release-cloud-prod.yml

name: Release Sourcebot (Cloud - Production)

permissions:
  contents: read
  id-token: write

on:
  push:
    tags: ["v*.*.*"]
  workflow_dispatch:

concurrency:
  group: release-cloud-prod-${{ github.ref }}
  cancel-in-progress: false

jobs:
  # The image tags below are only enabled for `v*` tag refs. Fail fast with a
  # clear error when dispatched from a branch rather than letting buildx fail
  # with "tag is needed when pushing to registry".
  validate-ref:
    runs-on: ubuntu-latest
    steps:
      - name: Require a release tag ref
        env:
          REF: ${{ github.ref }}
        run: |
          if [[ "$REF" != refs/tags/v* ]]; then
            echo "::error::Cloud production releases must run against a release tag (got '$REF'). Re-run with: gh workflow run release-cloud-prod.yml --ref v<version>"
            exit 1
          fi

  build:
    needs: validate-ref
    uses: ./.github/workflows/_build-cloud.yml
    with:
      environment: prod
      git_ref: ${{ github.ref }}
      docker_tags: |
        type=semver,pattern=v{{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
        type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
    secrets: inherit