From f9a875c02b8c8958bc5716ae5557abc6b6e6eb1a Mon Sep 17 00:00:00 2001
From: Shelley <shelley@localhost>
Date: Thu, 3 Sep 2026 23:17:24 +0000
Subject: [PATCH] ci: dispatch digest-pinned state update to PostHog/charts on
 release

Adds the state-file CD step to the existing release workflow (no second
image pipeline): after the multi-arch image push, record the manifest
digest and dispatch commit_state_update to PostHog/charts so
state/viaduck.yaml pins <commit>@sha256:<digest> and ArgoCD rolls it
with prod-approval gating.

Mutable :latest/:dev/:prod tags are kept for back-compat until the
charts-side cutover lands. Also tags the image with the commit SHA for
digest inspection and traceability, and guards the job to the canonical
repo.

Requires GH_APP_CHARTS_DEPLOYER_APP_ID / GH_APP_CHARTS_DEPLOYER_PRIVATE_KEY
secrets (not yet present in this repo).

Co-authored-by: Shelley <shelley@exe.dev>
---
 .github/workflows/release.yaml | 46 ++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index f059701..80e75de 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -14,6 +14,9 @@ permissions:
 
 jobs:
   release:
+    # Only run in the canonical repo — forks must not push images, tags,
+    # or deployment dispatches.
+    if: github.repository == 'PostHog/viaduck'
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
@@ -97,10 +100,53 @@ jobs:
           VIADUCK_VERSION=${{ steps.next_tag.outputs.version }}
         tags: |
           ghcr.io/posthog/viaduck:${{ steps.next_tag.outputs.tag }}
+          ghcr.io/posthog/viaduck:${{ github.sha }}
           ghcr.io/posthog/viaduck:latest
         cache-from: type=gha
         cache-to: type=gha,mode=max
 
+    # --- Deploy: pin the pushed image by digest in PostHog/charts ---
+    # The production deployment must not follow mutable tags (:prod,
+    # :latest). Instead we record the manifest digest of the image built
+    # here in the charts state file (state/viaduck.yaml) via a
+    # repository_dispatch. ArgoCD then rolls the pinned
+    # <commit>@sha256:<digest> reference with prod-approval gating.
+    # The :latest / :dev / :prod tag pushes stay for back-compat until the
+    # charts-side cutover lands.
+
+    - name: Get image digest
+      id: digest
+      run: |
+        digest=$(docker buildx imagetools inspect --raw ghcr.io/posthog/viaduck:${{ github.sha }} | sha256sum | awk '{print "sha256:"$1}')
+        echo "digest=${digest}" >> "$GITHUB_OUTPUT"
+
+    - name: Get deployer token
+      id: deployer
+      uses: getsentry/action-github-app-token@d4b5da6c5e37703f8c3b3e43abb5705b46e159cc # v3.0.0
+      with:
+        app_id: ${{ secrets.GH_APP_CHARTS_DEPLOYER_APP_ID }}
+        private_key: ${{ secrets.GH_APP_CHARTS_DEPLOYER_PRIVATE_KEY }}
+
+    - name: Trigger deployment via Charts repo
+      uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+      with:
+        token: ${{ steps.deployer.outputs.token }}
+        repository: PostHog/charts
+        event-type: commit_state_update
+        client-payload: |
+          {
+            "values": {
+              "image": {
+                "sha": "${{ github.sha }}@${{ steps.digest.outputs.digest }}"
+              }
+            },
+            "release": "viaduck",
+            "commit": ${{ toJson(github.event.head_commit) }},
+            "repository": ${{ toJson(github.repository) }},
+            "labels": [],
+            "timestamp": "${{ github.event.head_commit.timestamp }}"
+          }
+
     - name: Create git tag
       env:
         NEXT_TAG: ${{ steps.next_tag.outputs.tag }}