ci: formalize cloud release cycle for public SaaS

[msukkari]

Fixes SOU-2279

Summary

• Restrict production cloud image publishing to v*.*.* release tags while retaining manual dispatch.
• Add a staging cloud image workflow for main pushes using the staging GitHub Environment and staging ECR repository.
• Update the shared cloud build comment to reflect release behavior.
• Add the required Unreleased changelog entry.

Validation

• Parsed all three workflow YAML files.
• Verified production trigger/tag semantics and staging trigger/environment/tag semantics.
• Ran git diff --check and confirmed no stale production-on-main comment remains.

Linear issue: SOU-2279

  

---

Summary by cubic

Formalizes the cloud release cycle so production images publish only on v*.*.* release tags, while main pushes now build the staging image instead of production.

• Removes the main branch trigger and its image tags from the production cloud workflow; manual dispatch is unchanged.
• Adds a staging cloud workflow that builds from main pushes into the staging GitHub Environment and staging ECR repository.
• Updates the shared build comment to reflect that every cloud build, not just prod, gets a distinct Sentry release.

^{Written for commit 69ec473. Summary will update on new commits.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: e8fa168b-dbb2-4528-9675-39b8615c5472

📥 Commits

Reviewing files that changed from the base of the PR and between 1df8390 and 69ec473.

📒 Files selected for processing (3)

• .github/workflows/_build-cloud.yml
• .github/workflows/release-cloud-prod.yml
• .github/workflows/release-cloud-staging.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

@msukkari your pull request is missing a changelog!

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 69ec473. Configure here.}

[cursor]

Release tags skip production publish

High Severity

Official releases commit with [skip ci] before pushing the v*.*.* tag, and GitHub suppresses push workflows for that commit—including tag pushes. After dropping the main trigger, production cloud images no longer publish on the release cycle. The same skip also drops the release commit from the staging main workflow.

Additional Locations (1)

• .github/workflows/release-cloud-staging.yml#L6-L10

 

^{Reviewed by Cursor Bugbot for commit 69ec473. Configure here.}

[cursor]

Manual dispatch publishes no image tags

Medium Severity

Both remaining docker_tags rules enable only when github.ref is a version tag. workflow_dispatch defaults to a branch ref, so metadata emits an empty tag list and the reusable build still pushes. docker/build-push-action then fails because a tag is required.

 

^{Reviewed by Cursor Bugbot for commit 69ec473. Configure here.}