fix(preview-gated): chain-constrain dependencies to the previous stage's deploy

Chain-wide `dependencies` (a built Docker image, an AMI) previously carried
only whatever `passed` the caller set on them directly -- typically their own
build job. Nothing tied them to the PREVIOUS STAGE's deploy the way
`pulumi_code` already is via `passed_from`, so an image built after a stage's
own build step, but never actually deployed to the environment before it,
was still eligible to trigger and be approved there. Confirmed against
ol-infrastructure's generated pipelines (PR mitodl/ol-infrastructure#5600):
QA's preview job for the `concourse` AMI accepted any AMI that passed the
packer build, not specifically the one that deployed to CI.

Append the previous stage's deploy job to each chain-wide dependency's
`passed`, same guarantee `pulumi_code` gets, stacked on top of (not
replacing) whatever `passed` the caller already set. Copied, not mutated in
place, so this doesn't reintroduce the deploy-chained mutation trap this
topology exists to avoid. `custom_dependencies` is untouched -- those are
index-scoped and the caller already sets `passed` there explicitly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019mvaFgGzBYBL2aatAZ2mJG

Author: blarghmatey

pipeline_lib/src/ol_concourse/lib/jobs/infrastructure.py

@@ -194,9 +194,14 @@ def pulumi_jobs_chain(  # noqa: PLR0913, PLR0912, PLR0915
     :param project_source_path: The path within the `pulumi_code` resource where the
         code being executed is located
     :param dependencies: A list of `Get` step definitions that are used as inputs or
-        triggers for the jobs in the chain
+        triggers for the jobs in the chain. Under ``topology="preview-gated"``, each
+        of these is also `passed`-constrained to the previous stage's deploy job (in
+        addition to whatever `passed` it already carries, typically a build job) --
+        same promotion guarantee as the Pulumi code get, applied to whatever artifact
+        the Pulumi run also consumes (a built image, an AMI, ...).
     :param custom_dependencies: A dict of indices and `Get` step definitions that are
-        used as inputs or triggers for the jobs in the chain.
+        used as inputs or triggers for the jobs in the chain. Index-scoped and NOT
+        stage-chained -- the caller sets `passed` explicitly per stage here.
     :param github_issue_assignees: A list of GitHub usernames that should be assigned
     :param github_issue_labels: A list of GitHub labels that should be applied
     :param record_deployments: Only used with ``topology="preview-gated"``. When
@@ -738,6 +743,13 @@ def _preview_gated_chain(  # noqa: PLR0913, PLR0915
     it back, since promotion to the next stage is `passed` on the deploy job
     itself and the gate issue already authorised the deploy. Set ``False`` to
     drop it.
+
+    *dependencies* (the chain-wide ones, not *custom_dependencies*) are
+    `passed`-chained to the previous stage's deploy job here too, on top of
+    whatever `passed` the caller already set (typically a build job) --
+    without that, a Docker image or AMI built after this stage's own build
+    step, but never actually deployed to the PREVIOUS stage, would still be
+    eligible to trigger and be approved here.
     """
     exempt = {s.lower() for s in (auto_deploy_stages or [])}
 
@@ -824,17 +836,32 @@ def _alerts(job: Job, stack: str, kind: str) -> None:
 
     previous_deploy: Job | None = None
     for index, stack_name in enumerate(stack_names):
-        # Chain-wide dependencies plus this stage's index-keyed custom ones.
+        passed_from = [previous_deploy.name] if previous_deploy else None
+
+        # Chain-wide dependencies promote stage-to-stage exactly like
+        # pulumi_code: an artifact must have reached the PREVIOUS stage's
+        # deploy to be eligible here, same guarantee `passed_from` gives the
+        # code get. Copied (never mutating the caller's step -- see
+        # _stage_inputs), so this stacks with whatever `passed` the caller
+        # already set (typically the build job) rather than replacing it.
+        # custom_dependencies stays index-scoped and unchained: those already
+        # encode explicit per-stage semantics the caller controls directly.
+        chained_dependencies = []
+        for dep in dependencies or []:
+            dep_copy = dep.model_copy(deep=True)
+            if passed_from and hasattr(dep_copy, "passed"):
+                dep_copy.passed = [*(dep_copy.passed or []), *passed_from]
+            chained_dependencies.append(dep_copy)
+
         stage_inputs, stage_effects = _split_stage_steps(
             [
-                *(dependencies or []),
+                *chained_dependencies,
                 *((custom_dependencies or {}).get(index) or []),
             ]
         )
         post_steps = list((additional_post_steps or {}).get(index) or [])
         slug = stack_name.lower().replace(".", "-")
         serial_group = _stack_serial_group(project_name, stack_name)
-        passed_from = [previous_deploy.name] if previous_deploy else None
 
