<!-- ref:deploy-shared-workflow-v1 -->

# Deploy Shared Workflow

Shared workflow elements for both Bicep and Terraform deploy agents.
Each agent reads this reference and uses its IaC-specific deployment commands.

## Pre-Deploy Challenger Review

Before executing any deployment (after preview/what-if, before apply):

1. Invoke `@challenger-review-subagent` with the preview output summary
2. Focus lens: security-governance (Deny policy violations, destructive operations, missing tags)
3. If `must_fix` count > 0: stop deployment and present findings to user
4. If `should_fix` count > 0: present findings and ask user for explicit approval
5. Log review result to `00-session-state.json` under `review_audit.step_6`

## Preflight: Security Baseline Check

Run `npm run validate:iac-security-baseline` before preview/what-if.
If violations found, hand back to Code agent.
Skip if `05-implementation-reference.md` confirms `security_validation_status: PASSED`.

## Copy-Then-Fill Artifact Protocol

Start `06-deployment-summary.md` from the template, never from memory.

1. Read `.github/skills/azure-artifacts/templates/06-deployment-summary.template.md`
   and copy its full content to `agent-output/{project}/06-deployment-summary.md`
2. Fill each `{placeholder}` with real deployment data — do not add, remove, or reorder H2 headings
3. Verify with `npm run lint:artifact-templates -- agent-output/{project}/06-deployment-summary.md`

The attribution line must match `> Generated by {agent-name} agent` (validated by regex).

## Post-Deploy: Smart PR Flow

If running in a PR context (branch ≠ `main`), after deployment completes:

1. Check CI status via `gh pr checks` or MCP tools
2. Apply label `infraops-ci-pass` or `infraops-needs-fix`
3. If all gates pass and review approved, execute auto-merge
4. See `.github/skills/github-operations/references/smart-pr-flow.md`

## Stopping Rules

Stop immediately if: auth token fails · unresolved placeholders in params
(collect via `askQuestions` first) · preview/validate errors · destructive
operations without approval · >10 resource changes (summarize first) ·
user hasn't approved · deprecation signals detected.

Plan-only mode: if user selects plan/what-if only, generate `06-deployment-summary.md`
with preview results and mark status as simulated/not-applied.

## Default Follow Through Policy

When an approval gate is presented and the user approves, proceed immediately.
Do not re-confirm. If the user provides a custom response, interpret as instructions.

## Boundaries

- Always: run preview before apply, require user approval, validate prerequisites
- Always: use `askQuestions` for deployment approval gates
- Ask first: non-standard parameters, skipping preview, deploying to production
- Do not: deploy without user approval, modify IaC configurations, skip preview for production
