diff --git a/.github/actions/pantheon-push/action.yml b/.github/actions/pantheon-push/action.yml index 5de6435..2c6681a 100644 --- a/.github/actions/pantheon-push/action.yml +++ b/.github/actions/pantheon-push/action.yml @@ -132,10 +132,15 @@ runs: echo "Env ${SITE}.${TARGET_ENV} does not exist yet; multidev:create will provision it in git mode. Skipping connection-mode check." exit 0 fi - # No 2>/dev/null fallback — if connection:info errors here (auth, network), - # we want the step to fail with terminus's real error rather than coerce - # the result to an empty string and attempt connection:set on bad data. - MODE=$(terminus connection:info "${SITE}.${TARGET_ENV}" --field=connection_mode) + # `connection_mode` lives on env:info, NOT on connection:info (which + # only returns the git/sftp connection URLs and commands). v3.2.4 + # shipped with the wrong command — terminus errors with "The requested + # field, 'connection_mode', is not defined" — and the no-stderr-swallow + # fix from Copilot's review surfaced it. + # No `2>/dev/null` fallback: if terminus errors here (auth, network, + # schema drift), we want the step to fail with the real error rather + # than coerce the result to empty and attempt connection:set on bad data. + MODE=$(terminus env:info "${SITE}.${TARGET_ENV}" --field=connection_mode) echo "Current connection mode for ${SITE}.${TARGET_ENV}: ${MODE}" if [[ "${MODE}" != "git" ]]; then echo "::warning::${SITE}.${TARGET_ENV} is in '${MODE}' mode. Switching to git so the push isn't rejected by the pre-receive hook." diff --git a/.github/workflows/reusable-pantheon-deploy-dev.yml b/.github/workflows/reusable-pantheon-deploy-dev.yml index b986ab4..b3ffb02 100644 --- a/.github/workflows/reusable-pantheon-deploy-dev.yml +++ b/.github/workflows/reusable-pantheon-deploy-dev.yml @@ -62,7 +62,7 @@ jobs: semantic_release: name: Semantic Release if: ${{ inputs.run_semantic_release }} - uses: Square360/shared-workflows/.github/workflows/reusable-semantic-release.yml@v3.2.4 + uses: Square360/shared-workflows/.github/workflows/reusable-semantic-release.yml@v3.2.5 secrets: CI_GH_TOKEN: ${{ secrets.CI_GH_TOKEN }} @@ -92,7 +92,7 @@ jobs: fetch-depth: 1 - name: Install Terminus - uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.4 + uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.5 with: machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }} @@ -102,7 +102,7 @@ jobs: # ----------------------------------------------------------------------- - name: Push code to Pantheon DEV id: deploy_pantheon - uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.4 + uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.5 with: site: ${{ inputs.pantheon_site }} target_env: dev @@ -159,7 +159,7 @@ jobs: - name: Run post-deploy drush commands id: drush_commands - uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.4 + uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.5 with: site: ${{ inputs.pantheon_site }} env: dev diff --git a/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml b/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml index 490ce9f..0f22b3c 100644 --- a/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml +++ b/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml @@ -126,7 +126,7 @@ jobs: echo "Epic multidev: ${TARGET_ENV}" - name: Install Terminus - uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.4 + uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.5 with: machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }} @@ -148,7 +148,7 @@ jobs: - name: Push code to Pantheon epic multidev id: deploy - uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.4 + uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.5 with: site: ${{ inputs.pantheon_site }} target_env: ${{ steps.derive.outputs.target_env }} @@ -159,7 +159,7 @@ jobs: - name: Run post-deploy drush commands id: drush_commands - uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.4 + uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.5 with: site: ${{ inputs.pantheon_site }} env: ${{ steps.derive.outputs.target_env }} @@ -234,7 +234,7 @@ jobs: # The security workflow detects epr-* internally and runs unconditionally # in strict mode (fails on any High-severity finding) — same gate as rc-*, # per the Square360 SOP for epic integration multidevs. No force_run needed. - uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.4 + uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.5 with: pantheon_site: ${{ inputs.pantheon_site }} target_env: ${{ needs.deploy_epic_multidev.outputs.target_env }} diff --git a/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml b/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml index 16ef227..79cc487 100644 --- a/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml +++ b/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml @@ -83,7 +83,7 @@ jobs: run: echo "target_env=pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT - name: Install Terminus - uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.4 + uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.5 with: machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }} @@ -105,7 +105,7 @@ jobs: - name: Push code to Pantheon multidev id: deploy - uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.4 + uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.5 with: site: ${{ inputs.pantheon_site }} target_env: ${{ steps.derive.outputs.target_env }} @@ -116,7 +116,7 @@ jobs: - name: Run post-deploy drush commands id: drush_commands - uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.4 + uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.5 with: site: ${{ inputs.pantheon_site }} env: ${{ steps.derive.outputs.target_env }} @@ -228,7 +228,7 @@ jobs: contains(github.event.pull_request.body, '[run-security]') || contains(github.event.pull_request.body, '[security]') }} - uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.4 + uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.5 with: pantheon_site: ${{ inputs.pantheon_site }} target_env: ${{ needs.deploy_pr_multidev.outputs.target_env }} @@ -256,7 +256,7 @@ jobs: contains(github.event.pull_request.body, '[run-vrt]') || contains(github.event.pull_request.body, '[vrt]') }} - uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v3.2.4 + uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v3.2.5 with: pantheon_site: ${{ inputs.pantheon_site }} target_env: ${{ needs.deploy_pr_multidev.outputs.target_env }} diff --git a/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml b/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml index 43c83e9..166a0f2 100644 --- a/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml +++ b/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml @@ -88,7 +88,7 @@ jobs: echo "Derived RC multidev name: ${TARGET_ENV}" - name: Install Terminus - uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.4 + uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.5 with: machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }} @@ -111,7 +111,7 @@ jobs: - name: Push code to Pantheon multidev id: deploy - uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.4 + uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.5 with: site: ${{ inputs.pantheon_site }} target_env: ${{ steps.derive.outputs.target_env }} @@ -122,7 +122,7 @@ jobs: - name: Run post-deploy drush commands id: drush_commands - uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.4 + uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.5 with: site: ${{ inputs.pantheon_site }} env: ${{ steps.derive.outputs.target_env }} @@ -165,7 +165,7 @@ jobs: needs: deploy_rc_multidev # The security workflow detects rc-* internally and runs unconditionally # in strict mode (fails on any High-severity finding). No force_run needed. - uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.4 + uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.5 with: pantheon_site: ${{ inputs.pantheon_site }} target_env: ${{ needs.deploy_rc_multidev.outputs.target_env }} @@ -193,7 +193,7 @@ jobs: contains(github.event.head_commit.message, '[run-vrt]') || contains(github.event.head_commit.message, '[vrt]') }} - uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v3.2.4 + uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v3.2.5 with: pantheon_site: ${{ inputs.pantheon_site }} target_env: ${{ needs.deploy_rc_multidev.outputs.target_env }} diff --git a/docs/CHANGELOG-AGENT.md b/docs/CHANGELOG-AGENT.md index 2dd0fd5..603e6ab 100644 --- a/docs/CHANGELOG-AGENT.md +++ b/docs/CHANGELOG-AGENT.md @@ -2,6 +2,28 @@ This file tracks the work done together with GitHub Copilot on the Square360 Shared Pantheon Workflows repository. +## 2026-05-22 (later) + +### Fix - pre-flight terminus field query: `connection:info` → `env:info` (v3.2.5) + +- **The bug shipped in v3.2.4.** The pre-flight SFTP-mode check in `.github/actions/pantheon-push/action.yml` was querying the wrong terminus subcommand for the `connection_mode` field: + + ```bash + MODE=$(terminus connection:info "${SITE}.${TARGET_ENV}" --field=connection_mode) + ``` + + `connection_mode` lives on `env:info`, not `connection:info` (which only returns git/sftp connection URLs and commands). Terminus exits 1 with `The requested field, 'connection_mode', is not defined.` The fix is a one-word change: + + ```bash + MODE=$(terminus env:info "${SITE}.${TARGET_ENV}" --field=connection_mode) + ``` +- **Why this slipped past v3.2.4's Yale Health validation:** the original code had `2>/dev/null || echo ""` swallowing terminus errors, so MODE was always empty, the `!= "git"` check always tripped, and `connection:set git` ran defensively every single time — masking the broken field query. Copilot's review on PR #101 correctly flagged the stderr suppression and we removed it. That surfaced this real bug on the first v3.2.5-released consumer deploy (Yale Health, immediately after the plugin v2.0.18 release). +- **Out-of-scope but confirmed sound:** `terminus connection:info "${SITE}.${TARGET_ENV}" --field=git_url` in the verify-after-push step is correct — `git_url` is on `connection:info`. Only the pre-flight call was wrong. + +### Maintenance - Self-reference bumps to v3.2.5 + +- **Bumped all in-repo `uses:` self-references from `@v3.2.4` to `@v3.2.5`** across the four `reusable-pantheon-deploy-*.yml` workflows. Same pin-drift-trap discipline as prior releases. + ## 2026-05-22 ### Fix - `pantheon-push` fails loudly when Pantheon rejects the push (v3.2.4)