Add `workflow_dispatch` support to image ci workflows

[bschwedler]

We want the ability to trigger the ci workflow for each image via the workflow_dispatch trigger.

This will allow us to use a GitHub App and trigger with gh workflow run with the `--repo` flag.

Prerequisites

Shared infrastructure (merged)

• Add cross-repository workflow DAG page #444
• Add bakery CLI commands for release automation #393
• Add shared product-release workflow #419

GitHub Apps + Pulumi + secrets (manual, gates production dispatch)

Dev stream filtering & dispatch support

• Add --dev-stream filter option for dev version builds #457 (bakery CLI)
• Add image-version and dev-stream inputs to build workflows #480 (shared workflow inputs)

Connect

Production (release dispatch → image build)

• Add release workflow images-connect#41
• Add workflow_dispatch trigger to all build workflows images-connect#58
• https://github.com/posit-dev/connect/pull/38346

Development (dev dispatch → dev image build)

• Add dispatch inputs to development workflow images-connect#66
• https://github.com/posit-dev/connect/pull/38466

Workbench

Production (release dispatch → image build)

• Add release workflow images-workbench#49
• Add workflow_dispatch trigger to all build workflows images-workbench#64
• https://github.com/rstudio/rstudio-pro/pull/10541

Development (dev dispatch → dev image build)

• Add dispatch inputs to development workflow images-workbench#74
• https://github.com/rstudio/rstudio-pro/pull/10603
• Add Workbench preview release stream #452
• Add Workbench preview release stream images-workbench#75

Package Manager

Production (release dispatch → image build)

• Add release workflow images-package-manager#55
• Add workflow_dispatch trigger to all build workflows images-package-manager#62
• https://github.com/rstudio/package-manager/pull/17579

Development (dev dispatch → dev image build)

• Add dispatch inputs to development workflow images-package-manager#69
• https://github.com/rstudio/package-manager/pull/17654

Helm auto-update (image build → helm chart)

• Add product-release workflow dispatch rstudio/helm#830
• Add update-helm job to production workflow images-connect#59
• Add update-helm job to production workflow images-workbench#65
• Add update-helm job to production workflow images-package-manager#63

[bschwedler]

High-level diagram of an end state

flowchart LR
    workbench --> images-workbench --> helm
    connect --> images-connect --> helm
    package-manager --> images-package-manager --> helm

Loading

We can also trigger additional downstream workflows where it makes sense

[bschwedler]

Prerequisites

• Merge release workflow PRs (Add bakery CLI commands for release automation #393, Add release workflow images-connect#41, Add release workflow images-workbench#49, Add release workflow images-package-manager#55)
• Set up a GitHub App with actions:write on the posit-dev/images-* and posit-dev/helm repos
• Switch preview images from ECR to GHCR (Push preview images to GHCR instead of ECR images-workbench#54, Push preview images to GHCR instead of ECR images-package-manager#57)

Per-product work

Connect

Image repo (posit-dev/images-connect):

• Add workflow_dispatch trigger to development.yml and production.yml
• After a successful production build, dispatch a workflow in posit-dev/helm with the product name, version, and image tag

Product repo (posit-dev/connect):

• Add a step to tools/release/publish_release.py calling run_github_actions_workflow() to dispatch release.yml in posit-dev/images-connect. The function already exists in release_common.py and is used for 3 other dispatch calls (docs, sbom, escrow).

Workbench

Image repo (posit-dev/images-workbench):

• Add workflow_dispatch trigger to development.yml, production.yml, and session.yml
• After a successful production build, dispatch a workflow in posit-dev/helm with the product name, version, and image tag

Product repo (rstudio/rstudio-pro):

• Add a release-update-images-workbench.yml sub-workflow (same pattern as release-update-docker-products.yml), call it from release-all.yml alongside the other update-* jobs.

Package Manager

Image repo (posit-dev/images-package-manager):

• Add workflow_dispatch trigger to development-builds.yml and production-builds.yml
• After a successful production build, dispatch a workflow in posit-dev/helm with the product name, version, and image tag

Product repo (rstudio/package-manager):

• Add a dispatch step to .github/workflows/ci.yml in the publish job, after S3 upload and CloudFront cache invalidation, conditional on tag push. No cross-repo automation exists today so this is net-new.

Helm (posit-dev/helm)

• Add a workflow_dispatch workflow that accepts product name, version, and image tag as inputs
• The workflow updates Chart.yaml appVersion, bumps the chart patch version, and creates a PR
• Helm repo owns its own update logic — image repos just dispatch with version info

Decisions

• GitHub App for cross-repo dispatch (not PATs). Extends existing App infrastructure.
• Direct dispatch from product repos to image repos. No centralized routing layer.
• Helm update logic lives in the Helm repo. Image repos dispatch a workflow in posit-dev/helm after successful production builds. Helm repo owns how its charts are updated.
• No auto-merge for Helm PRs until Helm workflows are cleaned up.
• Keep schedules as fallbacks (weekly prod, daily dev) but primary trigger becomes event-driven.

[bschwedler]

Workflow call graph

flowchart TB
    subgraph "posit-dev/connect"
        PCT_PUB["publish_release.py"]
    end

    subgraph "rstudio/rstudio-pro"
        RSP_ALL["release-all.yml"]
        RSP_IMG["release-update-images-workbench.yml"]
        RSP_ALL --> RSP_IMG
    end

    subgraph "rstudio/package-manager"
        PPM_CI["ci.yml (publish job)"]
    end

    subgraph "posit-dev/images-connect"
        IC_REL["release.yml"]
        IC_PROD["production.yml"]
        IC_HELM["update-helm job"]
        IC_PROD --> IC_HELM
    end

    subgraph "posit-dev/images-workbench"
        IW_REL["release.yml"]
        IW_PROD["production.yml"]
        IW_HELM["update-helm job"]
        IW_PROD --> IW_HELM
    end

    subgraph "posit-dev/images-package-manager"
        IP_REL["release.yml"]
        IP_PROD["production.yml"]
        IP_HELM["update-helm job"]
        IP_PROD --> IP_HELM
    end

    subgraph "rstudio/helm"
        HELM["product-release.yml"]
    end

    PCT_PUB -- "dispatch" --> IC_REL
    RSP_IMG -- "dispatch" --> IW_REL
    PPM_CI -- "dispatch" --> IP_REL

    IC_REL -. "PR merge triggers" .-> IC_PROD
    IW_REL -. "PR merge triggers" .-> IW_PROD
    IP_REL -. "PR merge triggers" .-> IP_PROD

    IC_HELM -- "dispatch" --> HELM
    IW_HELM -- "dispatch" --> HELM
    IP_HELM -- "dispatch" --> HELM

Loading