ci(sandbox): auto-bump deco-apps-cd on studio-sandbox image release

[pedrofrxncx]

Problem

Merging any change to packages/sandbox/** on main builds + pushes a new studio-sandbox image (release-studio-sandbox.yaml), but nothing bumps the tag in deco-apps-cd, so the release never rolls out without a manual values edit. (Chart default is 1.6.1; deco-apps-cd is hand-bumped to 1.9.0 — the drift is the symptom.)

Fix

Add a bump-deco-apps-cd job that fires the generic image-bump repository_dispatch already implemented in deco-apps-cd (bump-image.yml), which surgically rewrites the tag: under the matching repository: line and self-commits. Payload:

{ "version": "<packages/sandbox/package.json version>",
  "repository": "decocms/studio/studio-sandbox",
  "files": ["apps/studio-sandbox-stg/values.yaml", "apps/studio-sandbox-prod/values.yaml"] }

Mirrors release-mesh.yaml's dispatch pattern — same DEPLOY_REPO_TOKEN (decobot), no cross-repo write credential in this repo.

Behavior / safety

• Fires only when a new image was actually pushed (skips docs/test-only packages/sandbox changes that reuse the existing tag), via a new image-exists job output.
• No-ops (job still green) if DEPLOY_REPO_TOKEN isn't set — the bump never reds a release.
• Bumps both stg and prod. Both sandbox apps are ArgoCD auto-sync, but a SandboxTemplate tag bump only changes what new sandbox claims get — running pods aren't disturbed. (Confirmed the desired behavior.)

Testing

YAML parses; job graph build-push → bump-deco-apps-cd. The dispatch itself only exercises on a real main merge (needs the org secret). Anchor + files verified against the current deco-apps-cd studio-sandbox-{stg,prod}/values.yaml.

🤖 Generated with Claude Code

---

Summary by cubic

Automates rollout of new studio-sandbox images by auto-bumping the tag in deco-apps-cd after a successful image release. This removes manual values edits and keeps staging and prod aligned.

• New Features
  • Adds bump-deco-apps-cd job in release-studio-sandbox.yaml to dispatch image-bump to decocms/deco-apps-cd with the new version and stg/prod values files.
  • Runs only when a new image was actually pushed; no-ops (green) if DEPLOY_REPO_TOKEN is not set.
  • Updates both environments; ArgoCD sync affects new sandbox claims only, not running pods.

^{Written for commit 5a2a7f5. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}