Remove duplicate test file and fix expression bypass

- Remove duplicate test file (errors-job-environment-deployment-disabled-feature.yml)
- Move deployment feature flag check before expression skip so
  deployment: ${{ ... }} is still gated by allowDeploymentKeyword

expressions/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/expressions",
-  "version": "0.3.48",
+  "version": "0.3.47",
   "license": "MIT",
   "type": "module",
   "source": "./src/index.ts",

expressions/src/features.test.ts

@@ -56,7 +56,8 @@ describe("FeatureFlags", () => {
         "blockScalarChompingWarning",
         "allowCaseFunction",
         "allowCronTimezone",
-        "allowCopilotRequestsPermission"
+        "allowCopilotRequestsPermission",
+        "allowDeploymentKeyword"
       ]);
     });
   });

expressions/src/features.ts

@@ -46,6 +46,12 @@ export interface ExperimentalFeatures {
    * @default false
    */
   allowCopilotRequestsPermission?: boolean;
+
+  /**
+   * Enable the deployment keyword in workflow job environment.
+   * @default false
+   */
+  allowDeploymentKeyword?: boolean;
 }
 
 /**
@@ -62,7 +68,8 @@ const allFeatureKeys: ExperimentalFeatureKey[] = [
   "blockScalarChompingWarning",
   "allowCaseFunction",
   "allowCronTimezone",
-  "allowCopilotRequestsPermission"
+  "allowCopilotRequestsPermission",
+  "allowDeploymentKeyword"
 ];
 
 export class FeatureFlags {

languageserver/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/languageserver",
-  "version": "0.3.48",
+  "version": "0.3.47",
   "description": "Language server for GitHub Actions",
   "license": "MIT",
   "type": "module",
@@ -48,8 +48,8 @@
     "actions-languageserver": "./bin/actions-languageserver"
   },
   "dependencies": {
-    "@actions/languageservice": "^0.3.48",
-    "@actions/workflow-parser": "^0.3.48",
+    "@actions/languageservice": "^0.3.47",
+    "@actions/workflow-parser": "^0.3.47",
     "@octokit/rest": "^21.1.1",
     "@octokit/types": "^9.0.0",
     "vscode-languageserver": "^8.0.2",

languageservice/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/languageservice",
-  "version": "0.3.48",
+  "version": "0.3.47",
   "description": "Language service for GitHub Actions",
   "license": "MIT",
   "type": "module",
@@ -47,8 +47,8 @@
     "watch": "tsc --build tsconfig.build.json --watch"
   },
   "dependencies": {
-    "@actions/expressions": "^0.3.48",
-    "@actions/workflow-parser": "^0.3.48",
+    "@actions/expressions": "^0.3.47",
+    "@actions/workflow-parser": "^0.3.47",
     "vscode-languageserver-textdocument": "^1.0.7",
     "vscode-languageserver-types": "^3.17.2",
     "vscode-uri": "^3.0.8",

languageservice/src/validate.test.ts

@@ -368,24 +368,6 @@ jobs:
     });
   });
 
-  describe("environment deployment", () => {
-    it("allows deployment boolean under environment mapping", async () => {
-      const workflow = `
-on: push
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    environment:
-      name: prod
-      deployment: false
-    steps:
-    - run: echo
-`;
-      const result = await validate(createDocument("wf.yaml", workflow));
-      expect(result).toEqual([]);
-    });
-  });
-
   describe("workflow_dispatch", () => {
     it("allows empty string in choice options", async () => {
       const result = await validate(

lerna.json

@@ -6,5 +6,5 @@
     "languageservice",
     "languageserver"
   ],
-  "version": "0.3.48"
+  "version": "0.3.47"
 }

package-lock.json

@@ -136,7 +136,7 @@
     },
     "expressions": {
       "name": "@actions/expressions",
-      "version": "0.3.48",
+      "version": "0.3.47",
       "license": "MIT",
       "devDependencies": {
         "@types/jest": "^29.0.3",
@@ -396,11 +396,11 @@
     },
     "languageserver": {
       "name": "@actions/languageserver",
-      "version": "0.3.48",
+      "version": "0.3.47",
       "license": "MIT",
       "dependencies": {
-        "@actions/languageservice": "^0.3.48",
-        "@actions/workflow-parser": "^0.3.48",
+        "@actions/languageservice": "^0.3.47",
+        "@actions/workflow-parser": "^0.3.47",
         "@octokit/rest": "^21.1.1",
         "@octokit/types": "^9.0.0",
         "vscode-languageserver": "^8.0.2",
@@ -927,11 +927,11 @@
     },
     "languageservice": {
       "name": "@actions/languageservice",
-      "version": "0.3.48",
+      "version": "0.3.47",
       "license": "MIT",
       "dependencies": {
-        "@actions/expressions": "^0.3.48",
-        "@actions/workflow-parser": "^0.3.48",
+        "@actions/expressions": "^0.3.47",
+        "@actions/workflow-parser": "^0.3.47",
         "vscode-languageserver-textdocument": "^1.0.7",
         "vscode-languageserver-types": "^3.17.2",
         "vscode-uri": "^3.0.8",
@@ -14020,10 +14020,10 @@
     },
     "workflow-parser": {
       "name": "@actions/workflow-parser",
-      "version": "0.3.48",
+      "version": "0.3.47",
       "license": "MIT",
       "dependencies": {
-        "@actions/expressions": "^0.3.48",
+        "@actions/expressions": "^0.3.47",
         "cronstrue": "^2.21.0",
         "yaml": "^2.0.0-8"
       },

