Add pre-flight stack status checks to CD workflows

Blocks deploy if the CloudFormation stack is in ROLLBACK_COMPLETE,
FAILED, or IN_PROGRESS state. Prevents wasted deploy attempts on
stacks that need manual intervention.

.github/workflows/cd-cdk.yaml

@@ -23,6 +23,10 @@ on:
         description: "Enable QEMU for cross-platform Docker builds (arm64 on x86 runners)"
         type: boolean
         default: false
+      stack-name:
+        description: "CloudFormation stack name (for pre-flight checks)"
+        type: string
+        default: ""
     secrets:
       deploy-role-arn:
         description: "OIDC deploy role ARN"
@@ -67,6 +71,30 @@ jobs:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
 
+      - name: Pre-flight checks
+        if: ${{ inputs.stack-name != '' }}
+        run: |
+          echo "Pre-flight: checking stack ${{ inputs.stack-name }}..."
+          STATUS=$(aws cloudformation describe-stacks \
+            --stack-name "${{ inputs.stack-name }}" \
+            --query 'Stacks[0].StackStatus' --output text 2>/dev/null || echo "NOT_FOUND")
+          case "$STATUS" in
+            *ROLLBACK_COMPLETE|*FAILED)
+              echo "::error::Stack ${{ inputs.stack-name }} is in $STATUS — manual intervention required."
+              exit 1
+              ;;
+            *IN_PROGRESS)
+              echo "::error::Stack ${{ inputs.stack-name }} has an operation in progress ($STATUS) — wait for it to complete."
+              exit 1
+              ;;
+            NOT_FOUND)
+              echo "Pre-flight: stack not found — will be created on first deploy."
+              ;;
+            *)
+              echo "Pre-flight: stack status is $STATUS — OK to deploy."
+              ;;
+          esac
+
       - name: CDK deploy
         working-directory: ${{ inputs.cdk-dir }}
         run: npx -y cdk deploy --all --require-approval never

.github/workflows/cd-sam.yaml

@@ -53,6 +53,29 @@ jobs:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
 
+      - name: Pre-flight checks
+        run: |
+          echo "Pre-flight: checking stack ${{ inputs.stack-name }}..."
+          STATUS=$(aws cloudformation describe-stacks \
+            --stack-name "${{ inputs.stack-name }}" \
+            --query 'Stacks[0].StackStatus' --output text 2>/dev/null || echo "NOT_FOUND")
+          case "$STATUS" in
+            *ROLLBACK_COMPLETE|*FAILED)
+              echo "::error::Stack ${{ inputs.stack-name }} is in $STATUS — manual intervention required."
+              exit 1
+              ;;
+            *IN_PROGRESS)
+              echo "::error::Stack ${{ inputs.stack-name }} has an operation in progress ($STATUS) — wait for it to complete."
+              exit 1
+              ;;
+            NOT_FOUND)
+              echo "Pre-flight: stack not found — will be created on first deploy."
+              ;;
+            *)
+              echo "Pre-flight: stack status is $STATUS — OK to deploy."
+              ;;
+          esac
+
       - name: SAM build
         run: sam build --template ${{ inputs.sam-template }}