Create lockDeploys workflow

[roryabraham]

Details

To avoid a race condition between this job and preDeploy:version, added a new action called https://github.com/TomChv/wait-my-workflow/ . Tested in Public-Test-Repo and seems to work well.

Fixed Issues

Fixes https://github.com/Expensify/Expensify/issues/155210

Tests

1. Merge this PR, then quickly add the 🔐 LockCashDeploys 🔐 label to the StagingDeployCash. We should then expect that:

• The lockDeploys workflow should wait for the preDeploy::version job to finish before proceeding past wait-my-workflow. But then once it does...
• The bumpVersion action should be executed w/ SEMVER_LEVEL = PATCH
• An automerge PR should be merged to master to bump the PATCH version
• After the preDeploy workflow runs again, an automerge PR should be merged to staging from master.
• The StagingDeployCash should be updated with the new PATCH version

2. Then merge another PR to master, and we should expect:

• OS Botify comments on the PR to say it will be deployed later
• The staging deploy should be skipped for this PR. No version-bump PR should be created.
• The StagingDeployCash should not be modified

3. Then close the StagingDeployCash, and:

• A release should be created w/ the PATCH version created in step 1
• A "production deploy" should happen
• The BUILD version should be bumped on master
• A staging deploy should happen with the new BUILD version on master.
• A new StagingDeployCash should be created, and should include the PR merged in step 2.

4. Add the 🔐 LockCashDeploys 🔐 to some random issue, and this workflow should be skipped.

[roryabraham]

Testing step 1:

LockDeploys workflow: https://github.com/Expensify/Expensify.cash/runs/2151878987?check_suite_focus=true
PR against master: https://github.com/Expensify/Expensify.cash/pulls/1943
Staging deploys happened:

preDeploy after master PR was merged: https://github.com/Expensify/Expensify.cash/actions/runs/669167652

StagingDeployCash updated #1926

[roryabraham]

Automerge master failed silently https://github.com/Expensify/Expensify.cash/runs/2151890115?check_suite_focus=true

So our new version wasn't updated on master or staging. This was of course the result of a race condition. preDeploy from this PR being merged had created an automerge PR against master and finished, but the PR had not yet been auto-merged. So the lockDeploys workflow did the patch version bump without first pulling the latest version-bump on master, so when it created the PR there was a merge conflict.

To resolve, we'll make sure there are no automerge jobs going either, and pull master after waiting.

[roryabraham]

Testing step 1 round 2:

lockDeploys workflow: https://github.com/Expensify/Expensify.cash/actions/runs/669259652
PR against master: #1951 ❌ didn't merge

I think that after the preDeploy workflow completed, the automerge workflow hadn't started by the time the next step in lockDeploys happened.

[roryabraham]

Testing step 1 round 3:

lockDeploys workflow: https://github.com/Expensify/Expensify.cash/actions/runs/669426206
PR agains master: #1957
preDeploy didn't update staging because StagingDeployCash was locked https://github.com/Expensify/Expensify.cash/actions/runs/669431604 ❌
StagingDeployCash was updated #1926

The fact that staging wasn't updated is a problem, but not until we need to build CPs. When we do that, we'll need to make sure that we're not deploying staging until the staging branch is actually updated.