Update NewDot deploy permissions.

[roryabraham]

Details

1. Opens up manual CP privileges to the @Expensify/mobile-deployers group
2. Restricts production deploy abilities to the @Expensify/mobile-deployers group
3. Allows @Expensify/mobile-deployers to run the platformDeploy.yml workflow. This means we can now retry failed deploy workflows. But be warned! With great power comes great responsibility. You must understand that if you push a tag or create a GH release, you will trigger a staging/production deploy.

Fixed Issues

$ https://github.com/Expensify/Expensify/issues/171977
$ https://github.com/Expensify/Expensify/issues/173687

Tests

This must be live-tested. Testing steps can happen out-of-order, but the complete list of things we need to verify is:

• Merge a PR when the deploy checklist is unlocked. Verify that a staging deploy occurs as expected.
• Have a mobile-deployer restart an active platformDeploy.yml workflow. Verify that it restarts and works as expected.
• Have a non-mobile deployer restart a platformDeploy.yml workflow. Verify that it does not restart.
• With the deploy checklist locked, merge a PR with the CP Staging label. It should be CP'd to staging.
• Have a mobile-deployer (not a member of the deprecated expensify-cash-deployers team) attempt to manually trigger a CP. It should work as expected.
• Have a non-mobile-deployer attempt to manually trigger a CP. It should not work.
• Have a non-mobile deployer attempt to close out a StagingDeployCash where there are unchecked boxes in the description. It should not work.
• Have a mobile-deployer attempt to close out a StagingDeployCash where there are unchecked boxes in the description. It should not work.
• Have a non-mobile-deployer attempt to close out a StagingDeployCash with all the boxes checked and with the comment. It should not work.
• Have a mobile-deployer attempt to close out a StagingDeployCash with all the boxes checked and with the comment. It should work and trigger the prod deploy.

[MonilBhavsar]

Looks good

[Julesssss]

Looks good, what's the plan for testing? Should we turn each numbered item into a checkbox maybe?

[Jag96]

Added a couple of questions, but looks good

[roryabraham]

Should we turn each numbered item into a checkbox maybe?

Excellent idea!

[Julesssss]

I imagine @AndrewGable is busy, but let's give him a chance to review too?

[roryabraham]

Agreed, no big rush here.

[roryabraham]

Updated this slightly so that we first validate the actor, then check for deploy blockers. This allows us to print a more specific error message.

[OSBotify]

✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

[roryabraham]

Have a non-mobile-deployer attempt to manually trigger a CP. It should not work.

Looks like this didn't work as expected – probably needed needs.validateActor.outputs.IS_DEPLOYER == 'true', which we've seen before.

[roryabraham]

Okay, there is more than one way this did not work. Isabella was just able to run a prod deploy w/o the comment, then the deploy checklist was reopened but no comment was left. This is basically a 🔥 now

[OSBotify]

🚀 Deployed to staging by @AndrewGable in version: 1.0.88-3 🚀

platform	result
🤖 android 🤖	cancelled 🔪
🖥 desktop 🖥	cancelled 🔪
🍎 iOS 🍎	cancelled 🔪
🕸 web 🕸	success ✅

[OSBotify]

🚀 Deployed to production by @roryabraham in version: 1.0.90-2 🚀

platform	result
🤖 android 🤖	success ✅
🖥 desktop 🖥	success ✅
🍎 iOS 🍎	failure ❌
🕸 web 🕸	success ✅