Overview

You should only merge a PR if you're going to deploy it straight away. Whatever is on master should also be in production, unless there's a problem with the deployment. A typical sequence looks like the following:

1. Check if there are any outstanding deployments for the app.
2. Post about it in #govuk-notify-tech e.g. ":mouse: admin". If manual testing is required in preview. First pause the staging deployment. This should be also be posted on #govuk-notify-tech. Consider using a development environment before preview (See below for info).
3. Merge the branch and monitor the apps pipeline in Concourse.
   • You need to be on the VPN to access Concourse.
4. Wait for the new version to deploy to the preview environment.
5. Do any additional manual testing you need to do in Preview.
   • You need to be on the VPN to access this environment.
6. Release the pause on staging deployment if pause. Post on #govuk-notify-tech.

Apps are continuously deployed. This means it will be automatically deployed to preview, then staging and then production, as long as the functional tests pass at each stage.

If your deployment fails for some reason, you should start a thread in Slack to keep everyone informed. You should also keep an eye on the #govuk-notify-release channel, as some failure notifications will appear there.

Merging

Reviewing a third-party PR

If a third-party user creates a PR against any of our repos, Concourse won't automatically run any tests against it. This is because it would be simple for that user to edit the PR to perform malicious actions in the test script. For these pull requests, the process should be two-stage.

• Manually look through the PR. At this stage we're just interested in does the PR seem honest and well intentioned, or does it look like it'll do something malicious. You don't need to create and publish a GitHub review at this point.

• Pull the branch and then push it.

  export PULL_REQUEST_ID=123 # grab this ID from the URL of their pull request
  git fetch origin pull/$PULL_REQUEST_ID/head:concourse-test-pr-$PULL_REQUEST_ID
  git checkout concourse-test-pr-$PULL_REQUEST_ID
  git push
  

• Follow the link from the output to open the new PR.

Because the new PR is created from within the repo rather than from a fork, concourse will run. Then, because the head commit has the same code sha as the third party's branch, Concourse will update their PR with a ✅ or a ❌ too! Note that the third party isn't able to see the actual test run details, so you'll need to tell them what went wrong.

If you rebase, merge, or add commits to your branch (or if they add commits to their branch) this won't work.

Deploying a branch before merging

This is a quick way to get extra confidence about a change before merging it. See Deploying a Notify Development Environment