add deployment protection

Author: aplr

.github/workflows/deploy.yml

@@ -99,13 +99,15 @@ jobs:
       build-context: ${{ inputs.build-context }}
       build-target: ${{ inputs.build-target }}
       build-args: ${{ inputs.build-args }}
+      build-push: ${{ github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch) }}
     secrets:
       aws-key-id: ${{ secrets.aws-key-id }}
       aws-secret-key: ${{ secrets.aws-secret-key }}
       build-secrets: ${{ secrets.build-secrets }}
 
   deploy-staging:
     uses: ./.github/workflows/lambda_deploy.yml
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch)
     needs: [setup, build]
     with:
       environment: staging
@@ -120,7 +122,7 @@ jobs:
 
   deploy-production:
     uses: ./.github/workflows/lambda_deploy.yml
-    if: github.repository != inputs.template-repository-name
+    if: github.repository != inputs.template-repository-name && github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch)
     needs: [setup, build]
     with:
       environment: production
@@ -131,4 +133,4 @@ jobs:
     secrets:
       aws-key-id: ${{ secrets.aws-key-id }}
       aws-secret-key: ${{ secrets.aws-secret-key }}
-      function-admin-api-key: ${{ secrets.function-admin-api-key }}
+      function-admin-api-key: ${{ secrets.function-admin-api-key }}

.github/workflows/lambda_build.yml

@@ -34,6 +34,11 @@ on:
         type: string
         description: "The build arguments to pass to the Docker build"
         required: false
+      build-push:
+        type: boolean
+        description: "Whether to push the image to the registry"
+        required: false
+        default: true
     secrets:
       aws-key-id:
         description: "The AWS access key ID"
@@ -103,11 +108,11 @@ jobs:
           file: ${{ inputs.build-file || 'Dockerfile' }}
           context: ${{ inputs.build-context || '.'}}
           target: ${{ inputs.build-target }}
-          push: true
+          push: ${{ inputs.build-push }}
           provenance: false
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max,ignore-error=true
           build-args: ${{ inputs.build-args }}
-          secrets: ${{ secrets.build-secrets }}
+          secrets: ${{ secrets.build-secrets }}