         record_issue = None
         if record_deployments:

pipeline_lib/tests/test_infrastructure.py

@@ -727,6 +727,55 @@ def test_callers_step_objects_are_not_mutated(self):
         _gated_chain(dependencies=[dep])
         assert dep.trigger is True
 
+    def test_chain_dependencies_are_passed_constrained_to_the_previous_deploy(self):
+        """Without this, an image that only passed its OWN build job -- never
+        actually deployed to the previous stage -- could still trigger and be
+        approved here.
+        """
+        fragment = _gated_chain(dependencies=[self._dep()])
+        qa_dep = self._gets(
+            _job(fragment, "preview-ol-substructure-keycloak-qa"), "some-image"
+        )[0]
+        assert qa_dep.passed == ["deploy-ol-substructure-keycloak-ci"]
+
+        production_dep = self._gets(
+            _job(fragment, "preview-ol-substructure-keycloak-production"),
+            "some-image",
+        )[0]
+        assert production_dep.passed == ["deploy-ol-substructure-keycloak-qa"]
+
+    def test_chain_dependencies_keep_their_own_passed_constraint_too(self):
+        """The chain appends the previous deploy; it doesn't replace an
+        existing constraint such as the artifact's own build job.
+        """
+        fragment = _gated_chain(dependencies=[self._dep(passed=["build-job"])])
+        qa_dep = self._gets(
+            _job(fragment, "preview-ol-substructure-keycloak-qa"), "some-image"
+        )[0]
+        assert qa_dep.passed == [
+            "build-job",
+            "deploy-ol-substructure-keycloak-ci",
+        ]
+
+    def test_chain_dependencies_unconstrained_on_the_first_stage(self):
+        fragment = _gated_chain(dependencies=[self._dep()])
+        ci_dep = self._gets(
+            _job(fragment, "deploy-ol-substructure-keycloak-ci"), "some-image"
+        )[0]
+        assert not ci_dep.passed
+
+    def test_custom_dependencies_stay_unchained(self):
+        """Index-scoped custom_dependencies already encode explicit per-stage
+        `passed` semantics the caller controls -- chaining must not touch them.
+        """
+        fragment = _gated_chain(
+            custom_dependencies={1: [self._dep("qa-only-artifact")]}
+        )
+        dep = self._gets(
+            _job(fragment, "preview-ol-substructure-keycloak-qa"), "qa-only-artifact"
+        )[0]
+        assert not dep.passed
+
 
 class TestPreviewGatedSideEffects:
     """Nothing that writes to the outside world may fire from a preview.
@@ -902,10 +951,14 @@ def test_existing_passed_constraints_are_kept(self):
         assert "build-image" in (dep.passed or [])
 
     def test_preview_input_is_not_self_correlated(self):
-        """The preview cannot require having passed itself."""
+        """The preview cannot require having passed itself.
+
+        It IS chain-constrained to the previous stage's deploy, same as any
+        other chain-wide dependency -- just not to its own not-yet-run preview.
+        """
         preview = _job(self._chain(), "preview-ol-substructure-keycloak-qa")
         dep = next(s for s in preview.plan if str(getattr(s, "get", "")) == "app-image")
-        assert dep.passed == ["build-image"]
+        assert dep.passed == ["build-image", "deploy-ol-substructure-keycloak-ci"]
 
     def test_exempt_stage_input_is_untouched(self):
         deploy = _job(self._chain(), "deploy-ol-substructure-keycloak-ci")