fix(ci): fix deployment lockups and protect database PVCs

.github/workflows/.deploy.yml

@@ -62,8 +62,7 @@ jobs:
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
       - uses: actions/checkout@v7
-      - name: Stop pre-existing deployments on PRs (status = pending-upgrade)
-        if: github.event_name == 'pull_request'
+      - name: Stop pre-existing deployments (status = pending-*)
         uses: bcgov/action-oc-runner@111868d1fc50db0a40417ba321d865ef5c931bbd # v1.7.0
         with:
           oc_namespace: ${{ vars.oc_namespace }}
@@ -72,12 +71,18 @@ jobs:
           triggers: ${{ inputs.triggers }}
           commands: |
             set -euo pipefail
-            # Interrupt any previous deployments (PR only)
+            # Interrupt any previous deployments
             PREVIOUS=$(helm status ${{ inputs.release_name }} -o json | jq .info.status || true)
             if [[ ${PREVIOUS} =~ pending ]]; then
               echo "Rollback triggered"
-              helm rollback ${{ inputs.release_name }} || \
-                helm uninstall ${{ inputs.release_name }}
+              if [ -n "${{ inputs.environment }}" ]; then
+                # Safe rollback only; never uninstall persistent environments (prod/test)
+                helm rollback ${{ inputs.release_name }}
+              else
+                # Fallback to uninstall permitted for ephemeral PR deployments
+                helm rollback ${{ inputs.release_name }} || \
+                  helm uninstall ${{ inputs.release_name }}
+              fi
             fi
 
       - name: Deploy
@@ -111,6 +116,12 @@ jobs:
             if [ -n "${{ inputs.params }}" ]; then
               PARAMS+="${{ inputs.params }}"
             fi
+            # Force-delete database PVCs ONLY in ephemeral Pull Request (DEV) environments.
+            # For all persistent/formal environments (TEST, PROD, dispatches), we fall back 
+            # to the safe default (keep: true in values.yaml) to prevent accidental data loss.
+            if [ -z "${{ inputs.environment }}" ] && [ "${{ github.event_name }}" = "pull_request" ]; then
+              PARAMS+=" --set database.pvc.keep=false"
+            fi
             echo "PARAMS: $PARAMS"
             echo "COMMANDS: $COMMANDS"
             helm upgrade $PARAMS $COMMANDS pubcode.tgz 

.github/workflows/merge.yml

@@ -8,7 +8,7 @@ on:
 
 concurrency:
   group: ${{ github.workflow }}
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 permissions: {}
 

charts/pubcode/templates/database/templates/pvc.yml

@@ -4,6 +4,10 @@ kind: PersistentVolumeClaim
 metadata:
   name: {{ .Release.Name }}-database
   namespace: {{ .Release.Namespace }}
+  {{- if .Values.database.pvc.keep }}
+  annotations:
+    "helm.sh/resource-policy": keep
+  {{- end }}
   labels:
     {{- include "database.labels" . | nindent 4 }}
 spec:

charts/pubcode/values.yaml

@@ -304,3 +304,4 @@ database:
     size: 750Mi
     storageClassName: netapp-file-standard
     accessModes: ReadWriteMany
+    keep: true