skills.rest
PostHog
PostHogOFFICIAL
Explore all skills by this author →
Website𝕏@PostHogGitHub

gating-production-deploys

Gate GitHub Actions container pushes and deploy dispatches behind the CD_DEPLOY_ENABLED variable.

713|118|Updated Aug 11, 2020
Search Tags:#docker#container registry#Workflow#deployment gating#ci/CD#GitHub actions#devOps
One-click install
npx skills add https://github.com/PostHog/posthog-foss --skill gating-production-deploys
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: gating-production-deploys
Source: https://github.com/PostHog/posthog-foss/tree/main/.agents/skills/gating-production-deploys
Command: npx skills add https://github.com/PostHog/posthog-foss --skill gating-production-deploys

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

When a repository is forked or mirrored, GitHub Actions workflows that push production container images or dispatch production deploys can run from the wrong repository, publishing artifacts or triggering deploys from unintended places. This Skill ensures those steps only run from the single canonical deploy repo.

Core Features & Use Cases

  • Canonical deploy gating: Apply the github.repository_owner == 'PostHog' && vars.CD_DEPLOY_ENABLED == 'true' condition to image-push and deploy-dispatch jobs instead of hardcoding a repository name.
  • Pattern library: Provides ready-made if expressions for whole-job gating, master-only steps, mixed PR/master build jobs, push-step booleans, and reusable workflows with a push input.
  • Scope guardrails: Clarifies what not to gate — release workflows (GitHub releases, npm, crates, Homebrew), pull_request validation builds, and change-detection setup jobs.
  • Use Case: You are editing container-images-cd.yml so a forked mirror does not push prod images to ECR; apply the gate to the push job and set CD_DEPLOY_ENABLED on the canonical repo before merging.

Quick Start

Ask the AI to review my GitHub Actions workflow that pushes a container image and add the CD_DEPLOY_ENABLED gate to the production push and deploy steps.

Frequently Asked Questions about gating-production-deploys

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I gate a GitHub Actions deploy to a single repository?▼

Add the condition `github.repository_owner == 'PostHog' && vars.CD_DEPLOY_ENABLED == 'true'` to the job or step that pushes images or dispatches deploys. This selects one canonical deploy repo via a variable instead of hardcoding the repository name.

How do I prevent a forked repo from pushing Docker images in CI?▼

Gate the push step with the CD_DEPLOY_ENABLED variable check so only the canonical repo publishes. For build jobs that also serve PRs, gate only the master arm of the job's `if` condition or the push boolean.

Should I gate pull_request validation builds in GitHub Actions?▼

No. Gating pull_request builds breaks contributor CI, since forks need validation builds to run. Only gate steps that push a prod-tagged image or trigger a deploy dispatch on master, schedule, or workflow_dispatch events.

Which release workflows should not be gated with CD_DEPLOY_ENABLED?▼

Do not gate workflows that publish GitHub releases, npm packages, crates, or Homebrew formulas, such as build-phrocs.yml or release-cli.yml. Those publish from the public repo by design and must remain ungated.

Why is my master build skipping the deploy after adding the gate?▼

The deploy is skipped because CD_DEPLOY_ENABLED is not set to 'true' on the repository that should ship. Set the variable on the canonical deploy repo before merging, then lint the workflow with actionlint.

Related Skills

Explore More Software Engineering Skills→
hicucuhicucu

preventing-github-actions-loops

Detect cyclic trigger paths in GitHub Actions workflow files.

Community
Intermediate
tsenseitsensei
3

land-and-deploy

Merge pull requests, trigger deployments, and verify production health via canary checks.

Community
Advanced
AstrumonAstrumon

ci-cd-pipeline-builder

Generate CI/CD pipelines for Kotlin Gradle repositories with GitHub Actions or GitLab CI.

Community
Intermediate
app-vitalsapp-vitals
9

repo-config

Configure branch protection, required checks, secrets, and deploy hooks for merge gates.

Official
Advanced