feat: add isolated staging results environment / 添加隔离的结果预发布环境 (#565)

* feat: add isolated staging results environment

Refresh the shared Neon staging branch from production before each staged ingest, synchronize the Vercel staging branch from master, and isolate server/CDN/blob caches by environment.

中文：添加隔离的结果预发布环境。每次预发布写入前从生产环境刷新共享 Neon staging 分支，将 Vercel staging 分支同步到 master，并按环境隔离服务端、CDN 和 Blob 缓存。

* fix: overwrite changelog metadata on reingest

Update changelog rows on their workflow/ref natural key and document the destructive staging refresh that replaces the previous unofficial run before every ingest.

中文：重复写入时覆盖 changelog 元数据。按 workflow/ref 自然键更新 changelog 行，并明确预发布环境会在每次写入前执行破坏性刷新，从而替换上一次非官方运行。

* fix: skip source wait for staged ingests

Keep the legacy delay only for direct ingest-agentic-results repository dispatches. Reusable /stage-results calls and manual workflow dispatches now start ingestion immediately.

中文：预发布写入时跳过源运行等待。仅直接 ingest-agentic-results repository dispatch 保留原有延迟；可复用的 /stage-results 调用和手动 workflow dispatch 会立即开始写入。

* fix: scope staging workflow secrets

Document the staging-ref write permission and pass only the secrets required by the reusable staging ingest instead of inheriting the repository secret set.

中文：限制预发布工作流的密钥范围。说明 staging Git 引用写入权限的用途，并仅向可复用预发布写入工作流传递所需密钥，不再继承仓库的全部密钥。

Author: cquil11

.env.example

@@ -30,6 +30,7 @@
 # DATABASE_READONLY_URL=
 # DATABASE_DRIVER=neon
 # DATABASE_SSL=true
+# CACHE_NAMESPACE=
 # BLOB_CACHE_PREFIX=
 # BLOB_READ_WRITE_TOKEN=
 # GITHUB_TOKEN=

.github/workflows/ingest-agentic-results.yml

@@ -24,6 +24,47 @@ name: Ingest Agentic Benchmark Results
 on:
   repository_dispatch:
     types: [ingest-agentic-results]
+  workflow_call:
+    inputs:
+      run-id:
+        description: InferenceX Actions run ID to ingest
+        required: true
+        type: string
+      run-attempt:
+        description: InferenceX Actions run attempt to ingest
+        required: false
+        default: '1'
+        type: string
+      database-target:
+        description: Database/cache target for the ingest
+        required: false
+        default: production
+        type: string
+    secrets:
+      DATABASE_WRITE_URL:
+        description: Production database write connection for direct ingests
+        required: false
+      DATABASE_DEV_WRITE_URL:
+        description: Development database write connection for direct ingests
+        required: false
+      DATABASE_STAGING_WRITE_URL:
+        description: Neon staging branch write connection
+        required: true
+      VERCEL_INVALIDATE_SECRET:
+        description: Production and development cache invalidation bearer token
+        required: false
+      VERCEL_STAGING_INVALIDATE_SECRET:
+        description: Staging cache invalidation bearer token
+        required: true
+      VERCEL_STAGING_BYPASS_SECRET:
+        description: Vercel protection automation bypass token
+        required: true
+      INFX_MAIN_PAT:
+        description: Token used to download InferenceX artifacts
+        required: true
+      SLACK_WEBHOOK_URL:
+        description: Optional failure and unmapped-entity notifications
+        required: false
   workflow_dispatch:
     inputs:
       run-id:
@@ -43,6 +84,7 @@ on:
         options:
           - production
           - dev
+          - staging
 
