The Pact Broker stores every published contract and every verification result, keyed by application version. From those it builds a matrix of which consumer versions work with which provider versions. can-i-deploy asks that matrix one question before a deployment: does the version I am about to deploy work with every version already running in the target environment?

pact-broker can-i-deploy \
  --pacticipant UserService \
  --version "$GIT_SHA" \
  --to-environment production

If a required verification failed or has not happened yet, the command exits with a non-zero code and the pipeline stops. Add --retry-while-unknown so the pipeline can wait for a provider verification that is still running.

The check only works if the Broker knows what is deployed, so record each deployment right after it succeeds:

pact-broker record-deployment \
  --pacticipant UserService \
  --version "$GIT_SHA" \
  --environment production

Without record-deployment, the Broker has nothing to compare against, and can-i-deploy can't protect you.

Sources: Pact: can-i-deploy, Pact: recording deployments and releases