ci-refuses-to-start-deploy-by-hand

The pipeline refuses a run before it starts, so the deploy has to happen from a workstation — told apart from a real failure first, and with what the manual path costs put back afterwards.

Procedure

  1. start start. Goes next to s1
  2. check Check how long the run lasted. Goes on_fail to s11; next to s2
  3. decision Refused, or failed?. Goes if started to s11; if default to s3
  4. check Read the run's annotation for the reason. Goes on_fail to s11; next to s4
  5. check Check the workstation has what the pipeline had. Goes on_fail to s11; next to s5
  6. check Confirm the working tree is clean and pushed. Goes on_fail to s11; next to s6
  7. action Produce the plan without applying it, RO (read-only). Goes on_fail to s11; next to s7
  8. check Read the plan for destroyed durables. Goes on_fail to s11; next to s8
  9. decision Is the plan the shape a deploy has?. Goes if destroys-state to s11; if default to s9
  10. action Apply, confirming each stack, IRR (irreversible), requires approval. Goes on_fail to s11; next to s10
  11. check Confirm what is live is the new build. Goes on_fail to s11; next to s12
  12. action Put back what the manual path disturbed, RW (reversible-write). Goes on_fail to s11; next to __end_success
  13. escalate Escalate to whoever owns the pipeline. Terminal
  14. end success. Terminal

Open the graph on its own page — larger, printable, and an address you can send.

Walk it without running it — you answer what your environment would answer, and the path, the capabilities, the approvals and the distance back to an undo come out of the document. Nothing executes; there is no Run button here and there will not be one.

Trust

T2 · attested 2026-10-11 · runbooks.directory

Nobody has attested this record. That is the ordinary case: T2 is what the catalog can check on its own, and T3 needs somebody to run the procedure and sign for it.

  • Link liveness has not been checked: it needs a network and the catalog builds without one. Run pnpm gates --online where there is one.

Steps

  1. s1 check — Check how long the run lasted
  2. s2 decision — Refused, or failed?
  3. s3 check — Read the run's annotation for the reason
  4. s4 check — Check the workstation has what the pipeline had
  5. s5 check — Confirm the working tree is clean and pushed
  6. s6 action — Produce the plan without applying it (read-only)
  7. s7 check — Read the plan for destroyed durables
  8. s8 decision — Is the plan the shape a deploy has?
  9. s9 action — Apply, confirming each stack (irreversible) — requires approval
  10. s10 check — Confirm what is live is the new build
  11. s12 action — Put back what the manual path disturbed (reversible-write)
  12. s11 escalate — Escalate to whoever owns the pipeline

Capabilities

This is a privilege request. Check it against your own allowlist before running.

    Provenance

    Source
    https://runbooks.directory/r/std/ci-refuses-to-start-deploy-by-hand/source.md
    Fetched
    2026-09-04
    Source last checked
    not since it was captured on 2026-09-04 — recorded as current
    Licence
    CC-BY-4.0
    How it got here
    Written by this catalog's maintainers and reviewed in full.
    Highest risk in this procedure
    irreversible

    Take it with you

    Run it under supervision

    This procedure contains irreversible steps. Run it here, where the supervisor is the thing invoking the commands and therefore sees every one of them: each step is proposed before it happens and a gate stops for you. Nothing about the run leaves this machine.

    # irreversible steps: every one stops for you before it runs.
npx @runbooks/cli run std/ci-refuses-to-start-deploy-by-hand@1.0.0 --as "$(whoami)" \
  --input environment=<which environment is being deployed, as your tooling names it>