Build the UI image after tests pass, then ask infra for the deploy PR

.github/workflows/image.yml

@@ -1,9 +1,12 @@
-# Builds the UI image (also used for the hydra-clients Job) for the Kubernetes deployment.
+# Builds the UI image (also used for the hydra-clients Job) for the Kubernetes deployment, once `test`
+# passed on a push to main, then asks bulbashenko-com/infra for the production deploy PR (the owner merges it).
 # Tag = full commit SHA: bulbashenko-com/infra pins the same SHA for the configs and the image.
 name: image
 
 on:
-  push:
+  workflow_run:
+    workflows: [test]
+    types: [completed]
     branches: [main]
   workflow_dispatch:
 
@@ -13,9 +16,19 @@ permissions:
 
 jobs:
   ui:
+    # Only commits that landed on main (not PRs from a branch named main) and passed UI checks + e2e.
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push')
     runs-on: ubuntu-24.04
+    outputs:
+      sha: ${{ steps.sha.outputs.sha }}
     steps:
+      - id: sha
+        run: echo "sha=${{ github.event.workflow_run.head_sha || github.sha }}" >> "$GITHUB_OUTPUT"
       - uses: actions/checkout@v5
+        with:
+          ref: ${{ steps.sha.outputs.sha }}
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
         with:
@@ -27,10 +40,20 @@ jobs:
           context: ui
           push: true
           tags: |
-            ghcr.io/${{ github.repository_owner }}/auth-ui:${{ github.sha }}
+            ghcr.io/${{ github.repository_owner }}/auth-ui:${{ steps.sha.outputs.sha }}
             ghcr.io/${{ github.repository_owner }}/auth-ui:main
           labels: |
             org.opencontainers.image.source=https://github.com/${{ github.repository }}
-            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.revision=${{ steps.sha.outputs.sha }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+  # Opens or refreshes the production deploy PR deploy/auth in bulbashenko-com/infra.
+  promote:
+    needs: ui
+    if: github.ref == 'refs/heads/main'
+    uses: bulbashenko-com/infra/.github/workflows/request-promote.yml@main
+    with:
+      app: auth
+      sha: ${{ needs.ui.outputs.sha }}
+    secrets: inherit

README.md

@@ -49,7 +49,7 @@ Groups decide access. Each OIDC client names one group in `metadata.required_gro
 
 `kustomization.yaml` at the root is a Kustomize base built from the same `ory/` files that `compose.yml` mounts: Deployments for Kratos, Hydra and Keto (each runs its migration as an init container), Oathkeeper and the UI, the `hydra-clients` Job, and Traefik routes (`auth-public` on the `web` entrypoint, `auth-admin` for `users.int` behind the mesh and Oathkeeper). Service names match the compose stack, so the configs' internal URLs work unchanged.
 
-The deploying side provides the namespace, the image tag and a Secret `auth` with `KRATOS_DSN`, `HYDRA_DSN`, `KETO_DSN`, `KRATOS_SECRETS_{COOKIE,DEFAULT,CIPHER,PAGINATION}`, `HYDRA_SECRETS_{SYSTEM,COOKIE,PAGINATION}`, `SMTP_CONNECTION_URI`, `SMTP_SENDER` and `OIDC_{SITE,COOLIFY,HEADSCALE}_CLIENT_SECRET`. bulbashenko.com deploys it from [bulbashenko-com/infra](https://github.com/bulbashenko-com/infra), pinned to one commit of this repo; `.github/workflows/image.yml` builds `ghcr.io/bulbashenko-com/auth-ui:<commit>` for that commit.
+The deploying side provides the namespace, the image tag and a Secret `auth` with `KRATOS_DSN`, `HYDRA_DSN`, `KETO_DSN`, `KRATOS_SECRETS_{COOKIE,DEFAULT,CIPHER,PAGINATION}`, `HYDRA_SECRETS_{SYSTEM,COOKIE,PAGINATION}`, `SMTP_CONNECTION_URI`, `SMTP_SENDER` and `OIDC_{SITE,COOLIFY,HEADSCALE}_CLIENT_SECRET`. bulbashenko.com deploys it from [bulbashenko-com/infra](https://github.com/bulbashenko-com/infra), pinned to one commit of this repo; `.github/workflows/image.yml` builds `ghcr.io/bulbashenko-com/auth-ui:<commit>` once `test` passes on main and then opens the deploy PR `deploy/auth` in infra.
 
 ## Deploy on Coolify