Fit staging Cloud Run tag within the 46-char combined limit

Cloud Run rejects deploys where traffic tag + service name exceed 46
characters (they form the tag URL's DNS label). The Stage 1 service
rename to policyengine-api-staging (24 chars) left 22 for the tag,
but the staging tag template stage3-staging-<run#>-<sha7> is at least
24 — every staging deploy failed at gcloud. Shorten the staging tag to
stg-<run#>-<sha7> (combined <=45 even at 9-digit run numbers; prod
keeps stage3-prod-*, which exit gates key on) and add a fail-fast
combined-length guard to deploy validation.

Fixes #3729

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: anth-volk

.github/scripts/validate_cloud_run_deploy_env.sh

@@ -5,6 +5,15 @@ set -euo pipefail
 source .github/scripts/cloud_run_env.sh
 cloud_run_set_defaults
 
+# Cloud Run rejects deploys where the traffic tag and service name together
+# exceed 46 characters (they form the tag URL's DNS label). Fail fast here
+# with a clear message instead of at gcloud.
+combined_length=$(( ${#CLOUD_RUN_TAG} + ${#CLOUD_RUN_SERVICE} ))
+if (( combined_length > 46 )); then
+  echo "Cloud Run tag '${CLOUD_RUN_TAG}' (${#CLOUD_RUN_TAG}) + service '${CLOUD_RUN_SERVICE}' (${#CLOUD_RUN_SERVICE}) = ${combined_length} characters exceeds Cloud Run's 46-character combined limit." >&2
+  exit 1
+fi
+
 cloud_run_require_env \
   CLOUD_RUN_PROJECT \
   CLOUD_RUN_REGION \

.github/workflows/push.yml

@@ -233,7 +233,8 @@ jobs:
         id: cloud_run
         run: |
           echo "image_tag=${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
-          echo "revision_tag=stage3-staging-${GITHUB_RUN_NUMBER}-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+          # Short tag: Cloud Run caps tag + service name at 46 combined chars.
+          echo "revision_tag=stg-${GITHUB_RUN_NUMBER}-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
       - name: Build and push Cloud Run image
         run: bash .github/scripts/build_cloud_run_image.sh
         env:

changelog.d/staging-cloud-run-tag-length.fixed.md

@@ -0,0 +1 @@
+Shorten the staging Cloud Run revision tag to fit Cloud Run's 46-character combined tag + service name limit, and fail fast in deploy validation when the limit is exceeded.