From 9f85bb740fadaff66cf79677d8b082076c4c54d6 Mon Sep 17 00:00:00 2001
From: Brendan Kellam <brendan@sourcebot.dev>
Date: Tue, 29 Sep 2026 11:54:53 -0700
Subject: [PATCH 1/2] fix(ci): dispatch cloud prod release from the production
 release workflow

The release commit is marked `[skip ci]`, which also suppresses the push
event for the release tag, so release-cloud-prod.yml never ran on tag push.
Dispatch it explicitly against the new tag from release-prod.yml, and fail
fast in release-cloud-prod.yml when it is run from a non-tag ref.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/release-cloud-prod.yml | 16 ++++++++++++++++
 .github/workflows/release-prod.yml       | 21 +++++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/.github/workflows/release-cloud-prod.yml b/.github/workflows/release-cloud-prod.yml
index bc6f68a2d..d9fa0f777 100644
--- a/.github/workflows/release-cloud-prod.yml
+++ b/.github/workflows/release-cloud-prod.yml
@@ -14,7 +14,23 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  # The image tags below are only enabled for `v*` tag refs. Fail fast with a
+  # clear error when dispatched from a branch rather than letting buildx fail
+  # with "tag is needed when pushing to registry".
+  validate-ref:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require a release tag ref
+        env:
+          REF: ${{ github.ref }}
+        run: |
+          if [[ "$REF" != refs/tags/v* ]]; then
+            echo "::error::Cloud production releases must run against a release tag (got '$REF'). Re-run with: gh workflow run release-cloud-prod.yml --ref v<version>"
+            exit 1
+          fi
+
   build:
+    needs: validate-ref
     uses: ./.github/workflows/_build-cloud.yml
     with:
       environment: prod
diff --git a/.github/workflows/release-prod.yml b/.github/workflows/release-prod.yml
index 72c7a5c37..1eebc037d 100644
--- a/.github/workflows/release-prod.yml
+++ b/.github/workflows/release-prod.yml
@@ -247,6 +247,27 @@ jobs:
               --generate-notes \
               --latest
 
+  # The release commit is marked `[skip ci]`, which also suppresses the `push`
+  # event for the tag that points at it, so the tag push alone never starts the
+  # cloud prod build. Dispatch it explicitly against the new tag instead.
+  # (workflow_dispatch is one of the events GITHUB_TOKEN is allowed to trigger.)
+  release-cloud-prod:
+    needs: [prepare-release, finalize-release]
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+
+    steps:
+      - name: Dispatch cloud production release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ needs.prepare-release.outputs.version }}
+        run: |
+          gh workflow run release-cloud-prod.yml \
+              --repo "$GITHUB_REPOSITORY" \
+              --ref "v$VERSION"
+          echo "Dispatched release-cloud-prod.yml for v$VERSION"
+
   publish-to-registry:
     needs: [prepare-release, build, finalize-release]
     uses: ./.github/workflows/_merge.yml

From ba4c97bd722ccde30bb8907ad492d093ebdadaaf Mon Sep 17 00:00:00 2001
From: Brendan Kellam <brendan@sourcebot.dev>
Date: Tue, 29 Sep 2026 12:04:56 -0700
Subject: [PATCH 2/2] fix(ci): drop [skip ci] from release commits instead of
 dispatching cloud prod

`[skip ci]` on the release commit also suppressed the push event for the
release tag, so release-cloud-prod.yml never ran on tag push. Removing it
lets the tag push trigger the cloud prod build (and the main push trigger
the cloud staging build), so the explicit dispatch job is no longer needed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/release-prod.yml | 23 +----------------------
 1 file changed, 1 insertion(+), 22 deletions(-)

diff --git a/.github/workflows/release-prod.yml b/.github/workflows/release-prod.yml
index 1eebc037d..98d7b0479 100644
--- a/.github/workflows/release-prod.yml
+++ b/.github/workflows/release-prod.yml
@@ -145,7 +145,7 @@ jobs:
       - name: Commit changes
         run: |
           git add CHANGELOG.md packages/shared/src/version.ts docs/api-reference/sourcebot-public.openapi.json
-          git commit -m "[skip ci] Release v$VERSION"
+          git commit -m "Release v$VERSION"
 
       - name: Push to temporary branch
         id: push_temp_branch
@@ -247,27 +247,6 @@ jobs:
               --generate-notes \
               --latest
 
-  # The release commit is marked `[skip ci]`, which also suppresses the `push`
-  # event for the tag that points at it, so the tag push alone never starts the
-  # cloud prod build. Dispatch it explicitly against the new tag instead.
-  # (workflow_dispatch is one of the events GITHUB_TOKEN is allowed to trigger.)
-  release-cloud-prod:
-    needs: [prepare-release, finalize-release]
-    runs-on: ubuntu-latest
-    permissions:
-      actions: write
-
-    steps:
-      - name: Dispatch cloud production release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          VERSION: ${{ needs.prepare-release.outputs.version }}
-        run: |
-          gh workflow run release-cloud-prod.yml \
-              --repo "$GITHUB_REPOSITORY" \
-              --ref "v$VERSION"
-          echo "Dispatched release-cloud-prod.yml for v$VERSION"
-
   publish-to-registry:
     needs: [prepare-release, build, finalize-release]
     uses: ./.github/workflows/_merge.yml