ci: trigger deploy-dev workflow after sync-main-to-dev

[webpiratt]

Summary

• Add workflow_run trigger to deploy-dev.yaml so it triggers when sync-main-to-dev completes successfully
• Fix SHA references to use correct commit when triggered via workflow_run
• This fixes the issue where pushes via GITHUB_TOKEN don't trigger other workflows

Test plan

• Merge to main and verify deploy-dev triggers after sync-main-to-dev completes

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Improved deployment workflow automation with enhanced coordination between workflows, ensuring consistent and reliable deployment execution.
  • Refined image tagging mechanism to dynamically select deployment identifiers based on trigger source, supporting both direct pushes and workflow-initiated deployments.

[coderabbitai]

Walkthrough

The deploy-dev.yaml workflow now responds to completed "Sync main to dev" workflow runs. Conditional execution guards added to build jobs for both push and workflow_run events. Image tag computation updated to use workflow_run head_sha when available, otherwise defaults to push SHA. Ref override added for checkout in deploy job.

Changes

Cohort / File(s)

Summary

GitHub Actions Workflow .github/workflows/deploy-dev.yaml

Added workflow_run trigger to respond to completed "Sync main to dev" workflow. Introduced conditional execution guards (if statements) for build jobs to handle both push and workflow_run events. Updated image tag computation from static commit SHA to conditional logic using head_sha from workflow_run when available, otherwise falling back to push SHA. Added ref override for actions/checkout in deploy job when triggered by workflow_run. Updated deployment file templating (TAG) usage to align with new conditional tag logic.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly addresses the main objective of the PR: enabling the deploy-dev workflow to be triggered after the sync-main-to-dev workflow completes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Merge Conflict Detection	✅ Passed	✅ No merge conflicts detected when merging into main

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/trigger-deploy-on-sync

Tip

Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/deploy-dev.yaml (1)

22-33: ⚠️ Potential issue | 🟠 Major

The build jobs check out main's code instead of dev in workflow_run context, causing a code-to-tag mismatch.

When triggered via workflow_run, build-push-image.yaml performs a plain actions/checkout@v4 without a ref override, which defaults to the default branch (main), not dev. Meanwhile, the sync workflow uses git merge origin/main --no-edit, which creates a merge commit on dev—making dev HEAD different from main HEAD after the sync completes. Images are then built from main's code and tagged with main's SHA (via head_sha), while the deploy job correctly checks out dev to apply those mismatched images.

To fix this, build-push-image.yaml needs to accept a ref input parameter, and the build jobs in deploy-dev.yaml must pass ref: dev when triggered via workflow_run.

🧹 Nitpick comments (1)

.github/workflows/deploy-dev.yaml (1)

10-13: Consider adding a branches filter to workflow_run.

Without a branches filter, this trigger fires for every completion of "Sync main to dev" regardless of which branch triggered it. If that workflow only runs on main, this is harmless but fragile — adding an explicit filter makes the intent clearer and prevents surprise triggers if the source workflow's branch rules change later.

   workflow_run:
     workflows: ["Sync main to dev"]
+    branches: [main]
     types:
       - completed