fix: align workflows to v* tags and support manual release deploys

.github/actions/prepare-tofu/action.yml

@@ -6,12 +6,18 @@ inputs:
     description: The OpenTofu version to install.
     required: false
     default: '1.11.5'
+  is_release_tag:
+    description: Whether the build is for a release tag. Passed through to VITE_IS_RELEASE_TAG.
+    required: false
+    default: 'false'
 
 runs:
   using: composite
   steps:
     - name: Setup app and build
       uses: ./.github/actions/setup
+      env:
+        VITE_IS_RELEASE_TAG: ${{ inputs.is_release_tag }}
       with:
         build: 'true'
 

.github/workflows/cloudflare-web-deploy.yml

@@ -11,6 +11,11 @@ on:
     tags:
       - 'v*'
   workflow_dispatch:
+    inputs:
+      git_tag:
+        description: 'Git tag to deploy (e.g. v1.2.3). Leave empty to deploy current HEAD.'
+        required: false
+        type: string
 
 env:
   CLOUDFLARE_API_TOKEN: ${{ secrets.TF_CLOUDFLARE_API_TOKEN }}
@@ -49,6 +54,8 @@ jobs:
 
       - name: Prepare OpenTofu deployment
         uses: ./.github/actions/prepare-tofu
+        with:
+          is_release_tag: ${{ startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.git_tag != '') }}
 
       - name: Comment PR plan
         uses: dflook/tofu-plan@3f5dc358343fb58cd60f83b019e810315aa8258f # v2.2.3
@@ -57,7 +64,7 @@ jobs:
           label: production
 
   apply:
-    if: (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/sable/v')) || github.event_name == 'workflow_dispatch'
+    if: (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -69,9 +76,12 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.git_tag || '' }}
 
       - name: Prepare OpenTofu deployment
         uses: ./.github/actions/prepare-tofu
+        with:
+          is_release_tag: ${{ startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.git_tag != '') }}
 
       - name: Plan infrastructure
         run: tofu plan -input=false -no-color

.github/workflows/docker-publish.yml

@@ -9,6 +9,12 @@ on:
     paths:
       - 'Dockerfile'
       - '.github/workflows/docker-publish.yml'
+  workflow_dispatch:
+    inputs:
+      git_tag:
+        description: 'Git tag to build and publish (e.g. v1.2.3). Leave empty to build current HEAD as a dev image.'
+        required: false
+        type: string
 
 env:
   REGISTRY: ghcr.io
@@ -29,6 +35,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.git_tag || '' }}
 
       - name: Log in to GitHub Container Registry
         if: github.event_name != 'pull_request'
@@ -42,8 +49,13 @@ jobs:
         id: release_tag
         shell: bash
         run: |
-          if [[ "${GITHUB_REF}" == refs/tags/sable/v* ]]; then
-            echo "value=${GITHUB_REF#refs/tags/sable/}" >> "$GITHUB_OUTPUT"
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            TAG="${{ inputs.git_tag }}"
+          else
+            TAG="${GITHUB_REF#refs/tags/}"
+          fi
+          if [[ "${TAG}" == v* ]]; then
+            echo "value=${TAG}" >> "$GITHUB_OUTPUT"
             echo "is_release=true" >> "$GITHUB_OUTPUT"
           else
             echo "value=" >> "$GITHUB_OUTPUT"
@@ -58,11 +70,11 @@ jobs:
           flavor: |
             latest=false
           tags: |
-            # dev branch: short commit SHA + latest
-            type=sha,prefix=,format=short,enable=${{ github.ref == 'refs/heads/dev' }}
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/dev' }}
+            # dev branch or manual dispatch without a tag: short commit SHA + latest
+            type=sha,prefix=,format=short,enable=${{ github.ref == 'refs/heads/dev' || (github.event_name == 'workflow_dispatch' && inputs.git_tag == '') }}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/dev' || (github.event_name == 'workflow_dispatch' && inputs.git_tag == '') }}
 
-            # git tags: semver breakdown
+            # git tags (push or manual dispatch with a tag): semver breakdown
             type=semver,pattern={{version}},value=${{ steps.release_tag.outputs.value }},enable=${{ steps.release_tag.outputs.is_release == 'true' }}
             type=semver,pattern={{major}}.{{minor}},value=${{ steps.release_tag.outputs.value }},enable=${{ steps.release_tag.outputs.is_release == 'true' }}
             type=semver,pattern={{major}},value=${{ steps.release_tag.outputs.value }},enable=${{ steps.release_tag.outputs.is_release == 'true' && !startsWith(steps.release_tag.outputs.value, 'v0.') }}

vite.config.ts

@@ -54,7 +54,7 @@ const isReleaseTag = (() => {
   if (envVal !== undefined && envVal !== '') return envVal === 'true';
   try {
     const tag = execSync('git describe --exact-match --tags HEAD 2>/dev/null').toString().trim();
-    return tag.startsWith('sable/v');
+    return tag.startsWith('v');
   } catch {
     return false;
   }