Add support for running "Deploy" GitHub workflow when GitHub pre-release/release is created

[angela-tran]

• Update deploy.yml to check for pre-release/release events
• Add step(s) to deploy.yml to run appropriate checks (run tests, etc.) if pre-release/release
• Add logic to name the Docker tag appropriately when we see a GitHub pre-release/release
• Create Docker tag with Git tag name too
• Configure tag protections so that only benefits-admin team can push tags that trigger deployment (same sort of protection as what we have with branch protections for current deployment model)
• Configure Required reviewers on GitHub deployment environments for test/prod to provide an additional opportunity to check that the deployment looks correct

[angela-tran]

• Configure tag protections so that only benefits-admin team can push tags that trigger deployment (same sort of protection as what we have with branch protections for current deployment model)

While setting up tag protection, I noticed some UI for using repository rules instead:

Repository rules had their GA release in July 2023 and are more flexible than branch protection and tag protection.

I set up two repository rules to protect the creation/update/deletion of tags: one rule for pre-release tags and one for release tags. Anyone with read access to the repository can view these rules to help determine why their action was blocked.

Someone who is not on the rule's bypass list will see an error message when trying to do a protected action:

Someone who is on the bypass list will be able to bypass the protection:

[angela-tran]

Because repository rules show you what your target pattern matches, I noticed that the glob pattern we're using for release tags in azure-pipelines.yml is too permissive - 20??.??.?* matches more than just release tags.

For the release-tag repository rule, I used a simpler pattern that is more strict about the end of the value.

I will create a new issue to update our trigger pattern in MST's pipeline and SBMTD's pipeline.

[angela-tran]

• Configure Required reviewers on GitHub deployment environments for test/prod to provide an additional opportunity to check that the deployment looks correct

I updated the deployment protection rules on our test and prod GitHub environments so they require a review from the benefits-admin team.

[angela-tran]

All tasks for this issue are done. We can close this ticket after we go over it in our dev workshop on Wednesday