External approval gate

After review and CI, waits for a go/no-go from an external system such as a CD pipeline or a change board. A rejection or a timeout ends the run.

Template	external-approval-gate
Works on	A git repository, cloned into an isolated Docker sandbox
Where a person acts	Nobody inside the run. The pull request it opens is merged by a person, outside it.
Waits on systems	CI result, up to 4h Deployment gate decision, up to 48h

The workflow

Drawn from the template spec at build time. Bookkeeping nodes that only record status are left out; amber nodes are where a person acts.

flowchart TD
  n_validate["Validate"]
  n_implement["Implement"]
  n_review["Review"]
  n_checkApproval{"Check approval?"}
  n_openPR["Open PR"]
  n_checkReviewLimit{"Check review limit?"}
  n_waitForCI[/"Wait for CI<br/><small>waits up to 4h: CI result</small>"/]
  n_terminateReviewFailed(["Failed<br/><small>review failed</small>"])
  n_reviewFix["Review fix"]
  n_checkCI{"Check CI?"}
  n_terminateCITimedOut(["Timed out<br/><small>ci timed out</small>"])
  n_waitForDeployGate[/"Wait for deploy gate<br/><small>waits up to 48h: Deployment gate decision</small>"/]
  n_checkCILimit{"Check CI limit?"}
  n_checkDeployGate{"Check deploy gate?"}
  n_terminateDeployTimedOut(["Timed out<br/><small>deploy timed out</small>"])
  n_terminateCIFailed(["Failed<br/><small>ci failed</small>"])
  n_fetchLogs["Fetch logs"]
  n_done(["Done"])
  n_terminateDeployRejected(["Failed<br/><small>deploy rejected</small>"])
  n_ciFix["CI fix"]
  n_repushAfterCIFix["Repush after CI fix"]
  n_validate --> n_implement
  n_implement --> n_review
  n_review --> n_checkApproval
  n_checkApproval -->|"yes"| n_openPR
  n_checkApproval -->|"no"| n_checkReviewLimit
  n_openPR --> n_waitForCI
  n_checkReviewLimit -->|"yes"| n_terminateReviewFailed
  n_checkReviewLimit -->|"no"| n_reviewFix
  n_waitForCI -->|"received"| n_checkCI
  n_waitForCI -->|"timed out"| n_terminateCITimedOut
  n_reviewFix --> n_review
  n_checkCI -->|"yes"| n_waitForDeployGate
  n_checkCI -->|"no"| n_checkCILimit
  n_waitForDeployGate -->|"received"| n_checkDeployGate
  n_waitForDeployGate -->|"timed out"| n_terminateDeployTimedOut
  n_checkCILimit -->|"yes"| n_terminateCIFailed
  n_checkCILimit -->|"no"| n_fetchLogs
  n_checkDeployGate -->|"yes"| n_done
  n_checkDeployGate -->|"no"| n_terminateDeployRejected
  n_fetchLogs --> n_ciFix
  n_ciFix --> n_repushAfterCIFix
  n_repushAfterCIFix --> n_waitForCI
  class n_waitForCI,n_waitForDeployGate wait

Maturity: built from the flagship steps

Ships as a built-in template and reuses the engineering steps the flagship flow runs. This particular arrangement of them is not separately exercised end to end against a real repository. See product overview §8.

Use it

Every built-in template is seeded into the workflow library and can be cloned, edited on the visual canvas, and versioned — see architecture for the node types. The spec lives in packages/shared/src/workflow/templates/externalApprovalGate.ts.