ci: reuse candidates for production pull requests

.gitea/actions/quickstack-oci/deploy.test.mjs

@@ -2,16 +2,19 @@ import assert from "node:assert/strict";
 import test from "node:test";
 
 import {
+  classifyVersion2Execution,
   deployExactImage,
   expandTokens,
   mergeEnvironment,
   orderApplications,
   resolveDeploymentBranch,
+  resolvePullRequestHeadBranch,
   selectDeployment,
   selectPipeline,
   toSavePayload,
   validateArtifact,
   validateApplication,
+  validatePromotionPullRequestSource,
   validateTarget,
   validateVersion2Pipeline,
   verifyEndpoint,
@@ -62,6 +65,39 @@ test("resolves push and pull request deployment branches without accepting empty
   );
 });
 
+test("resolves the pull request head branch from direct and payload context", () => {
+  assert.equal(
+    resolvePullRequestHeadBranch({ environment: { GITHUB_HEAD_REF: "staging" } }),
+    "staging",
+  );
+  assert.equal(
+    resolvePullRequestHeadBranch({
+      environment: {},
+      eventPayload: { pull_request: { head: { ref: "release-candidate" } } },
+    }),
+    "release-candidate",
+  );
+  assert.throws(
+    () => resolvePullRequestHeadBranch({ environment: {}, eventPayload: {} }),
+    /Pull request head branch/,
+  );
+});
+
+test("production pull requests validate tested candidates without rebuilding", () => {
+  assert.equal(classifyVersion2Execution({ strategy: "candidate" }, "pull_request"), "build-validation");
+  assert.equal(classifyVersion2Execution({ strategy: "candidate" }, "push"), "build-deploy");
+  assert.equal(classifyVersion2Execution({ strategy: "promote" }, "pull_request"), "validate-candidate");
+  assert.equal(classifyVersion2Execution({ strategy: "promote" }, "push"), "promote");
+  assert.equal(
+    validatePromotionPullRequestSource({ source: { branch: "staging" } }, "staging"),
+    "staging",
+  );
+  assert.throws(
+    () => validatePromotionPullRequestSource({ source: { branch: "staging" } }, "feature"),
+    /must originate from staging, not feature/,
+  );
+});
+
 test("validates OCI paths and repository-local build paths", () => {
   assert.equal(validateTarget({ name: "Web", image: "Owner/Web", appId: "app-1" }).image, "owner/web");
   assert.throws(() => validateTarget({ name: "Web", image: "owner/web", appId: "app-1", context: "../secret" }), /inside/);