From b500dbdf2d720f46fb8d6edcf12f7e3d59dbdc4b Mon Sep 17 00:00:00 2001
From: Salman Chishti <salmanmkc@GitHub.com>
Date: Wed, 18 Mar 2026 15:49:42 +0000
Subject: [PATCH] Remove duplicate test file and fix expression bypass

- Remove duplicate test file (errors-job-environment-deployment-disabled-feature.yml)
- Move deployment feature flag check before expression skip so
  deployment: ${{ ... }} is still gated by allowDeploymentKeyword
---
 .../src/model/converter/job/environment.ts    | 23 +++++++++++--------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/workflow-parser/src/model/converter/job/environment.ts b/workflow-parser/src/model/converter/job/environment.ts
index 62f729c..f7825c7 100644
--- a/workflow-parser/src/model/converter/job/environment.ts
+++ b/workflow-parser/src/model/converter/job/environment.ts
@@ -23,6 +23,18 @@ export function convertToActionsEnvironmentRef(
 
   for (const property of environmentMapping) {
     const propertyName = property.key.assertString("job environment key");
+
+    // Check deployment feature flag before skipping expressions,
+    // so deployment: ${{ ... }} is still gated by the flag
+    if (propertyName.value === "deployment") {
+      const featureFlags = context.state["featureFlags"] as FeatureFlags | undefined;
+      const flags = featureFlags ?? new FeatureFlags();
+      if (!flags.isEnabled("allowDeploymentKeyword")) {
+        context.error(property.key, `The key 'deployment' is not allowed`);
+        continue;
+      }
+    }
+
     if (property.key.isExpression || property.value.isExpression) {
       continue;
     }
@@ -36,16 +48,9 @@ export function convertToActionsEnvironmentRef(
         result.url = property.value;
         break;
 
-      case "deployment": {
-        const featureFlags = context.state["featureFlags"] as FeatureFlags | undefined;
-        const flags = featureFlags ?? new FeatureFlags();
-        if (flags.isEnabled("allowDeploymentKeyword")) {
-          result.deployment = property.value;
-        } else {
-          context.error(property.key, `The key 'deployment' is not allowed`);
-        }
+      case "deployment":
+        result.deployment = property.value;
         break;
-      }
     }
   }