80.8 Project 74: Approval step before production

echo 'input step pauses the pipeline until a person decides'

mkdir -p /tmp/jen74 && echo 'Today: input, submitter, timeout, prod deploy'

echo 'Staging stays automatic; prod waits'

printf '%s\n' '    stage(\'Approve Prod\') {' '      steps {' '        timeout(time: 30, unit: \'MINUTES\') {' '          input message: \'Deploy cart to production?\', ok: \'Deploy\', submitter: \'prod-approvers\'' '        }' '      }' '    }' > /tmp/jen74/INPUT.txt && cat /tmp/jen74/INPUT.txt

echo 'ok label is the button text the approver clicks'

echo 'Without timeout, abandoned runs clog the executor queue'

printf '%s\n' 'Create Jenkins group or assign users: prod-approvers' 'Only those identities can submit this input' > /tmp/jen74/SUBMITTER.txt && cat /tmp/jen74/SUBMITTER.txt

echo 'Developers can see the pause but cannot approve if not in the group'

echo 'Use two people for high-risk services when policy asks'

printf '%s\n' '    stage(\'Prod Deploy\') {' '      steps {' '        sh \'kubectl -n shop-prod set image deploy/cart cart=$ACCOUNT.dkr.ecr.$REGION.amazonaws.com/$REPO:$GIT_SHA\'' '        sh \'kubectl -n shop-prod rollout status deploy/cart --timeout=180s\'' '      }' '    }' > /tmp/jen74/PROD.txt && head -5 /tmp/jen74/PROD.txt

echo 'Use a different kube context or namespace for prod'

echo 'Same SHA that passed staging — no rebuild'

echo 'Click Abort on the input form'

echo 'Pipeline goes red/aborted; Prod Deploy stage must not run'

printf '%s\n' 'Acceptance: abort leaves shop-prod image unchanged' > /tmp/jen74/ACCEPT.txt && cat /tmp/jen74/ACCEPT.txt

echo 'If nobody clicks within 30 minutes the stage fails'

echo 'Pager tip: notify approvers when input appears'

echo 'Do not raise timeout to days — that hides stuck releases'

printf '%s\n' 'Open the paused run in Jenkins classic UI' 'Blue Ocean also shows an Approve button' 'Mailer can notify the submitter group' > /tmp/jen74/UI.txt && cat /tmp/jen74/UI.txt

echo 'Mobile: use the Jenkins app or email deep link if enabled'

echo 'Record approver identity in the build log automatically'

printf '%s\n' 'Order: Build -> Push -> Staging Deploy -> Smoke -> Approve Prod -> Prod Deploy' > /tmp/jen74/ORDER.txt && cat /tmp/jen74/ORDER.txt

echo 'Never ask for approval before staging smoke is green'

echo 'Put the SHA and smoke URL in the input message body'

echo 'milestone() before input helps older builds not steal the gate'

echo 'Disable concurrent builds for prod pipelines if needed'

echo 'Lockable Resources plugin can serialize prod deploys'

printf '%s\n' 'At Paytm in Noida, auto-promote pushed bad config to prod at 2 a.m.' 'Vikram added input with 30-minute timeout and named approvers.' > /tmp/jen74/STORY.txt && wc -l /tmp/jen74/STORY.txt

echo 'Rough cost: about ₹1 crore that night'

echo 'Vikram: PASS'

ls /tmp/jen74

grep submitter /tmp/jen74/INPUT.txt

echo 'Next: Shared libraries project 75'

echo 'input with timeout'

echo 'submitter group set'

echo 'reject leaves prod unchanged'