Add Deploy Blocker Workflow

.claude/agents/deploy-blocker-investigator.md

@@ -0,0 +1,90 @@
+---
+name: deploy-blocker-investigator
+description: Investigates deploy blockers to find the causing PR and recommend resolution.
+tools: Glob, Grep, Read, Bash, BashOutput
+model: inherit
+---
+
+# Deploy Blocker Investigator
+
+Investigate the deploy blocker issue to identify the causing PR and post a recommendation.
+
+---
+
+## Domain Knowledge
+
+### Labels
+
+- `DeployBlockerCash` - Blocks the **App** deploy (frontend)
+- `DeployBlocker` - Blocks the **Web** deploy (backend PHP)
+- `StagingDeployCash` - The deploy checklist issue listing all PRs on staging
+
+### Backend vs Frontend
+
+Determine from the issue description and App code whether this is a frontend or backend bug:
+
+**Backend bug** = issue originates from the API / backend code, not this App repo:
+- Server error codes (500, 502, 503)
+- API response errors or malformed data
+- Authentication/authorization failures from server
+- Data missing or incorrect from API responses
+- Error messages mentioning Auth, PHP, or API
+
+**Frontend bug** = issue is in the App (React Native/TypeScript):
+- UI rendering issues, navigation bugs
+- Onyx state problems
+- Client-side validation errors
+- Issues that occur before any API call
+
+When analyzing, look at the App code to understand:
+- Does the bug occur in UI logic, or when processing an API response?
+- Is the App code handling the response correctly, or is the response itself wrong?
+
+---
+
+## What To Do
+
+1. **Investigate** the issue and find the causing PR. Check the issue description to see if the bug is reproducible on production. If it's staging-only, the cause is likely a PR in the StagingDeployCash checklist. If it's also on production, the bug may predate the current staging deploy.
+2. **Comment** on the issue with your findings
+3. **Update labels** based on classification:
+
+| Classification | Label Action |
+|----------------|--------------|
+| Backend bug | Remove `DeployBlockerCash` (doesn't block App deploy) |
+| Frontend bug | Remove `DeployBlocker` if present (doesn't block Web deploy) |
+
+---
+
+## Comment Structure
+
+Post ONE comment with:
+
+1. **Causing PR** (or candidates if uncertain)
+   - PR number, title, author, link
+   - Confidence level (high/medium/low)
+   - Evidence (why you think this PR caused it)
+
+2. **Related issues** - any other deploy blockers that might be caused by the same PR
+
+3. **Recommendation** - one of:
+   - **REVERT** - Default choice. Preferred when the causing PR is clear and can be cleanly reverted. Especially important if the PR caused multiple linked issues.
+   - **ROLL FORWARD** - Use when reverting is problematic: fix is simpler than revert, revert would cause merge conflicts, or many dependent PRs have merged on top.
+   - **NEEDS INVESTIGATION** - Use when you cannot determine the root cause with reasonable confidence. List candidate PRs for human review, and tag PR author and reviewers.
+   - **DEMOTE** - Use when the bug is pretty minor (cosmetic and uncommon, pretty edge case, affects very few users) and not worth blocking the deploy.
+
+State which label you're removing (if any) and why.
+
+---
+
+## Commands
+
+```bash
+# Post your findings as a comment:
+gh issue comment "$ISSUE_URL" --body "YOUR_COMMENT_HERE"
+
+# Remove label (backend bugs only):
+gh issue edit "$ISSUE_URL" --remove-label DeployBlockerCash
+
+# Remove label if confirmed to be frontend bug and label exists
+gh issue edit "$ISSUE_URL" --remove-label DeployBlocker
+```

.claude/commands/investigate-deploy-blocker.md

@@ -0,0 +1,12 @@
+---
+allowed-tools: Bash(gh issue view:*),Bash(gh issue edit:* --remove-label DeployBlocker),Bash(gh issue edit:* --remove-label DeployBlockerCash),Bash(gh issue comment:*),Bash(gh issue list:*),Bash(gh pr view:*),Bash(gh pr list:*),Bash(gh api:*),Bash(git log:*),Bash(git show:*),Bash(git blame:*),Glob,Grep,Read
+description: Investigate a deploy blocker issue to find the causing PR and recommend resolution
+---
+
+Investigate the deploy blocker issue at $ISSUE_URL using the `deploy-blocker-investigator` agent.
+
+The agent will:
+- Analyze the issue to determine if it's a frontend (App) or backend bug
+- Find the most likely causing PR
+- Post a comment with findings and recommendation
+- Update labels if appropriate

.github/workflows/deployBlockerInvestigation.yml

@@ -0,0 +1,63 @@
+name: Investigate Deploy Blocker
+
+permissions:
+  contents: read
+  issues: write
+
+on:
+  workflow_dispatch:
+    inputs:
+      ISSUE_URL:
+        description: 'The full URL of the issue to investigate (e.g., https://github.com/Expensify/App/issues/12345)'
+        required: true
+        type: string
+
+concurrency:
+  group: deploy-blocker-investigation-${{ inputs.ISSUE_URL }}
+  cancel-in-progress: true
+
+jobs:
+  investigate:
+    runs-on: ubuntu-latest
+    env:
+      ISSUE_URL: ${{ inputs.ISSUE_URL }}
+    steps:
+      - name: Checkout App repository
+        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+        with:
+          fetch-depth: 1
+
+      # Validate that the user has write access to the repository
+      # workflow_dispatch already requires write access, but this makes it explicit
+      # and ensures the token works for team membership checks
+      - name: Validate actor has write access
+        uses: ./.github/actions/composite/validateActor
+        with:
+          REQUIRE_APP_DEPLOYER: false
+          OS_BOTIFY_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
+
+      - name: Setup Node
+        uses: ./.github/actions/composite/setupNode
+
+      - name: Validate issue has DeployBlockerCash label
+        id: validate
+        run: |
+          LABELS=$(gh issue view "${{ inputs.ISSUE_URL }}" --json labels --jq '.labels[].name')
+          if echo "$LABELS" | grep -q "DeployBlockerCash"; then
+            echo "valid=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "valid=false" >> "$GITHUB_OUTPUT"
+            echo "::warning::Issue ${{ inputs.ISSUE_URL }} does not have DeployBlockerCash label"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+
+      - name: Run Claude to investigate deploy blocker
+        if: steps.validate.outputs.valid == 'true'
+        uses: anthropics/claude-code-action@a7e4c51380c42dd89b127f5e5f9be7b54020bc6b # v1.0.21
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          github_token: ${{ secrets.OS_BOTIFY_TOKEN }}
+          prompt: "/investigate-deploy-blocker ISSUE_URL: ${{ inputs.ISSUE_URL }}"
+          claude_args: |
+            --allowedTools "Task,Glob,Grep,Read,Bash(gh issue view:*),Bash(gh issue edit:* --remove-label DeployBlocker),Bash(gh issue edit:* --remove-label DeployBlockerCash),Bash(gh issue comment:*),Bash(gh issue list:*),Bash(gh pr view:*),Bash(gh pr list:*),Bash(gh api:*),Bash(git log:*),Bash(git show:*),Bash(git blame:*)"