// the find
github/branch-deploy
Enabling Branch Deployments through IssueOps with GitHub Actions - If you find this project useful, give it a star! ⭐️
A GitHub Action that implements branch deployments via PR comments (IssueOps). You comment `.deploy` on a PR, it checks permissions/CI status/branch protection, then gates subsequent workflow steps via outputs. Aimed at teams who want deploy-before-merge workflows without standing up a separate ChatOps bot.
- Solid pre-check logic: respects branch protection rules, CI check status, required reviews, and enforced deployment ordering before allowing a deploy to proceed - this is the hard part and it's well covered.
- Deployment locking (per-environment and global) using lock branches is a practical solution that requires no external state store beyond the repo itself.
- Good test coverage with per-function test files mirroring the src layout, and the coverage badge is actually wired up rather than just decorative.
- The security model is sound - using `issue_comment` trigger means workflow files always run from the default branch, preventing fork-based secret exfiltration that plagues `pull_request_target` workflows.
- The lock mechanism writes lock branches to the repo itself, which pollutes the branch list and creates a dependency on `contents: write` permissions - a fairly broad grant just for locking.
- The action bundles its own compiled `dist/index.js` in-repo (ncc pattern), which means PRs touching `src/` also need to touch `dist/` or CI fails. This is a common GitHub Actions pattern but it makes code review harder and diffing the compiled output is nearly useless.
- 40+ inputs is a lot of surface area, and several interact in non-obvious ways (e.g., `skip_ci` vs `checks` vs `required_contexts` vs `ignored_checks`) - the docs help but misconfiguring these silently allows or blocks deployments in ways that are hard to debug.
- No built-in audit log or persistent deployment history beyond what GitHub's deployments API stores; if you need to answer 'who deployed what and when across all environments last month', you're querying the API yourself.