 permissions: {}
 
@@ -61,7 +103,9 @@ jobs:
       contents: read
     steps:
       - name: Wait for source run to finish
-        if: github.event_name != 'workflow_dispatch'
+        if: >-
+          github.event_name == 'repository_dispatch' &&
+          github.event.action == 'ingest-agentic-results'
         run: sleep 300
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -82,15 +126,28 @@ jobs:
           REQUESTED_DATABASE_TARGET: ${{ github.event.client_payload.database-target || inputs.database-target || 'production' }}
           DATABASE_WRITE_URL_PRODUCTION: ${{ secrets.DATABASE_WRITE_URL }}
           DATABASE_WRITE_URL_DEV: ${{ secrets.DATABASE_DEV_WRITE_URL }}
+          DATABASE_WRITE_URL_STAGING: ${{ secrets.DATABASE_STAGING_WRITE_URL }}
+          INVALIDATE_SECRET_DEFAULT: ${{ secrets.VERCEL_INVALIDATE_SECRET }}
+          INVALIDATE_SECRET_STAGING: ${{ secrets.VERCEL_STAGING_INVALIDATE_SECRET }}
+          PROTECTION_BYPASS_SECRET_STAGING: ${{ secrets.VERCEL_STAGING_BYPASS_SECRET }}
+          STAGING_SITE_URL: ${{ vars.STAGING_SITE_URL || 'https://inferencemax-app-git-staging-semianalysisai.vercel.app' }}
         run: |
           case "$REQUESTED_DATABASE_TARGET" in
             production)
               database_write_url="$DATABASE_WRITE_URL_PRODUCTION"
               cache_invalidate_url="https://inferencex.semianalysis.com/api/v1/invalidate"
+              cache_invalidate_secret="$INVALIDATE_SECRET_DEFAULT"
               ;;
             dev)
               database_write_url="$DATABASE_WRITE_URL_DEV"
               cache_invalidate_url="https://inferencemax-app-git-feat-agentx-semianalysisai.vercel.app/api/v1/invalidate"
+              cache_invalidate_secret="$INVALIDATE_SECRET_DEFAULT"
+              ;;
+            staging)
+              database_write_url="$DATABASE_WRITE_URL_STAGING"
+              cache_invalidate_url="${STAGING_SITE_URL%/}/api/v1/invalidate"
+              cache_invalidate_secret="$INVALIDATE_SECRET_STAGING"
+              protection_bypass_secret="$PROTECTION_BYPASS_SECRET_STAGING"
               ;;
             *)
               echo "::error::Unsupported database-target: $REQUESTED_DATABASE_TARGET"
@@ -102,11 +159,27 @@ jobs:
             echo "::error::Database secret is empty for target: $REQUESTED_DATABASE_TARGET"
             exit 1
           fi
+          if [ -z "$cache_invalidate_secret" ]; then
+            echo "::error::Cache invalidation secret is empty for target: $REQUESTED_DATABASE_TARGET"
+            exit 1
+          fi
+          if [ "$REQUESTED_DATABASE_TARGET" = "staging" ] && [ -z "$protection_bypass_secret" ]; then
+            echo "::error::Vercel protection bypass secret is empty for staging"
+            exit 1
+          fi
 
           echo "::add-mask::$database_write_url"
-          echo "DATABASE_WRITE_URL=$database_write_url" >> "$GITHUB_ENV"
-          echo "INGEST_DATABASE_TARGET=$REQUESTED_DATABASE_TARGET" >> "$GITHUB_ENV"
-          echo "CACHE_INVALIDATE_URL=$cache_invalidate_url" >> "$GITHUB_ENV"
+          echo "::add-mask::$cache_invalidate_secret"
+          if [ -n "$protection_bypass_secret" ]; then
+            echo "::add-mask::$protection_bypass_secret"
+          fi
+          {
+            echo "DATABASE_WRITE_URL=$database_write_url"
+            echo "CACHE_INVALIDATE_SECRET=$cache_invalidate_secret"
+            echo "INGEST_DATABASE_TARGET=$REQUESTED_DATABASE_TARGET"
+            echo "CACHE_INVALIDATE_URL=$cache_invalidate_url"
+            echo "CACHE_PROTECTION_BYPASS_SECRET=$protection_bypass_secret"
+          } >> "$GITHUB_ENV"
           echo "Selected ingest target: $REQUESTED_DATABASE_TARGET"
           echo "Cache invalidate URL: $cache_invalidate_url"
 
@@ -184,11 +257,15 @@ jobs:
         run: pnpm admin:db:verify
 
       - name: Invalidate Vercel cache
-        env:
-          VERCEL_INVALIDATE_SECRET: ${{ secrets.VERCEL_INVALIDATE_SECRET }}
         run: |
-          curl -sSf -X POST "$CACHE_INVALIDATE_URL" \
-            -H "Authorization: Bearer $VERCEL_INVALIDATE_SECRET" || true
+          if [ "$INGEST_DATABASE_TARGET" = "staging" ]; then
+            curl --retry 12 --retry-delay 10 --retry-all-errors -sSf -X POST "$CACHE_INVALIDATE_URL" \
+              -H "Authorization: Bearer $CACHE_INVALIDATE_SECRET" \
+              -H "x-vercel-protection-bypass: $CACHE_PROTECTION_BYPASS_SECRET"
+          else
+            curl -sSf -X POST "$CACHE_INVALIDATE_URL" \
+              -H "Authorization: Bearer $CACHE_INVALIDATE_SECRET" || true
+          fi
 
       - name: Check for unmapped entities
         if: always()