fix(ci): publish an app-server image for every previewed pull request (#1458)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: FelixTJDietrich

.github/workflows/cicd.yml

@@ -113,6 +113,7 @@ jobs:
         env:
           COOLIFY_TOKEN: ${{ secrets.COOLIFY_API_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
+          DOCKER_RESULT: ${{ needs.Docker.result }}
         run: |
           set -euo pipefail
 
@@ -121,6 +122,13 @@ jobs:
             exit 0
           fi
 
+          # No image workflow, no SOURCE_COMMIT tag. Requesting the deployment anyway would only
+          # queue one that fails on `manifest unknown`, under a green check.
+          if [ "${DOCKER_RESULT}" != 'success' ]; then
+            echo "::notice::No application-server image was published for this commit (Docker: ${DOCKER_RESULT}); skipping preview update."
+            exit 0
+          fi
+
           body=$(mktemp)
           status=$(curl -sS -o "${body}" -w '%{http_code}' -X POST \
             -H "Authorization: Bearer ${COOLIFY_TOKEN}" \
@@ -187,11 +195,18 @@ jobs:
   Docker:
     uses: ./.github/workflows/ci-docker-build.yml
     needs: [detect-changes]
+    # Coolify gives every same-repository pull request a preview and pins it to SOURCE_COMMIT, so
+    # every such pull request needs an application-server tag at its head commit — including one that
+    # touches only the preview stack or documentation. Without it the preview deployment fails with
+    # `manifest unknown` for an image that will never be published. application-server-build is a
+    # cached rebuild when server code did not change; the webapp and agent images stay gated by their
+    # own inputs, so this costs one cached build, not the whole matrix.
     if: |
       needs.detect-changes.outputs.should_skip != 'true' && (
         needs.detect-changes.outputs.any-code == 'true' ||
         needs.detect-changes.outputs.ci-config == 'true' ||
-        github.event_name != 'pull_request'
+        github.event_name != 'pull_request' ||
+        github.event.pull_request.head.repo.full_name == github.repository
       )
     secrets: inherit
     with: