feat: add deployment tagging, GitHub Releases, and PR template

[mahata]

Summary

• Add a post-deploy step to deploy.yml that creates a git tag (deploy-YYYY-MM-DD-SHA) and a GitHub Release with auto-generated notes after each successful production deployment
• Add a default PR template with a pre-deploy checklist for PRs targeting prod

Details

Deployment Tracking (deploy.yml)

After a successful Cloudflare Workers deploy, the workflow now:

1. Fetches existing tags (needed because actions/checkout does a shallow clone)
2. Creates a git tag in the format deploy-2026-03-30-a1b2c3d
3. Pushes the tag to the remote
4. Creates a GitHub Release with auto-generated notes covering all changes since the previous deploy-* tag

This provides:

• Exact commit tracking: each tag points to the deployed commit
• Deployment history: git tag -l 'deploy-*' or the GitHub Releases page
• Changelog per deploy: auto-generated release notes list included PRs/commits

The workflow gets permissions: contents: write to push tags and create releases via GITHUB_TOKEN.

PR Template (.github/PULL_REQUEST_TEMPLATE.md)

A default template shown for all new PRs with:

• Summary section
• Included Changes section (with link to compare view)
• Pre-deploy checklist (CI, migrations, secrets, Durable Objects)
• Rollback plan section

[Copilot]

Pull request overview

Adds automated deployment tracking to the production deploy workflow by tagging each successful deploy and creating a corresponding GitHub Release, and introduces a default PR template with a pre-deploy checklist to standardize releases to prod.

Changes:

• Grant workflow permission to write repository contents so it can push tags and create releases.
• After successful deploy, fetch tags, create a deploy-YYYY-MM-DD-SHA tag, push it, and create a GitHub Release with autogenerated notes since the previous deploy tag.
• Add .github/PULL_REQUEST_TEMPLATE.md with summary, checklist, and rollback plan prompts.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
.github/workflows/deploy.yml	Adds post-deploy tagging + GitHub Release creation for production deployments.
.github/PULL_REQUEST_TEMPLATE.md	Adds a default PR template with a pre-deploy checklist and rollback plan section.

[Copilot]

Workflow-wide permissions: contents: write grants write access to the repo token for all jobs (including test/e2e). Consider setting a read-only default at the workflow level and granting contents: write only on the deploy job (or even only on the release/tagging step) to reduce the blast radius if a job step is compromised.

[mahata]

@copilot apply changes based on this feedback

[Copilot]

Done in ac8d3b5. Changed the workflow-level permission to contents: read (so test and e2e jobs only get read access) and added permissions: contents: write scoped to the deploy job only.

[warcvs-svg]

={_/_}