[sjungwon03]

Summary

Project protected environments can now add one shared group to deployment access by exact numeric group ID. The new grant explicitly uses direct membership, and the dialog requires the exact environment name and acknowledgement after reviewing existing deployment access and approval rules.

Complete paginated inventory and strict detail preflight reject stale, missing, ambiguous and duplicate-group grants. One PUT sends only the group ID and direct-membership setting. Strict response and authoritative read-back checks require exactly one new stable grant and preserve existing deploy grants, descriptions, approval rules and legacy counts. Pending operations and account changes are isolated; uncertain writes require fresh inspection and confirmation, blocking duplicate retries if the grant was applied.

Closes #660

Validation

• dart format --output=none --set-exit-if-changed .
• flutter analyze reports no issues
• Full app and package suites: 8,582 tests passed (app 4,876; API 3,362; design system 135; models 204; secure storage 5)
• Related controller/widget regressions: 230 tests passed; dedicated API suite: 26 tests passed
• API, controller and widget tests were run red before implementation, then green
• Localization regenerated for English, Korean, Japanese, Hindi and Chinese
• No model changes; build_runner is not applicable
• CI English-language policy and whitespace checks
• Synthetic mobile/desktop captures inspected in light and dark themes
• Manually validated against a live GitLab instance (not performed; fixture-only validation)

Checklist

• Targets dev; links one issue with Closes #
• Conventional Commits and DCO sign-off
• Test-first implementation and updated behavior documentation
• Five locales tested at 320/800/1200 widths in both themes
• No new dependencies or third-party assets added
• No credentials, real instance hostnames or confidential data in fixtures or screenshots
• Repository text is English except supported locale translations

Screenshots

Fixture-only captures show the confirmation portion of the scrollable dialog.

Viewport	Light	Dark
Mobile, 390 × 844
Desktop, 1200 × 900

Notes for reviewers

The update endpoint supports adding deploy records without an existing record ID. The request explicitly chooses direct membership. Reported access_level metadata on the new group grant is accepted and retained; the request supplies no role/user selector. The write disables redirects and automatic OAuth replay. The strict reader is the same full-rule reader used by existing deployment-group membership edits.

Premium/Ultimate, enabled CI/CD, management permission and sharing the group with the project are server requirements. No group/member enumeration or sharing mutation is added. Group-level rules remain read-only. Grant replacement/removal and inherited-membership selection during creation are separate slices.

The endpoint provides no atomic compare-and-set; preflight and read-back cannot eliminate concurrent server changes. Preservation covers modelled fields, and no live role/tier/self-hosted version matrix was validated. See implementation and evidence.

[sjungwon03-ai]

Review summary

Verdict: Approved

• Reviewed: protected-environment deployment-group API, controller, dialog, localization, and regression coverage
• Checks: all reported CI checks passed