feat(preview-gated): make the post-deploy record issue optional

Under topology="preview-gated" the "... deployed." issue posted after every
apply is pure audit trail -- nothing reads it back, since promotion to the
next stage is `passed` on the deploy job itself and the gate issue already
authorised the deploy. Add record_deployments=True so callers whose gate
issue is doing the real work can turn the noise off.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019mvaFgGzBYBL2aatAZ2mJG

Author: blarghmatey

pipeline_lib/src/ol_concourse/lib/jobs/infrastructure.py

@@ -182,6 +182,7 @@ def pulumi_jobs_chain(  # noqa: PLR0913, PLR0912, PLR0915
     max_carried_changes: int | str | None = None,
     topology: Literal["deploy-chained", "preview-gated"] = "deploy-chained",
     auto_deploy_stages: list[str] | None = None,
+    record_deployments: bool = True,
 ) -> PipelineFragment:
     """Create a chained sequence of jobs for running Pulumi tasks.
 
@@ -198,6 +199,13 @@ def pulumi_jobs_chain(  # noqa: PLR0913, PLR0912, PLR0915
         used as inputs or triggers for the jobs in the chain.
     :param github_issue_assignees: A list of GitHub usernames that should be assigned
     :param github_issue_labels: A list of GitHub labels that should be applied
+    :param record_deployments: Only used with ``topology="preview-gated"``. When
+        ``True`` (default), every deploy posts a ``... deployed.`` GitHub issue
+        as an audit record. Unlike in ``deploy-chained``, nothing reads that
+        issue back -- promotion is `passed` on the deploy job itself, and the
+        gate issue is what actually authorised the deploy -- so it is a record,
+        not a gate. Set ``False`` to drop it once the gate issue is doing the
+        useful work and the record is just noise.
     :param env_vars_from_files: The list of environment variables that should be set
         during the build and the files to load for populating the values (e.g. the
         `version` file from a GitHub resource)
@@ -233,6 +241,7 @@ def pulumi_jobs_chain(  # noqa: PLR0913, PLR0912, PLR0915
             project_source_path=project_source_path,
             github_issue_repository=github_issue_repository,
             auto_deploy_stages=auto_deploy_stages,
+            record_deployments=record_deployments,
             github_issue_assignees=github_issue_assignees,
             github_issue_labels=github_issue_labels,
             dependencies=dependencies,
@@ -249,6 +258,9 @@ def pulumi_jobs_chain(  # noqa: PLR0913, PLR0912, PLR0915
     if auto_deploy_stages is not None:
         msg = "auto_deploy_stages only applies to topology='preview-gated'"
         raise ValueError(msg)
+    if not record_deployments:
+        msg = "record_deployments=False only applies to topology='preview-gated'"
+        raise ValueError(msg)
 
     chain_fragment = PipelineFragment(resource_types=[github_issues_resource()])
     previous_job = None
@@ -663,6 +675,7 @@ def _preview_gated_chain(  # noqa: PLR0913, PLR0915
     project_source_path: Path,
     github_issue_repository: str,
     auto_deploy_stages: list[str] | None = None,
+    record_deployments: bool = True,
     github_issue_assignees: list[str] | None = None,
     github_issue_labels: list[str] | None = None,
     dependencies: list[GetStep] | None = None,
@@ -719,6 +732,12 @@ def _preview_gated_chain(  # noqa: PLR0913, PLR0915
     the fast feedback loop it exists to provide. Matched case-insensitively
     against both the full stack name and its trailing dotted segment, so both
     ``CI`` and ``mitx.CI`` work.
+
+    *record_deployments* controls the ``... deployed.`` issue posted after
+    every stage's `pulumi up`. It is an audit record only: nothing here reads
+    it back, since promotion to the next stage is `passed` on the deploy job
+    itself and the gate issue already authorised the deploy. Set ``False`` to
+    drop it.
     """
     exempt = {s.lower() for s in (auto_deploy_stages or [])}
 
@@ -817,15 +836,32 @@ def _alerts(job: Job, stack: str, kind: str) -> None:
         serial_group = _stack_serial_group(project_name, stack_name)
         passed_from = [previous_deploy.name] if previous_deploy else None
 