workflow-parser/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/workflow-parser",
-  "version": "0.3.48",
+  "version": "0.3.47",
   "license": "MIT",
   "type": "module",
   "source": "./src/index.ts",
@@ -48,7 +48,7 @@
     "watch": "tsc --build tsconfig.build.json --watch"
   },
   "dependencies": {
-    "@actions/expressions": "^0.3.48",
+    "@actions/expressions": "^0.3.47",
     "cronstrue": "^2.21.0",
     "yaml": "^2.0.0-8"
   },

workflow-parser/src/model/converter/job/environment.ts

@@ -1,3 +1,4 @@
+import {FeatureFlags} from "@actions/expressions/features";
 import {TemplateContext} from "../../../templates/template-context.js";
 import {TemplateToken} from "../../../templates/tokens/template-token.js";
 import {isScalar} from "../../../templates/tokens/type-guards.js";
@@ -22,6 +23,18 @@ export function convertToActionsEnvironmentRef(
 
   for (const property of environmentMapping) {
     const propertyName = property.key.assertString("job environment key");
+
+    // Check deployment feature flag before skipping expressions,
+    // so deployment: ${{ ... }} is still gated by the flag
+    if (propertyName.value === "deployment") {
+      const featureFlags = context.state["featureFlags"] as FeatureFlags | undefined;
+      const flags = featureFlags ?? new FeatureFlags();
+      if (!flags.isEnabled("allowDeploymentKeyword")) {
+        context.error(property.key, `The key 'deployment' is not allowed`);
+        continue;
+      }
+    }
+
     if (property.key.isExpression || property.value.isExpression) {
       continue;
     }
@@ -35,13 +48,9 @@ export function convertToActionsEnvironmentRef(
         result.url = property.value;
         break;
 
-      case "deployment": {
-        const deploymentValue = property.value.assertBoolean("job environment deployment");
-        if (deploymentValue.value === false) {
-          result.skipDeployment = true;
-        }
+      case "deployment":
+        result.deployment = property.value;
         break;
-      }
     }
   }
 

workflow-parser/src/model/workflow-template.ts

@@ -26,7 +26,7 @@ export type ConcurrencySetting = {
 export type ActionsEnvironmentReference = {
   name?: TemplateToken;
   url?: TemplateToken;
-  skipDeployment?: boolean;
+  deployment?: TemplateToken;
 };
 
 export type WorkflowJob = Job | ReusableWorkflowJob;

workflow-parser/src/workflow-v1.0.json

@@ -2082,7 +2082,7 @@
           },
           "deployment": {
             "type": "boolean",
-            "description": "Whether to create a deployment record for this environment. Defaults to true."
+            "description": "Whether to create a deployment for this environment. Set to `false` to access environment secrets and variables without creating a deployment record. Defaults to `true`."
           }
         }
       }

workflow-parser/src/xlang.test.ts

@@ -1,6 +1,7 @@
 import * as fs from "fs";
 import * as path from "path";
 import * as YAML from "yaml";
+import {FeatureFlags} from "@actions/expressions/features";
 import {convertWorkflowTemplate} from "./model/convert.js";
 import {NoOperationTraceWriter} from "./templates/trace-writer.js";
 import {File} from "./workflows/file.js";
@@ -10,6 +11,7 @@ import {parseWorkflow} from "./workflows/workflow-parser.js";
 
 interface TestOptions {
   "include-source"?: boolean;
+  "allow-deployment-keyword"?: boolean;
   skip?: string[];
 }
 
@@ -85,7 +87,10 @@ describe("x-lang tests", () => {
         parseResult.value!, // eslint-disable-line @typescript-eslint/no-non-null-assertion
         testFileProvider,
         {
-          fetchReusableWorkflowDepth: 1
+          fetchReusableWorkflowDepth: 1,
+          featureFlags: new FeatureFlags({
+            allowDeploymentKeyword: testOptions["allow-deployment-keyword"]
+          })
         }
       );
 

workflow-parser/testdata/reader/errors-job-environment-deployment-disabled-feature-default-go.yml

@@ -0,0 +1,21 @@
+include-source: false # Drop file/line/col from output
+skip:
+  - C#
+---
+on: push
+jobs:
+  build:
+    environment:
+      name: production
+      deployment: false
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo hi
+---
+{
+  "errors": [
+    {
+      "Message": ".github/workflows/errors-job-environment-deployment-disabled-feature-default-go.yml (Line: 6, Col: 7): The key 'deployment' is not allowed"
+    }
+  ]
+}

workflow-parser/testdata/reader/errors-job-environment-deployment-disabled-feature.yml

@@ -0,0 +1,21 @@
+include-source: false # Drop file/line/col from output
+skip:
+  - C#
+---
+on: push
+jobs:
+  build:
+    environment:
+      name: production
+      deployment: false
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo hi
+---
+{
+  "errors": [
+    {
+      "Message": ".github/workflows/errors-job-environment-deployment-disabled-feature.yml (Line: 6, Col: 7): The key 'deployment' is not allowed"
+    }
+  ]
+}

workflow-parser/testdata/reader/job-environment-deployment.yml

@@ -1,6 +1,7 @@
 include-source: false # Drop file/line/col from output
 skip:
   - C#
+allow-deployment-keyword: true
 ---
 on: push
 jobs: