misc: Release candidate v0.47.0

Wire.go

@@ -345,6 +345,9 @@ func InitializeApp() (*App, error) {
 		pipeline.NewCiCdPipelineOrchestrator,
 		wire.Bind(new(pipeline.CiCdPipelineOrchestrator), new(*pipeline.CiCdPipelineOrchestratorImpl)),
 
+		pipeline.NewGitMaterialVariableSyncServiceImpl,
+		wire.Bind(new(pipeline.GitMaterialVariableSyncService), new(*pipeline.GitMaterialVariableSyncServiceImpl)),
+
 		// scoped variables start
 		variables.NewScopedVariableServiceImpl,
 		wire.Bind(new(variables.ScopedVariableService), new(*variables.ScopedVariableServiceImpl)),
@@ -367,6 +370,9 @@ func InitializeApp() (*App, error) {
 		variables.NewScopedVariableCMCSManagerImpl,
 		wire.Bind(new(variables.ScopedVariableCMCSManager), new(*variables.ScopedVariableCMCSManagerImpl)),
 
+		variables.NewRepoFieldVariableResolverImpl,
+		wire.Bind(new(variables.RepoFieldVariableResolver), new(*variables.RepoFieldVariableResolverImpl)),
+
 		// end
 
 		gitOpsConfig.NewDevtronAppGitOpConfigServiceImpl,

api/restHandler/app/pipeline/configure/BuildPipelineRestHandler.go

@@ -33,6 +33,7 @@
 	bean2 "github.com/devtron-labs/devtron/pkg/build/pipeline/bean"
 	eventProcessorBean "github.com/devtron-labs/devtron/pkg/eventProcessor/bean"
 	constants2 "github.com/devtron-labs/devtron/pkg/pipeline/constants"
+	"github.com/devtron-labs/devtron/pkg/variables"
 	"github.com/devtron-labs/devtron/util/stringsUtil"
 	"golang.org/x/exp/maps"
 
@@ -124,7 +125,7 @@
 	}
 	createRequest.UserId = userId
 
 	handler.Logger.Infow("request payload, create ci config", "create request", createRequest)
 
 	if !handler.validateRequestBody(w, createRequest, "create ci config") {
 		return
@@ -199,7 +200,7 @@
 	}
 	patchRequest.UserId = userId
 
 	handler.Logger.Debugw("update request ", "req", patchRequest)
 
 	token := r.Header.Get("token")
 	_, authorized := handler.getAppAndCheckAuthForAction(w, patchRequest.AppId, token, casbin.ActionTrigger)
@@ -223,7 +224,7 @@
 	// Update the pipeline
 	err := handler.pipelineBuilder.PatchRegexCiPipeline(&patchRequest)
 	if err != nil {
 		handler.Logger.Errorw("service err, PatchCiPipelines", "err", err, "PatchCiPipelines", patchRequest)
 		common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)
 		return
 	}
@@ -1000,7 +1001,7 @@
 	common.WriteJsonResp(w, nil, resp, http.StatusOK)
 }
 
 func (handler *PipelineConfigRestHandlerImpl) GetBuildHistory(w http.ResponseWriter, r *http.Request) {
 	userId, err := handler.userAuthService.GetLoggedInUser(r)
 	if userId == 0 || err != nil {
 		common.HandleUnauthorized(w, r)
@@ -1027,7 +1028,7 @@
 	handler.Logger.Infow("request payload, GetBuildHistory", "pipelineId", pipelineId, "offset", offset)
 	ciPipeline, err := handler.ciPipelineRepository.FindById(pipelineId)
 	if err != nil {
 		handler.Logger.Errorw("service err, GetBuildHistory", "err", err, "pipelineId", pipelineId, "offset", offset)
 		common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)
 		return
 	}
@@ -1363,6 +1364,11 @@
 		return
 	}
 	for _, gitMaterial := range createMaterialDto.Material {
+		// a @{{VAR_NAME}} reference isn't a real URL yet - skip the format check here,
+		// RepoFieldVariableResolver validates and resolves it before use
+		if variables.IsFullVariableReference(gitMaterial.Url) {
+			continue
+		}
 		validationResult, err := handler.ValidateGitMaterialUrl(gitMaterial.GitProviderId, gitMaterial.Url)
 		if err != nil {
 			handler.Logger.Errorw("service err, CreateMaterial", "err", err, "CreateMaterial", createMaterialDto)
@@ -1409,16 +1415,20 @@
 		common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
 		return
 	}
-	validationResult, err := handler.ValidateGitMaterialUrl(updateMaterialDto.Material.GitProviderId, updateMaterialDto.Material.Url)
-	if err != nil {
-		handler.Logger.Errorw("service err, UpdateMaterial", "err", err, "UpdateMaterial", updateMaterialDto)
-		common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)
-		return
-	} else {
-		if !validationResult {
-			handler.Logger.Errorw("validation err, UpdateMaterial : invalid git material url", "err", err, "gitMaterialUrl", updateMaterialDto.Material.Url, "UpdateMaterial", updateMaterialDto)
-			common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
+	// a @{{VAR_NAME}} reference isn't a real URL yet - skip the format check here,
+	// RepoFieldVariableResolver validates and resolves it before use
+	if !variables.IsFullVariableReference(updateMaterialDto.Material.Url) {
+		validationResult, err := handler.ValidateGitMaterialUrl(updateMaterialDto.Material.GitProviderId, updateMaterialDto.Material.Url)
+		if err != nil {
+			handler.Logger.Errorw("service err, UpdateMaterial", "err", err, "UpdateMaterial", updateMaterialDto)
+			common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)
 			return
+		} else {
+			if !validationResult {
+				handler.Logger.Errorw("validation err, UpdateMaterial : invalid git material url", "err", err, "gitMaterialUrl", updateMaterialDto.Material.Url, "UpdateMaterial", updateMaterialDto)
+				common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
+				return
+			}
 		}
 	}
 	resourceObject := handler.enforcerUtil.GetAppRBACNameByAppId(updateMaterialDto.AppId)
@@ -1531,7 +1541,7 @@
 	vars := mux.Vars(r)
 	workflowId, err := strconv.Atoi(vars["workflowId"])
 	if err != nil {
 		handler.Logger.Errorw("request err, CancelWorkflow", "err", err, "workflowId", workflowId)
 		common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
 		return
 	}
@@ -1723,7 +1733,7 @@
 	if err != nil {
 		// response already written by ExtractIntPathParamWithContext
 		// common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
 		handler.Logger.Error("request err getting , FetchWorkflowDetails", "appId", appId, "err", err)
 		return
 	}
 	// pipelineId, err := strconv.Atoi(vars["pipelineId"])
@@ -1988,7 +1998,7 @@
 	common.WriteJsonResp(w, err, ciConf, http.StatusOK)
 }
 
 func (handler *PipelineConfigRestHandlerImpl) CreateUpdateImageTagging(w http.ResponseWriter, r *http.Request) {
 	vars := mux.Vars(r)
 	token := r.Header.Get("token")
 	userId, err := handler.userAuthService.GetLoggedInUser(r)
@@ -2128,7 +2138,7 @@
 	common.WriteJsonResp(w, err, resp, http.StatusOK)
 }
 
 func (handler *PipelineConfigRestHandlerImpl) extractCipipelineMetaForImageTags(artifactId int) (externalCi bool, ciPipelineId int, appId int, err error) {
 	externalCi = false
 	ciPipelineId = 0
 	appId = 0

api/restHandler/app/pipeline/configure/DeploymentPipelineRestHandler.go

@@ -279,7 +279,7 @@
 	common.WriteJsonResp(w, err, createResp, http.StatusOK)
 }
 
 func (handler *PipelineConfigRestHandlerImpl) PatchCdPipeline(w http.ResponseWriter, r *http.Request) {
 	decoder := json.NewDecoder(r.Body)
 	userId, err := handler.userAuthService.GetLoggedInUser(r)
 	if userId == 0 || err != nil {
@@ -290,38 +290,61 @@
 	err = decoder.Decode(&cdPipeline)
 	cdPipeline.UserId = userId
 	if err != nil {
 		handler.Logger.Errorw("request err, PatchCdPipeline", "err", err, "payload", cdPipeline)
 		common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
 		return
 	}
 
 	v := r.URL.Query()
-	forceDelete := false
-	cascadeDelete := true
 	force := v.Get("force")
 	cascade := v.Get("cascade")
-	if len(force) > 0 && len(cascade) > 0 {
-		handler.Logger.Errorw("request err, PatchCdPipeline", "err", fmt.Errorf("cannot perform both cascade and force delete"), "payload", cdPipeline)
+	foreground := v.Get("foregroundDelete")
+	if len(force) > 0 && len(cascade) > 0 && len(foreground) > 0 {
+		err = fmt.Errorf("cannot perform force, cascade and foreground delete together")
+		handler.Logger.Errorw("request err, PatchCdPipeline", "err", err, "payload", cdPipeline)
+		common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
+		return
+	} else if len(force) > 0 && len(cascade) > 0 {
+		err = fmt.Errorf("cannot perform both cascade and force delete")
+		handler.Logger.Errorw("request err, PatchCdPipeline", "err", err, "payload", cdPipeline)
+		common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
+		return
+	} else if len(foreground) > 0 && len(cascade) > 0 {
+		err = fmt.Errorf("cannot perform both cascade and foreground delete")
+		handler.Logger.Errorw("request err, PatchCdPipeline", "err", err, "payload", cdPipeline)
+		common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
+		return
+	} else if len(foreground) > 0 && len(force) > 0 {
+		err = fmt.Errorf("cannot perform both force and foreground delete")
+		handler.Logger.Errorw("request err, PatchCdPipeline", "err", err, "payload", cdPipeline)
 		common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
 		return
 	}
-	if len(force) > 0 {
-		forceDelete, err = strconv.ParseBool(force)
+	if len(foreground) > 0 {
+		foregroundDelete, err := strconv.ParseBool(foreground)
+		if err != nil {
+			handler.Logger.Errorw("request err, PatchCdPipeline", "err", err, "payload", cdPipeline)
+			common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
+			return
+		}
+		cdPipeline.ForegroundDelete = &foregroundDelete
+	} else if len(force) > 0 {
+		forceDelete, err := strconv.ParseBool(force)
 		if err != nil {
 			handler.Logger.Errorw("request err, PatchCdPipeline", "err", err, "payload", cdPipeline)
 			common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
 			return
 		}
+		cdPipeline.ForceDelete = forceDelete
 	} else if len(cascade) > 0 {
-		cascadeDelete, err = strconv.ParseBool(cascade)
+		cascadeDelete, err := strconv.ParseBool(cascade)
 		if err != nil {
 			handler.Logger.Errorw("request err, PatchCdPipeline", "err", err, "payload", cdPipeline)
 			common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
 			return
 		}
+		cdPipeline.NonCascadeDelete = !cascadeDelete
 	}
-	cdPipeline.ForceDelete = forceDelete
-	cdPipeline.NonCascadeDelete = !cascadeDelete
 	handler.Logger.Infow("request payload, PatchCdPipeline", "payload", cdPipeline)
 	err = handler.validator.StructPartial(cdPipeline, "AppId", "Action")
 	if err == nil {
@@ -668,7 +691,7 @@
 	}
 	validate, err2 := handler.deploymentTemplateValidationService.DeploymentTemplateValidate(r.Context(), envConfigProperties.EnvOverrideValues, chartRefId, scope)
 	if !validate {
 		handler.Logger.Errorw("validation err, UpdateAppOverride", "err", err2, "payload", envConfigProperties)
 		common.WriteJsonResp(w, err2, nil, http.StatusBadRequest)
 		return
 	}
@@ -782,7 +805,7 @@
 	token := r.Header.Get("token")
 	app, err := handler.pipelineBuilder.GetApp(appId)
 	if err != nil {
 		handler.Logger.Errorw("service err, GetEnvConfigOverride", "err", err, "payload", appId, environmentId, chartRefId)
 		common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
 		return
 	}
@@ -1023,7 +1046,7 @@
 	vars := mux.Vars(r)
 	appId, err := strconv.Atoi(vars["appId"])
 	if err != nil {
 		handler.Logger.Errorw("request err, GetCdPipelines", "err", err, "appId", appId)
 		common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
 		return
 	}
@@ -1031,7 +1054,7 @@
 	token := r.Header.Get("token")
 	app, err := handler.pipelineBuilder.GetApp(appId)
 	if err != nil {
 		handler.Logger.Errorw("service err, GetCdPipelines", "err", err, "appId", appId)
 		common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
 		return
 	}
@@ -1126,7 +1149,7 @@
 	if offsetQueryParam != "" {
 		offset, err = strconv.Atoi(offsetQueryParam)
 		if err != nil || offset < 0 {
 			handler.Logger.Errorw("request err, GetArtifactsForRollback", "offsetQueryParam", offsetQueryParam, "err", err)
 			common.WriteJsonResp(w, err, "invalid offset", http.StatusBadRequest)
 			return
 		}
@@ -1183,7 +1206,7 @@
 
 	appTags, err := handler.imageTaggingReadService.GetUniqueTagsByAppId(pipeline.AppId)
 	if err != nil {
 		handler.Logger.Errorw("service err, GetTagsByAppId", "appId", pipeline.AppId, "err", err)
 		common.WriteJsonResp(w, err, ciArtifactResponse, http.StatusInternalServerError)
 		return
 	}
@@ -1380,7 +1403,7 @@
 	token := r.Header.Get("token")
 	deploymentPipeline, err := handler.pipelineBuilder.FindPipelineById(cdPipelineId)
 	if err != nil {
 		handler.Logger.Errorw("service err, GetArtifactsForRollback", "err", err, "cdPipelineId", cdPipelineId)
 		common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
 		return
 	}

api/restHandler/scopedVariable/ScopedVariableRestHandler.go

@@ -23,7 +23,9 @@
 	"net/http"
 	"strconv"
 
+	"github.com/devtron-labs/common-lib/async"
 	"github.com/devtron-labs/devtron/api/restHandler/common"
+	util2 "github.com/devtron-labs/devtron/internal/util"
 	"github.com/devtron-labs/devtron/pkg/auth/authorisation/casbin"
 	"github.com/devtron-labs/devtron/pkg/auth/user"
 	"github.com/devtron-labs/devtron/pkg/bean"
@@ -42,31 +44,36 @@
 	CreateVariables(w http.ResponseWriter, r *http.Request)
 	GetScopedVariables(w http.ResponseWriter, r *http.Request)
 	GetJsonForVariables(w http.ResponseWriter, r *http.Request)
+	GetVariableUsage(w http.ResponseWriter, r *http.Request)
 }
 
 type ScopedVariableRestHandlerImpl struct {
-	logger                *zap.SugaredLogger
-	userAuthService       user.UserService
-	validator             *validator.Validate
-	pipelineBuilder       pipeline.PipelineBuilder
-	enforcerUtil          rbac.EnforcerUtil
-	enforcer              casbin.Enforcer
-	scopedVariableService variables.ScopedVariableService
+	logger                         *zap.SugaredLogger
+	userAuthService                user.UserService
+	validator                      *validator.Validate
+	pipelineBuilder                pipeline.PipelineBuilder
+	enforcerUtil                   rbac.EnforcerUtil
+	enforcer                       casbin.Enforcer
+	scopedVariableService          variables.ScopedVariableService
+	gitMaterialVariableSyncService pipeline.GitMaterialVariableSyncService
+	asyncRunnable                  *async.Runnable
 }
 type JsonResponse struct {
 	Manifest   *models.ScopedVariableManifest `json:"manifest"`
 	JsonSchema string                         `json:"jsonSchema"`
 }
 
