[bedatty]

GitHub Actions Shared Workflows

---

Description

Problem. Caradhras deploys through the plugin-access-manager gitops directory (gitops_app_name: "plugin-access-manager" in its release.yml). On benedita, that app's app_extra_envs entry sent every channel to cross (beta, rc, stable). It also added beta to stg-mt, which already gets rc from the normal tag expansion.

A beta runs its migrations on the env's database. An rc or stable cut before those migrations then crash-loops against the newer schema. This happened with Caradhras v1.7.1 on cross (2026-10-23, a hotfix of the previous line cut during the 1.8.0-beta.x series) and with an rc on stg-mt (2026-10-26).

Fix. Each multi-tenant env now follows a single channel:

plugin-access-manager:
  stable: ["cross"]

• cross follows stable only, like tenant-manager's cross.
• stg-mt gets rc only, from the normal expansion. It no longer gets beta.

The comments on the entry and on the app_extra_envs list say why, and mark plugin-access-manager as the one app with a stg-mt directory that takes no beta there.

Scope differs from the issue. The issue suggested app_release_types. That filter removes the app from the whole cluster for the excluded release types, so it would also have cut dev-st, stg-st and prd-st. app_extra_envs is the setting that decides which channels reach the extra envs. The other suggestion, refusing a binary that is behind the database migration, belongs to Caradhras (a schema-version check at startup) rather than to this matrix. Both choices, including cross following stable, were agreed before implementation.

Rollout notes

• Callers read the matrix from main at runtime, so this takes effect once develop reaches main. No release tag is needed.
• It also applies to plugin-access-manager's own releases, which write to the same directory.
• cross and stg-mt already run the newest beta migrations. An rc or stable cut before them can still fail there once more, until the channel catches up.

Type of Change

• feat: New workflow or new input/output/step in an existing workflow
• fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)
• perf: Performance improvement (e.g. caching, parallelism, reduced steps)
• refactor: Internal restructuring with no behavior change
• docs: Documentation only (README, docs/, inline comments)
• ci: Changes to self-CI (workflows under .github/workflows/ that run on this repo)
• chore: Dependency bumps, config updates, maintenance
• test: Adding or updating tests
• BREAKING CHANGE: Callers must update their configuration after this PR

Breaking Changes

None. No caller configuration changes. Betas of Caradhras and plugin-access-manager stop reaching cross and stg-mt, and rcs stop reaching cross. That is the intended change in where they deploy. dev-st, stg-st and prd-st are unaffected.

Testing

• YAML syntax validated locally: the deployment-matrix lint script, run as CI runs it, prints Deployment matrix is valid (49 apps registered, 2 clusters defined); typos is clean
• Triggered a real workflow run on a caller repository pinned to this PR branch (@<pr-branch>) — see the Test this pull request comment
• Verified all existing inputs still work with default values
• Confirmed no secrets or tokens are printed in logs
• Checked that unrelated workflows are not affected

Caller repo / workflow run: not run. The matrix is read from main at runtime, so a branch run would not exercise it.

Related Issues

Closes #981

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: LerianStudio/github-actions-shared-workflows
• Branch: fix/access-manager-single-channel-envs
• File: .coderabbit.yml
• Commit: 0bbd4a9
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Essentials
• Run ID: 8900852e-72af-4804-ac2f-35aff7fc40bd

Commits

Reviewing files that changed from the base of the PR and between 5634859 and 0bbd4a9.

Files selected for processing: 1

• config/deployment-matrix.yml

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Walkthrough

The deployment matrix updates plugin-access-manager extra-environment mappings for Benedita. It removes explicit beta and rc entries for stg-mt and cross, while retaining cross for stable releases.

Changes

Benedita release channels

Layer / File(s)	Summary
Update plugin-access-manager environment mapping config/deployment-matrix.yml	The mapping retains cross for stable releases and removes explicit beta and rc extras for stg-mt and cross. Comments describe the stg-mt exception and release-channel history.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix · Severity of issue fixed: Medium

Possibly related PRs

• LerianStudio/github-actions-shared-workflows#977: Adds per-app release-channel filtering in the deployment matrix; this PR changes extra-environment mappings for plugin-access-manager.

Suggested labels: workflow

Suggested reviewers: ferr3ira-gabriel

Merge Risk: Minimal · up to 0bbd4

This change restricts the cross environment to stable releases and leaves stg-mt on the rc channel, which addresses the crash-loop risk when a beta migrates a database ahead of rc or stable releases. No concrete merge-blocking defect was found. Caller-side environment overrides could still defeat the single-channel intent. Those overrides were not available to check, so it is worth confirming them after merge.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely identifies the main change: keeping each multi-tenant access-manager environment on one release channel.
Description check		The description covers the problem, fix, scope, rollout behavior, breaking-change impact, testing, and related issue. It explicitly explains why no caller workflow run was performed.
Linked Issues check		Issue #981 requires one release channel per multi-tenant environment or a release-time migration check. In config/deployment-matrix.yml, plugin-access-manager now has only stable: ["cross"] unde…
Out of Scope Changes check		The pull request changes only the Benedita app_extra_envs mapping and its explanatory comments. The comments document the migration failure, the gitops_app_name relationship, and the channel behav…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi…

Full details: Linked Issues check

Explanation

Issue #981 requires one release channel per multi-tenant environment or a release-time migration check. In config/deployment-matrix.yml, plugin-access-manager now has only stable: ["cross"] under Benedita app_extra_envs. The normal tag expansion continues to send rc releases to stg-mt, and the beta extra for stg-mt is removed. This implements the matrix option for the Caradhras path described in the issue. The reported deployment-matrix validation also supports the configuration change.

Full details: Out of Scope Changes check

Explanation

The pull request changes only the Benedita app_extra_envs mapping and its explanatory comments. The comments document the migration failure, the gitops_app_name relationship, and the channel behavior. These changes directly support issue #981. No unrelated application behavior, caller workflow, or release-time schema check was added.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[lerian-studio]

🔍 Lint Analysis

Check	Files Scanned	Status
YAML Lint	1 file(s)	✅ success
Action Lint	no changes	⏭️ skipped
Pinned Actions	no changes	⏭️ skipped
Markdown Link Check	no changes	⏭️ skipped
Spelling Check	1 file(s)	✅ success
Shell Check	no changes	⏭️ skipped
README Check	no changes	⏭️ skipped
Composite Schema	no changes	⏭️ skipped
Deployment Matrix	1 file(s)	✅ success

---

_{🔍 View full scan logs}

[lerian-studio]

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
Breaking Change Guard	✅ success	yes
Commit Signatures	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

---

_{🔍 View workflow run}

[lerian-studio]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.