[WIP] Add workflow_dispatch support to image CI workflows

[Copilot]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

---

This section details on the original issue you should resolve

<issue_title>Add workflow_dispatch support to image ci workflows</issue_title>
<issue_description>We want the ability to trigger the ci workflow for each image via the workflow_dispatch trigger.

This will allow us to use a GitHub App and trigger with gh workflow run with the --repo flag.</issue_description>

Comments on the Issue (you are @copilot in this section)

@bschwedler High-level diagram of an end state

flowchart LR
    workbench --> images-workbench --> helm
    connect --> images-connect --> helm
    package-manager --> images-package-manager --> helm

Loading

We can also trigger additional downstream workflows where it makes sense</comment_new>
<comment_new>@bschwedler

Prerequisites

• Merge release workflow PRs (Add bakery CLI commands for release automation #393, Add release workflow images-connect#41, Add release workflow images-workbench#49, Add release workflow images-package-manager#55)
• Set up a GitHub App with actions:write on the posit-dev/images-* and posit-dev/helm repos
• Switch preview images from ECR to GHCR (Push preview images to GHCR instead of ECR images-workbench#54, Push preview images to GHCR instead of ECR images-package-manager#57)

Per-product work

Connect

Image repo (posit-dev/images-connect):

• Add workflow_dispatch trigger to development.yml and production.yml
• After a successful production build, dispatch a workflow in posit-dev/helm with the product name, version, and image tag

Product repo (posit-dev/connect):

• Add a step to tools/release/publish_release.py calling run_github_actions_workflow() to dispatch release.yml in posit-dev/images-connect. The function already exists in release_common.py and is used for 3 other dispatch calls (docs, sbom, escrow).

Workbench

Image repo (posit-dev/images-workbench):

• Add workflow_dispatch trigger to development.yml, production.yml, and session.yml
• After a successful production build, dispatch a workflow in posit-dev/helm with the product name, version, and image tag

Product repo (rstudio/rstudio-pro):

• Add a release-update-images-workbench.yml sub-workflow (same pattern as release-update-docker-products.yml), call it from release-all.yml alongside the other update-* jobs.

Package Manager

Image repo (posit-dev/images-package-manager):

• Add workflow_dispatch trigger to development-builds.yml and production-builds.yml
• After a successful production build, dispatch a workflow in posit-dev/helm with the product name, version, and image tag

Product repo (rstudio/package-manager):

• Add a dispatch step to .github/workflows/ci.yml in the publish job, after S3 upload and CloudFront cache invalidation, conditional on tag push. No cross-repo automation exists today so this is net-new.

Helm (posit-dev/helm)

• Add a workflow_dispatch workflow that accepts product name, version, and image tag as inputs
• The workflow updates Chart.yaml appVersion, bumps the chart patch version, and creates a PR
• Helm repo owns its own update logic — image repos just dispatch with version info

Decisions

• GitHub App for cross-repo dispatch (not PATs). Extends existing App infrastructure.
• Direct dispatch from product repos to image repos. No centralized routing layer.
• Helm update logic lives in the Helm repo. Image repos dispatch a workflow in posit-dev/helm after successful production builds. Helm repo owns how its charts are updated.
• No auto-merge for Helm PRs until Helm workflows are cleaned up.
• Keep schedules as fallbacks (weekly prod, daily dev) but primary trigger becomes event-driven.</comment_new>

[bschwedler]

This was inadvertently created.