-func NewScopedVariableRestHandlerImpl(logger *zap.SugaredLogger, userAuthService user.UserService, validator *validator.Validate, pipelineBuilder pipeline.PipelineBuilder, enforcerUtil rbac.EnforcerUtil, enforcer casbin.Enforcer, scopedVariableService variables.ScopedVariableService) *ScopedVariableRestHandlerImpl {
+func NewScopedVariableRestHandlerImpl(logger *zap.SugaredLogger, userAuthService user.UserService, validator *validator.Validate, pipelineBuilder pipeline.PipelineBuilder, enforcerUtil rbac.EnforcerUtil, enforcer casbin.Enforcer, scopedVariableService variables.ScopedVariableService, gitMaterialVariableSyncService pipeline.GitMaterialVariableSyncService, asyncRunnable *async.Runnable) *ScopedVariableRestHandlerImpl {
 	return &ScopedVariableRestHandlerImpl{
-		logger:                logger,
-		userAuthService:       userAuthService,
-		validator:             validator,
-		pipelineBuilder:       pipelineBuilder,
-		enforcerUtil:          enforcerUtil,
-		enforcer:              enforcer,
-		scopedVariableService: scopedVariableService,
+		logger:                         logger,
+		userAuthService:                userAuthService,
+		validator:                      validator,
+		pipelineBuilder:                pipelineBuilder,
+		enforcerUtil:                   enforcerUtil,
+		enforcer:                       enforcer,
+		scopedVariableService:          scopedVariableService,
+		gitMaterialVariableSyncService: gitMaterialVariableSyncService,
+		asyncRunnable:                  asyncRunnable,
 	}
 }
 func (handler *ScopedVariableRestHandlerImpl) CreateVariables(w http.ResponseWriter, r *http.Request) {
@@ -94,7 +101,12 @@
 		return
 	}
 
-	payload := utils.ManifestToPayload(request.Manifest, userId)
+	payload, err := utils.ManifestToPayload(request.Manifest, userId)
+	if err != nil {
+		handler.logger.Errorw("invalid manifest in CreateVariables", "err", err)
+		common.WriteJsonResp(w, err, nil, http.StatusNotAcceptable)
+		return
+	}
 
 	// not logging bean object as it contains sensitive data
 	handler.logger.Infow("request payload received for variables")
@@ -108,15 +120,59 @@
 	//RBAC enforcer Ends
 	err = handler.scopedVariableService.CreateVariables(payload)
 	if err != nil {
-		if errors.As(err, &models.ValidationError{}) {
+		var deletionBlockedErr *models.VariableDeletionBlockedError
+		if errors.As(err, &deletionBlockedErr) {
+			apiErr := &util2.ApiError{
+				HttpStatusCode:    http.StatusConflict,
+				Code:              strconv.Itoa(http.StatusConflict),
+				InternalMessage:   deletionBlockedErr.Error(),
+				UserMessage:       deletionBlockedErr.Error(),
+				UserDetailMessage: deletionBlockedErr.UsageSummary(20),
+			}
+			common.WriteJsonResp(w, apiErr, nil, http.StatusConflict)
+		} else if errors.As(err, &models.ValidationError{}) {
 			common.WriteJsonResp(w, err, nil, http.StatusNotAcceptable)
 		} else {
 			common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
 		}
 		return
 	}
+	// CreateVariables replaces the entire variable set, so any Git Material referencing a
+	// scoped variable may need its git-sensor copy refreshed - run off-thread since each
+	// push to git-sensor can take up to its own timeout ceiling, and this must not block
+	// the response for a save that already succeeded above.
+	handler.asyncRunnable.Execute(func() {
+		if syncErr := handler.gitMaterialVariableSyncService.ResyncGitMaterialsForVariableChange(); syncErr != nil {
+			handler.logger.Errorw("error re-syncing git materials after variable change", "err", syncErr)
+		}
+	})
 	common.WriteJsonResp(w, nil, nil, http.StatusOK)
 }
+
+func (handler *ScopedVariableRestHandlerImpl) GetVariableUsage(w http.ResponseWriter, r *http.Request) {
+	userId, err := handler.userAuthService.GetLoggedInUser(r)
+	if userId == 0 || err != nil {
+		common.HandleUnauthorized(w, r)
+		return
+	}
+
+	// RBAC enforcer applying
+	token := r.Header.Get("token")
+	if isSuperAdmin := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*"); !isSuperAdmin {
+		common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)
+		return
+	}
+	//RBAC enforcer Ends
+
+	variableName := r.URL.Query().Get("name")
+	usages, err := handler.scopedVariableService.GetVariableUsage(variableName)
+	if err != nil {
+		handler.logger.Errorw("service err, GetVariableUsage", "variableName", variableName, "err", err)
+		common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)
+		return
+	}
+	common.WriteJsonResp(w, nil, usages, http.StatusOK)
+}
 func (handler *ScopedVariableRestHandlerImpl) GetScopedVariables(w http.ResponseWriter, r *http.Request) {
 	token := r.Header.Get("token")
 	isSuperAdmin := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionGet, "*")

