From b2ba49bdbc12d0bdd4b03f6ec781f2093c97ca17 Mon Sep 17 00:00:00 2001
From: jQuinRivero <joaquinrivero94@gmail.com>
Date: Mon, 2 Nov 2026 12:03:13 -0300
Subject: [PATCH] ci: resolve the GDAL runtime build run in deploy-apps when
 not given

A blank gdal_package_run_id now selects the successful gdal-runtime-build run for the deployed commit and fails with a clear message when none exists. The existing SHA, checksum and attestation checks still apply to the resolved run.
---
 .github/workflows/deploy-apps.yml | 35 ++++++++++++++++++-------------
 1 file changed, 20 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/deploy-apps.yml b/.github/workflows/deploy-apps.yml
index 53d32358..93048975 100644
--- a/.github/workflows/deploy-apps.yml
+++ b/.github/workflows/deploy-apps.yml
@@ -40,7 +40,7 @@ on:
         default: ""
         type: string
       gdal_package_run_id:
-        description: "Successful GDAL runtime build run ID with tested prebuilt Function App packages. Required except for swa-only deployments."
+        description: "Successful GDAL runtime build run ID with tested prebuilt Function App packages. Blank = the successful build for the deployed commit. Unused for swa."
         required: false
         default: ""
         type: string
@@ -66,15 +66,30 @@ jobs:
 
       - name: Download tested Function App packages
         id: function-packages
-        if: >-
-          inputs.gdal_package_run_id != '' &&
-          inputs.component != 'swa'
+        if: inputs.component != 'swa'
         env:
           GH_TOKEN: ${{ github.token }}
           PACKAGE_RUN_ID: ${{ inputs.gdal_package_run_id }}
           EXPECTED_SHA: ${{ github.sha }}
         run: |
           set -euo pipefail
+          if [[ -z "$PACKAGE_RUN_ID" ]]; then
+            PACKAGE_RUN_ID="$(gh run list \
+              --repo "$GITHUB_REPOSITORY" \
+              --workflow gdal-runtime-build.yml \
+              --commit "$EXPECTED_SHA" \
+              --status success \
+              --limit 1 \
+              --json databaseId \
+              --jq '.[0].databaseId // empty')"
+            if [[ -z "$PACKAGE_RUN_ID" ]]; then
+              echo "::error::No successful GDAL runtime build exists for" \
+                   "$EXPECTED_SHA. Run that workflow on this commit, or pass" \
+                   "gdal_package_run_id."
+              exit 1
+            fi
+            echo "Using GDAL runtime build run $PACKAGE_RUN_ID for $EXPECTED_SHA"
+          fi
           if [[ ! "$PACKAGE_RUN_ID" =~ ^[0-9]+$ ]]; then
             echo "::error::gdal_package_run_id must be a numeric Actions run ID"
             exit 1
@@ -106,16 +121,6 @@ jobs:
           done
           echo "directory=$package_dir" >> "$GITHUB_OUTPUT"
 
-      - name: Require prebuilt packages for Function App deployments
-        if: >-
-          inputs.component != 'swa' &&
-          inputs.gdal_package_run_id == ''
-        run: |
-          echo "::error::Function App deployments require gdal_package_run_id." \
-               "Select the successful GDAL runtime build for this exact source" \
-               "SHA so deployment uses the tested, attested, build-once zip."
-          exit 1
-
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
@@ -134,7 +139,7 @@ jobs:
       - name: Resolve hastegeo wheel URL
         id: hastegeo
         if: >-
-          inputs.gdal_package_run_id == '' &&
+          steps.function-packages.outputs.directory == '' &&
           (inputs.component == 'all' ||
           inputs.component == 'funcapi' ||
           inputs.component == 'funcqueue')