chore(ci): deploy the dashboard agent dormant, drop the reviewer gate, add a ref input

[ericallam]

Problem

Every merge to main touching the agent queued a gated staging+prod deploy that sat pending on a reviewer approval nobody grants routinely. Because the gated runs never completed, they never drained the concurrency queue and cancelled each other, so the Actions tab filled with never-completing runs and the agent only ever actually deployed via a manual dispatch + approval.

The reviewer gate bought nothing here: the agent deploys with --skip-promotion, so a deploy lands dormant and nothing goes live until the consuming webapp flips DASHBOARD_AGENT_VERSION. Promotion is already a deliberate act (the env-var flip); gating the dormant deploy on top of that just created the pile-up.

Change

• Remove the reviewer gate by dropping the required-reviewers rule on the dashboard-agent-* environments (repo-settings change, done). The environment: key stays so the per-environment scoped deploy token still resolves — no secret migration.
• workflow_dispatch ref input — deploy a specific commit SHA, branch, or tag; defaults to the ref the run launches from. Checkout uses github.event.inputs.ref || github.sha.
• Require the ref to be an ancestor of main. Constrains which commit gets deployed to merged code only. A push is always main's tip (passes trivially); a dispatched unmerged ref is rejected before the deploy step. Because an explicit ref: checkout doesn't create remote-tracking branches, origin/main is fetched explicitly before git merge-base --is-ancestor.
• cancel-in-progress: false (kept). Cancelling the runner wouldn't stop the remote build (it finishes server-side), and a superseding concurrent deploy would race the same project's indexer. With the gate gone, deploys are short, so a brief queue can't pile up.
• max-parallel: 1 stays (parallel deploys of the same project race at the indexer).

Owner actions (repo settings — not in the diff)

1. Remove required-reviewers on dashboard-agent-staging and dashboard-agent-prod — done.
2. Add a deployment branch policy on both environments restricting deployments to main. This is the authoritative token guard: workflow_dispatch runs the workflow file from the selected ref, so the in-file ancestor check alone can't protect TRIGGER_ACCESS_TOKEN (a branch could edit the check out). GitHub enforces the branch policy server-side against GITHUB_REF regardless of file contents. With it in place, the workflow only runs (and the token is only exposed) when dispatched from main, and the in-file check then constrains the independent ref input to merged commits.

Pile-up root cause

The stacking was caused by the reviewer gate (runs waited forever, so the queue never drained), not by cancel-in-progress. Removing the gate is what fixes it; cancel-in-progress stays false.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 074e239

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c081fc1a-e01c-4246-97d8-a2e7e5352ea7

📥 Commits

Reviewing files that changed from the base of the PR and between e65e60e and 074e239.

📒 Files selected for processing (1)

• .github/workflows/dashboard-agent-deploy.yml

Included review availability: Your plan provides up to 10 included reviews per hour; 5 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: code-quality / code-quality
• GitHub Check: Analyze (javascript-typescript)

🔇 Additional comments (2)

.github/workflows/dashboard-agent-deploy.yml (2)

77-81: Verify the main-only deployment branch policy.

The workflow cannot establish this repository setting. Confirm that both environments permit only the main branch, not a tag named main. This server-side policy must exist before the environment token can protect workflow_dispatch runs.

#!/usr/bin/env bash
set -euo pipefail

repo="$(gh repo view --json nameWithOwner --jq '.nameWithOwner')"

for environment in dashboard-agent-staging dashboard-agent-prod; do
  echo "== ${environment} =="

  gh api "repos/${repo}/environments/${environment}" \
    --jq '.deployment_branch_policy |
      select(.custom_branch_policies == true and .protected_branches == false)'

  mapfile -t policies < <(
    gh api --paginate \
      "repos/${repo}/environments/${environment}/deployment-branch-policies" \
      --jq '.branch_policies[] | "\(.type):\(.name)"'
  )

  test "${`#policies`[@]}" -eq 1
  test "${policies[0]}" = "branch:main"
done

---

27-31: LGTM!

Also applies to: 45-70, 72-76, 82-92

---

Walkthrough

The deployment workflow documents dormant per-environment deployments and environment-scoped tokens. Manual runs accept an optional commit, branch, or tag ref. Checkout uses the supplied ref when present and github.sha otherwise. The workflow fetches full history and rejects refs that are not ancestors of origin/main. Concurrency queues deployments without cancellation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the workflow changes: dormant deployment, reviewer-gate removal, and ref input support.
Description check	✅ Passed	The description clearly explains the problem, implementation, safeguards, and owner actions, but omits the template checklist, testing steps, changelog, screenshots, and issue link.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dashboard-agent-deploy-dispatch-ref

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4544b967-b6f1-425c-838f-d92a94aeab8b

📥 Commits

Reviewing files that changed from the base of the PR and between d93ff13 and e65e60e.

📒 Files selected for processing (1)

• .github/workflows/dashboard-agent-deploy.yml

Included review availability: Your plan provides up to 10 included reviews per hour; 6 remain after this review.

📜 Review details

⏰ Context from checks skipped due to timeout. (3)

• GitHub Check: code-quality / code-quality
• GitHub Check: Zizmor
• GitHub Check: Analyze (javascript-typescript)

🔇 Additional comments (2)

.github/workflows/dashboard-agent-deploy.yml (2)

6-14: LGTM!

Also applies to: 27-31, 65-70, 81-83

---

49-53: Resolve the cancellation-policy mismatch.

The PR objective says cancel-in-progress: true, but the workflow retains cancel-in-progress: false. The comments intentionally document the opposite behavior. Confirm which contract is required. If cancellation is required, add provider-side cancellation or locking before changing this value.

[devin-ai-integration]

Devin Review found 1 new potential issue.

View 1 additional finding in Devin Review.