Skip to content

ci: formalize cloud release cycle for public SaaS #1683

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
msukkari merged 3 commits into from
Sep 23, 2026
+26 −5
Merged

ci: formalize cloud release cycle for public SaaS #1683

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
96dff94
ci: formalize cloud release workflows
cursoragent Sep 23, 2026
48034d8
docs: add cloud release changelog entry
cursoragent Sep 23, 2026
69ec473
docs: remove cloud release changelog entry
cursoragent Sep 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions .github/workflows/_build-cloud.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,8 +144,7 @@ jobs:
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
# SENTRY_RELEASE is the commit SHA rather than SOURCEBOT_VERSION so that
# every prod build gets a distinct release (prod tracks `main`, where the
# version only moves on a tagged release). packages/backend/src/instrument.ts
# every cloud build gets a distinct release. packages/backend/src/instrument.ts
# reports NEXT_PUBLIC_BUILD_COMMIT_SHA as its release to match; the webapp
# gets SENTRY_RELEASE injected into its bundle by withSentryConfig.
build-args: |
Expand Down
3 changes: 0 additions & 3 deletions .github/workflows/release-cloud-prod.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@ permissions:

on:
push:
branches: ["main"]

@cursor cursor Bot Sep 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Release tags skip production publish

High Severity

Official releases commit with [skip ci] before pushing the v*.*.* tag, and GitHub suppresses push workflows for that commit—including tag pushes. After dropping the main trigger, production cloud images no longer publish on the release cycle. The same skip also drops the release commit from the staging main workflow.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 69ec473. Configure here.

tags: ["v*.*.*"]
workflow_dispatch:

Expand All @@ -21,8 +20,6 @@ jobs:
environment: prod
git_ref: ${{ github.ref }}
docker_tags: |
type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' }}

@cursor cursor Bot Sep 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Manual dispatch publishes no image tags

Medium Severity

Both remaining docker_tags rules enable only when github.ref is a version tag. workflow_dispatch defaults to a branch ref, so metadata emits an empty tag list and the reusable build still pushes. docker/build-push-action then fails because a tag is required.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 69ec473. Configure here.

type=sha,format=long,enable=${{ github.ref == 'refs/heads/main' }}
type=semver,pattern=v{{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
secrets: inherit
25 changes: 25 additions & 0 deletions .github/workflows/release-cloud-staging.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
name: Release Sourcebot (Cloud - Staging)

permissions:
contents: read
id-token: write

on:
push:
branches: ["main"]
workflow_dispatch:

concurrency:
group: release-cloud-staging-${{ github.ref }}
cancel-in-progress: false

jobs:
build:
uses: ./.github/workflows/_build-cloud.yml
with:
environment: staging
git_ref: ${{ github.ref }}
docker_tags: |
type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' }}
type=sha,format=long,enable=${{ github.ref == 'refs/heads/main' }}
secrets: inherit
Loading