-        record_issue = github_issues(
-            auth_method="token",
-            name=Identifier(f"gh-{project_name.lower()}-{slug}-deployed"),
-            repository=github_issue_repository,
-            issue_title_template=f"[bot] Pulumi {project_name} {stack_name} deployed.",
-            issue_prefix=f"[bot] Pulumi {project_name} {stack_name} deployed.",
-            issue_state="open",
-        )
-        chain.resources.append(record_issue)
+        record_issue = None
+        if record_deployments:
+            deployed_title = f"[bot] Pulumi {project_name} {stack_name} deployed."
+            record_issue = github_issues(
+                auth_method="token",
+                name=Identifier(f"gh-{project_name.lower()}-{slug}-deployed"),
+                repository=github_issue_repository,
+                issue_title_template=deployed_title,
+                issue_prefix=deployed_title,
+                issue_state="open",
+            )
+            chain.resources.append(record_issue)
+
+        def _record_put(
+            stack: str = stack_name, issue: Resource | None = record_issue
+        ) -> PutStep | None:
+            if not issue:
+                return None
+            return PutStep(
+                put=issue.name,
+                params={
+                    "assignees": github_issue_assignees or [],
+                    "labels": _record_labels(stack),
+                    "body_files": [f"{pulumi_resource.name}/{DEPLOY_SUMMARY_FILENAME}"],
+                },
+            )
 
         if is_exempt(stack_name):
             deploy = Job(
@@ -849,16 +885,7 @@ def _alerts(job: Job, stack: str, kind: str) -> None:
                     ),
                     *post_steps,
                 ],
-                on_success=PutStep(
-                    put=record_issue.name,
-                    params={
-                        "assignees": github_issue_assignees or [],
-                        "labels": _record_labels(stack_name),
-                        "body_files": [
-                            f"{pulumi_resource.name}/{DEPLOY_SUMMARY_FILENAME}"
-                        ],
-                    },
-                ),
+                on_success=_record_put(),
             )
             _alerts(deploy, stack_name, "deploy")
             chain.jobs.append(deploy)
@@ -973,14 +1000,7 @@ def _alerts(job: Job, stack: str, kind: str) -> None:
                 ),
                 *post_steps,
             ],
-            on_success=PutStep(
-                put=record_issue.name,
-                params={
-                    "assignees": github_issue_assignees or [],
-                    "labels": _record_labels(stack_name),
-                    "body_files": [f"{pulumi_resource.name}/{DEPLOY_SUMMARY_FILENAME}"],
-                },
-            ),
+            on_success=_record_put(),
         )
 
         _alerts(deploy, stack_name, "deploy")

pipeline_lib/tests/test_infrastructure.py

@@ -593,6 +593,46 @@ def test_every_index_keyed_parameter_is_now_honoured(self):
         )
 
 
+class TestRecordDeployments:
+    """The "deployed" issue is an audit record, not a gate -- it can be dropped."""
+
+    def test_record_deployments_false_rejected_on_default_topology(self):
+        with pytest.raises(ValueError, match="only applies to"):
+            pulumi_jobs_chain(
+                _make_pulumi_code(),
+                stack_names=["CI"],
+                project_name="p",
+                project_source_path=Path("x"),
+                github_issue_repository="org/repo",
+                record_deployments=False,
+            )
+
+    def test_default_still_posts_the_record_on_both_stage_kinds(self):
+        fragment = _gated_chain()
+        exempt_deploy = _job(fragment, "deploy-ol-substructure-keycloak-ci")
+        gated_deploy = _job(fragment, "deploy-ol-substructure-keycloak-qa")
+        assert "deployed" in str(exempt_deploy.on_success.put)
+        assert "deployed" in str(gated_deploy.on_success.put)
+
+    def test_record_deployments_false_drops_the_on_success_put(self):
+        fragment = _gated_chain(record_deployments=False)
+        exempt_deploy = _job(fragment, "deploy-ol-substructure-keycloak-ci")
+        gated_deploy = _job(fragment, "deploy-ol-substructure-keycloak-qa")
+        assert exempt_deploy.on_success is None
+        assert gated_deploy.on_success is None
+
+    def test_record_deployments_false_drops_the_issue_resources(self):
+        fragment = _gated_chain(record_deployments=False)
+        assert not any("deployed" in str(r.name) for r in fragment.resources)
+
+    def test_record_deployments_false_keeps_the_gate(self):
+        """Dropping the record must not touch the actual promotion gate."""
+        fragment = _gated_chain(record_deployments=False)
+        assert _job(fragment, "preview-ol-substructure-keycloak-qa") is not None
+        assert any("gate-post" in str(r.name) for r in fragment.resources)
+        assert any("gate-trigger" in str(r.name) for r in fragment.resources)
+
+
 class TestPreviewGatedStageInputs:
     """Stage inputs are artifacts the Pulumi run consumes, not just triggers.