Deployment Version Dependencies - Allow versions to depend on specific versions of other deployments

[jsbroks]

Summary

Add the ability for deployment versions to declare dependencies on specific versions of other deployments. A version with dependencies cannot deploy until all dependencies are satisfied - meaning the dependent deployment has a successfully deployed version matching the CEL selector on the same resource.

---

Use Cases

Database-first deployments:

# API v2.0 depends on Database Migration v2.x
dependencies:
  - deploymentSelector: "deployment.name == 'datadog'"
    versionSelector: "version.tag.startsWith('v2.')"

Feature-flagged dependencies:

# Frontend requires Backend with new API enabled
dependencies:
  - deploymentId: "dep_backend"
    versionSelector: "'newAPI' in version.metadata && version.metadata.newAPI == 'true'"

Multi-service coordination:

# Gateway requires auth-service on stable channel
dependencies:
  - deploymentId: "dep_auth_service"
    versionSelector: "version.metadata.channel == 'stable'"

---

Schema Design

DeploymentVersionDependency: {
  type: 'object',
  required: ['deploymentId', 'versionSelector'],
  properties: {
    deploymentId: { type: 'string' },
    versionSelector: openapi.schemaRef('CelSelector'),
    
    // Future extensions:
    // deploymentSelector: openapi.schemaRef('CelSelector'),  // dynamic deployment matching
    // environmentSelector: openapi.schemaRef('CelSelector'), // scope to environments
  },
},

DeploymentVersion: {
  // ... existing fields ...
  properties: {
    // ... existing properties ...
    dependencies: {
      type: 'array',
      items: openapi.schemaRef('DeploymentVersionDependency'),
    },
  },
},

---

Evaluation Logic

For version V deploying to resource R:
  For each dependency D in V.dependencies:
    1. Find release target for D.deploymentId + R (same resource)
    2. Get the currently deployed version (latest successful job)
    3. Evaluate D.versionSelector.cel against that version
    4. If no deployed version or CEL returns false → BLOCK
  All dependencies satisfied → ALLOW

---

CEL Context

The CEL expression evaluates against the deployed version:

Field	Type	Description
version.tag	string	Version tag (e.g., "v2.1.0")
version.name	string	Version name
version.status	string	Version status
version.metadata	map	Version metadata key-value pairs

---

Implementation Tasks

• Add DeploymentVersionDependency schema to OpenAPI (oapi/spec/schemas/deployments.jsonnet)
• Add dependencies field to DeploymentVersion schema
• Regenerate OpenAPI spec (make oapi)
• Create DeploymentVersionDependencyEvaluator in pkg/workspace/releasemanager/policy/evaluator/deploymentversiondependency/
• Register evaluator in policy manager
• Add unit tests for evaluator

---

Acceptance Criteria

• Versions with no dependencies deploy normally
• Versions with satisfied dependencies deploy
• Versions with unsatisfied dependencies are blocked with clear reason
• Multiple dependencies require ALL to pass
• CEL expressions can match on tag, name, status, and metadata