ci: continuously deploy green main commits to staging (app only)

[FelixTJDietrich]

What

Continuously deploy every green commit on main to Staging (app only). New workflow cd-staging.yml; nothing else changes.

Today staging deploys only when a release is cut (release.yml, if: released == 'true'), so main HEAD and staging drift between releases. This closes that gap while keeping production release-gated.

Result: Staging = main HEAD, Production = released versions.

How it works

• Trigger: workflow_run: [CI/CD] completed on main, gated if: conclusion == 'success' — deploy only on green (mirrors the existing release.yml trigger).
• Immutable artifact: deploys the exact commit's :<sha> image that CI already publishes — traceable, reproducible, rollback-friendly. Same "build once, deploy many" image that a release later promotes to prod.
• App only: deploy-core: false, deploy-proxy: false. NATS/webhook and proxy are stateful/disruptive to recreate (a NATS restart forces a JetStream recovery), so they're never auto-deployed.
• preflight: skips cleanly (no red run) when skip-duplicate-actions deduped the build and no :<sha> image exists.
• flag-infra-changes: when docker/compose.core.yaml or compose.proxy.yaml changed, emits a warning + job summary telling an operator to run the manual deploy-core/deploy-proxy — so core config can't silently lag (the exact gap that stranded the NATS binding).
• Concurrency: serialized, never interrupts an in-flight deploy. Production path (release.yml → deploy-prod with manual approval) is untouched.

Design rationale (sourced)

• Deploy-on-green + trunk-based, prod behind a gate — DORA continuous delivery / trunk-based development.
• Immutable per-commit image over latest — Docker image digests, ditch latest.
• Don't recreate stateful backing services per deploy — Twelve-Factor: backing services.
• Frequent app deploys are safe because migrations are backward-compatible (repo's deprecate-then-remove = expand/contract).

Follow-ups (not here)

• Pin by digest (@sha256:) rather than the SHA tag for the strongest guarantee — needs a small compose change to image: …@${DIGEST}.
• release.yml still deploys staging on release (the released semver tag); harmless overlap, can be trimmed later.

Testing

actionlint clean. No app code changed; .github/ only, so no changeset required.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@FelixTJDietrich, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 28 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: fea05324-5542-4f5f-978b-82d9a76b7ff5

📥 Commits

Reviewing files that changed from the base of the PR and between 2234ad0 and 577fb20.

📒 Files selected for processing (1)

• .github/workflows/cd-staging.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/cd-staging-on-main

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📚 Documentation Preview

Preview has been removed (PR closed)