api/router/ScopedVariableRouter.go

@@ -46,5 +46,8 @@ func (impl ScopedVariableRouterImpl) InitScopedVariableRouter(router *mux.Router
 	router.Path("/variables/detail").
 		HandlerFunc(impl.scopedVariableRestHandler.GetJsonForVariables).
 		Methods("GET")
+	router.Path("/variables/usage").
+		HandlerFunc(impl.scopedVariableRestHandler.GetVariableUsage).
+		Methods("GET")
 
 }

env_gen.md

@@ -15,6 +15,7 @@
  | FEATURE_MIGRATE_ARGOCD_APPLICATION_ENABLE | bool |false | enable migration of external argocd application to devtron pipeline |  | false |
  | FEATURE_MIGRATE_FLUX_APPLICATION_ENABLE | bool |false | enable flux application services |  | false |
  | FLUX_CD_PIPELINE_STATUS_CHECK_ELIGIBLE_TIME | string |120 | eligible time for checking flux app status periodically and update in db, value is in seconds., default is 120, if wfr is updated within configured time i.e. FLUX_CD_PIPELINE_STATUS_CHECK_ELIGIBLE_TIME then do not include for this cron cycle. |  | false |
+ | FOREGROUND_DELETE_CD_PIPELINE | bool |false | If enabled, deleting a CD pipeline will not delete the underlying deployed resource (helm release/argocd application/flux release) unless the request explicitly overrides it via payload. |  | false |
  | HELM_PIPELINE_STATUS_CHECK_ELIGIBLE_TIME | string |120 | eligible time for checking helm app status periodically and update in db, value is in seconds., default is 120, if wfr is updated within configured time i.e. HELM_PIPELINE_STATUS_CHECK_ELIGIBLE_TIME then do not include for this cron cycle. |  | false |
  | IS_INTERNAL_USE | bool |true | If enabled then cd pipeline and helm apps will not need the deployment app type mandatorily. Couple this flag with HIDE_GITOPS_OR_HELM_OPTION (in Dashborad) and if gitops is configured and allowed for the env, pipeline/ helm app will gitops else no-gitops. |  | false |
  | MIGRATE_DEPLOYMENT_CONFIG_DATA | bool |false | migrate deployment config data from charts table to deployment_config table |  | false |

go.mod

@@ -341,7 +341,7 @@ replace (
 	// Keep the left side unversioned: a versioned LHS stops matching whenever the
 	// require line is bumped, which silently un-pins this and breaks the linux build.
 	github.com/cyphar/filepath-securejoin => github.com/cyphar/filepath-securejoin v0.3.6 // indirect
-	github.com/devtron-labs/authenticator => github.com/devtron-labs/devtron-services/authenticator v0.0.0-20260803100101-66fcb35e4b0e
-	github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260803100101-66fcb35e4b0e
+	github.com/devtron-labs/authenticator => github.com/devtron-labs/devtron-services/authenticator v0.0.0-20260921111017-f0b3fba15081
+	github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260921111017-f0b3fba15081
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 => go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1
 )

