feat: add deployment-id input for per-attempt ArgoCD notification dedupe

.github/workflows/test-helm-raw-default-kube-version.yml

@@ -170,6 +170,21 @@ jobs:
           expected: "networking.k8s.io/v1"
           actual: "${{ steps.ingress.outputs.value }}"
 
+      - name: Get Deployment ID presence
+        id: deployment_id
+        shell: bash
+        run: |-
+          has_deployment_id=$( \
+            yq eval-all 'has("deployment_id")' \
+              ./assert/plat/ue2-sandbox/apps/staging/test-app/config.yaml \
+          )
+          echo "value=${has_deployment_id}" >> $GITHUB_OUTPUT
+
+      - uses: nick-fields/assert-action@0efd6166067d9c59d89c710fab4f79fb066f8985 # v4.0.1
+        with:
+          expected: "false"
+          actual: "${{ steps.deployment_id.outputs.value }}"
+
   teardown:
     runs-on: ubuntu-latest
     needs: [assert]

.github/workflows/test-helm-raw.yml

@@ -96,6 +96,7 @@ jobs:
           github-pat: ${{ steps.github-app.outputs.token }}
           image: nginx
           image-tag: ${{ needs.setup.outputs.random }}
+          deployment-id: ${{ github.run_id }}-${{ github.run_attempt }}
         env:
           AWS_ACCESS_KEY_ID: test
           AWS_SECRET_ACCESS_KEY: test
@@ -191,6 +192,21 @@ jobs:
           expected: "staging.test-app"
           actual: "${{ steps.name.outputs.value }}"
 
+      - name: Get Deployment ID
+        id: deployment_id
+        shell: bash
+        run: |-
+          deployment_id=$( \
+            yq eval-all '.deployment_id' \
+              ./assert/plat/ue2-sandbox/apps/staging/test-app/config.yaml \
+          )
+          echo "value=${deployment_id}" >> $GITHUB_OUTPUT
+
+      - uses: nick-fields/assert-action@0efd6166067d9c59d89c710fab4f79fb066f8985 # v4.0.1
+        with:
+          expected: "${{ github.run_id }}-${{ github.run_attempt }}"
+          actual: "${{ steps.deployment_id.outputs.value }}"
+
   teardown:
     runs-on: ubuntu-latest
     needs: [assert]

README.md

@@ -84,6 +84,7 @@ Deploy environment
             operation: deploy
             debug: false
             synchronously: true
+            deployment-id: ${{ github.run_id }}-${{ github.run_attempt }}
   ```
 
 
@@ -125,13 +126,42 @@ Destroy environment
   ```
 
 
+### Deduping ArgoCD notifications per deploy attempt
+
+ArgoCD's notification `oncePer` trigger dedupes on whichever field you point it at. Keying it on the
+application commit means a rollback — replaying a commit ArgoCD has already notified for — is silently
+suppressed, and the rollback reports no status at all.
+
+Pass `deployment-id` a value that is unique per *deploy attempt* rather than per code state, and point
+`oncePer` at it instead:
+
+```yaml
+  - name: Deploy
+    uses: cloudposse/github-action-deploy-argocd@main
+    with:
+      # ...
+      deployment-id: ${{ github.run_id }}-${{ github.run_attempt }}
+```
+
+The value is written to the generated `config.yaml` alongside the rest of the deploy metadata:
+
+```yaml
+  app_repository: acme/example-app
+  app_commit: 6e6a0e1b0e0c4b2a9f1d3c5e7a9b1d3f5a7c9e1b
+  app_hostname: https://example-app.example.com
+  name: preview.example-app
+  namespace: preview
+  manifests: plat/ue2-sandbox/apps/preview/example-app/manifests
+  deployment_id: "12345678901-2"
+```
+
+The input is optional. Left at its empty default, the `deployment_id` key is omitted from `config.yaml`
+entirely, so callers that do not set it get byte-identical output.
 
