44,6 +44,7 @@ export function createGithubEnvironmentAction(options: {
       custom_branch_policies: boolean;
     };
     customBranchPolicyNames?: string[];
+    customTagPolicyNames?: string[];
     environmentVariables?: { [key: string]: string };
     secrets?: { [key: string]: string };
     token?: string;
@@ -94,6 +95,16 @@ export function createGithubEnvironmentAction(options: {
               type: 'string',
             },
           },
+          customTagPolicyNames: {
+            title: 'Custom Tag Policy Name',
+            description: `The name pattern that tags must match in order to deploy to the environment.
+
+            Wildcard characters will not match /. For example, to match tags that begin with release/ and contain an additional single slash, use release/*/*. For more information about pattern matching syntax, see the Ruby File.fnmatch documentation.`,
+            type: 'array',
+            items: {
+              type: 'string',
+            },
+          },
           environmentVariables: {
             title: 'Environment Variables',
             description: `Environment variables attached to the deployment environment`,
@@ -118,6 +129,7 @@ export function createGithubEnvironmentAction(options: {
         name,
         deploymentBranchPolicy,
         customBranchPolicyNames,
+        customTagPolicyNames,
         environmentVariables,
         secrets,
         token: providedToken,
@@ -153,6 +165,19 @@ export function createGithubEnvironmentAction(options: {
           await client.rest.repos.createDeploymentBranchPolicy({
             owner: owner,
             repo: repo,
+            type: 'branch',
+            environment_name: name,
+            name: item,
+          });
+        }
+      }
+
+      if (customTagPolicyNames) {
+        for (const item of customTagPolicyNames) {
+          await client.rest.repos.createDeploymentBranchPolicy({
+            owner: owner,
+            repo: repo,
+            type: 'tag',
             environment_name: name,
             name: item,
           });