go.sum

@@ -237,10 +237,10 @@ github.com/denisenkom/go-mssqldb v0.0.0-20200428022330-06a60b6afbbc h1:VRRKCwnzq
 github.com/denisenkom/go-mssqldb v0.0.0-20200428022330-06a60b6afbbc/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
 github.com/devtron-labs/argo-workflows/v3 v3.5.13 h1:3pINq0gXOSeTw2z/vYe+j80lRpSN5Rp/8mfQORh8SmU=
 github.com/devtron-labs/argo-workflows/v3 v3.5.13/go.mod h1:/vqxcovDPT4zqr4DjR5v7CF8ggpY1l3TSa2CIG3jmjA=
-github.com/devtron-labs/devtron-services/authenticator v0.0.0-20260803100101-66fcb35e4b0e h1:mfAbqKv+CswkCah0JCSzeTJThvjaNBt51TunM8lBsPU=
-github.com/devtron-labs/devtron-services/authenticator v0.0.0-20260803100101-66fcb35e4b0e/go.mod h1:m/dMed6iiZQ/4iOJ6kIVWXQ+T71rJjU7DnCr9RcYh1w=
-github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260803100101-66fcb35e4b0e h1:gh/iIVC9FNpPE8C72duWZGNgwgE2jrYonpYDvty2cFM=
-github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260803100101-66fcb35e4b0e/go.mod h1:QZfnuGy0xqrYWhq3jCRe6fDDwIsrpbjAR2PXNrh0su8=
+github.com/devtron-labs/devtron-services/authenticator v0.0.0-20260921111017-f0b3fba15081 h1:BPkaewVaxMTnIAHcxwsWgebl5GV7uc6R/a0tCBoTZn0=
+github.com/devtron-labs/devtron-services/authenticator v0.0.0-20260921111017-f0b3fba15081/go.mod h1:m/dMed6iiZQ/4iOJ6kIVWXQ+T71rJjU7DnCr9RcYh1w=
+github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260921111017-f0b3fba15081 h1:niegDwFaPhH5b+7UP2QuGdR6rB43hFYqNY1pJ6ZbXQw=
+github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260921111017-f0b3fba15081/go.mod h1:QZfnuGy0xqrYWhq3jCRe6fDDwIsrpbjAR2PXNrh0su8=
 github.com/devtron-labs/go-bitbucket v0.9.60-beta h1:VEx1jvDgdtDPS6A1uUFoaEi0l1/oLhbr+90xOwr6sDU=
 github.com/devtron-labs/go-bitbucket v0.9.60-beta/go.mod h1:GnuiCesvh8xyHeMCb+twm8lBR/kQzJYSKL28ZfObp1Y=
 github.com/devtron-labs/protos v0.0.3-0.20250323220609-ecf8a0f7305e h1:U6UdYbW8a7xn5IzFPd8cywjVVPfutGJCudjePAfL/Hs=

pkg/bean/app.go

@@ -770,6 +770,16 @@ type CDPatchRequest struct {
 	UserId           int32                   `json:"-"`
 	ForceDelete      bool                    `json:"-"`
 	NonCascadeDelete bool                    `json:"-"`
+	ForegroundDelete *bool                   `json:"-"`
+}
+
+// GetForegroundDelete resolves the effective foreground-delete flag for this
+// request: the explicit query-param value if set, otherwise the provided env default.
+func (r *CDPatchRequest) GetForegroundDelete(envDefault bool) bool {
+	if r.ForegroundDelete != nil {
+		return *r.ForegroundDelete
+	}
+	return envDefault
 }
 
 type CdPatchAction int

pkg/bean/app_test.go

@@ -0,0 +1,28 @@
+package bean
+
+import "testing"
+
+func boolPtr(b bool) *bool { return &b }
+
+func TestCDPatchRequest_GetForegroundDelete(t *testing.T) {
+	tests := []struct {
+		name       string
+		field      *bool
+		envDefault bool
+		want       bool
+	}{
+		{"nil payload, env false", nil, false, false},
+		{"nil payload, env true", nil, true, true},
+		{"payload true overrides env false", boolPtr(true), false, true},
+		{"payload false overrides env true", boolPtr(false), true, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := &CDPatchRequest{ForegroundDelete: tt.field}
+			if got := r.GetForegroundDelete(tt.envDefault); got != tt.want {
+				t.Errorf("GetForegroundDelete(%v) with field=%v = %v, want %v",
+					tt.envDefault, tt.field, got, tt.want)
+			}
+		})
+	}
+}