 
 
 
-<!-- markdownlint-disable -->
 
-<!-- markdownlint-restore -->
 
 ## Inputs
 <!-- markdownlint-disable -->
@@ -147,6 +177,7 @@ Destroy environment
 | commit-status-github-token | Github token to access the app repository. Defaults to github-pat if not set. | N/A | false |
 | commit-timeout | Commit timeout (in seconds) | 60 | false |
 | debug | Debug mode | false | false |
+| deployment-id | Unique identifier for this deploy attempt (for example, the GitHub run ID joined with the run attempt). When set, it is written to `config.yaml` as `deployment\_id`, which lets ArgoCD dedupe notifications per deploy attempt instead of per commit. Left unset, the key is omitted from `config.yaml`. |  | false |
 | environment | Helmfile environment | preview | false |
 | github-pat | Github PAT to access argocd configuration repository | N/A | true |
 | gitref-sha | Git SHA (Depricated. Use `ref` instead) |  | false |

README.yaml

@@ -88,6 +88,7 @@ usage: |-
               operation: deploy
               debug: false
               synchronously: true
+              deployment-id: ${{ github.run_id }}-${{ github.run_attempt }}
     ```
 
 
@@ -128,5 +129,38 @@ usage: |-
               debug: false
     ```
 
+
+  ### Deduping ArgoCD notifications per deploy attempt
+
+  ArgoCD's notification `oncePer` trigger dedupes on whichever field you point it at. Keying it on the
+  application commit means a rollback — replaying a commit ArgoCD has already notified for — is silently
+  suppressed, and the rollback reports no status at all.
+
+  Pass `deployment-id` a value that is unique per *deploy attempt* rather than per code state, and point
+  `oncePer` at it instead:
+
+  ```yaml
+    - name: Deploy
+      uses: cloudposse/github-action-deploy-argocd@main
+      with:
+        # ...
+        deployment-id: ${{ github.run_id }}-${{ github.run_attempt }}
+  ```
+
+  The value is written to the generated `config.yaml` alongside the rest of the deploy metadata:
+
+  ```yaml
+    app_repository: acme/example-app
+    app_commit: 6e6a0e1b0e0c4b2a9f1d3c5e7a9b1d3f5a7c9e1b
+    app_hostname: https://example-app.example.com
+    name: preview.example-app
+    namespace: preview
+    manifests: plat/ue2-sandbox/apps/preview/example-app/manifests
+    deployment_id: "12345678901-2"
+  ```
+
+  The input is optional. Left at its empty default, the `deployment_id` key is omitted from `config.yaml`
+  entirely, so callers that do not set it get byte-identical output.
+
 include: []
 contributors: []

action.yml

@@ -117,7 +117,11 @@ inputs:
   kube-version:
     description: "Kubernetes version for helm/helmfile rendering (e.g. `1.28`). When provided, skips SSM metadata lookup via chamber."
     required: false
-    default: ""    
+    default: ""
+  deployment-id:
+    description: "Unique identifier for this deploy attempt (for example, the GitHub run ID joined with the run attempt). When set, it is written to `config.yaml` as `deployment_id`, which lets ArgoCD dedupe notifications per deploy attempt instead of per commit. Left unset, the key is omitted from `config.yaml`."
+    required: false
+    default: ""
 outputs:
   webapp-url:
     description: "Web Application url"
@@ -378,6 +382,15 @@ runs:
           namespace: ${{ inputs.namespace }}
           manifests: ${{ steps.config.outputs.path }}/manifests
 
+    - name: Stamp deployment id
+      if: ${{ inputs.operation == 'deploy' && inputs.deployment-id != '' }}
+      shell: bash
+      env:
+        DEPLOYMENT_ID: ${{ inputs.deployment-id }}
+        CONFIG_FILE: ${{ steps.config.outputs.tmp }}/config.yaml
+      run: |-
+        yq --exit-status --no-colors --inplace eval '.deployment_id = strenv(DEPLOYMENT_ID)' "${CONFIG_FILE}"
+
     - name: Push to Github
       uses: nick-fields/retry@v4
       id: git