chore(ci): deploy the dashboard agent dormant, drop the reviewer gate, add a ref input

The agent deploys with --skip-promotion, so a deploy lands dormant and nothing
goes live until DASHBOARD_AGENT_VERSION is flipped. The per-environment reviewer
gate therefore bought nothing but a pile-up: every agent-path merge queued a
staging+prod deploy that sat pending on an approval nobody granted, and
cancel-in-progress: false made each new push cancel the previously-pending leg.
In practice the agent only ever deployed via a manual dispatch + approval.

Drop the environment gate so pushes deploy dormant versions unattended, flip
cancel-in-progress to true so a newer push supersedes an in-flight deploy instead
of stacking, and add a workflow_dispatch ref input to deploy a specific commit,
branch, or tag when needed.

The deploy token moves from the two environment secrets to a repo/org secret of
the same name (TRIGGER_DASHBOARD_AGENT_DEPLOY_TOKEN), since dropping environment
means the env-scoped secret no longer resolves.

Author: ericallam

.github/workflows/dashboard-agent-deploy.yml

@@ -3,9 +3,15 @@ name: "🤖 Deploy dashboard agent"
 # Deploys the @internal/dashboard-agent chat.agent to its Trigger.dev project
 # with --skip-promotion, so a deploy never becomes "current" on its own. The
 # consuming app cuts over by pinning DASHBOARD_AGENT_VERSION to the new version.
-# Runs a leg per environment (staging + prod), each gated by its own environment;
-# a push to main that touches the agent or its store triggers both. Version
-# numbers are per-environment, so pin each environment to its own leg's version.
+# Runs a leg per environment (staging + prod); a push to main that touches the
+# agent or its store deploys both. Version numbers are per-environment, so pin
+# each environment to its own leg's version.
+#
+# The deploy lands dormant, so it doesn't need a reviewer gate: nothing goes live
+# until DASHBOARD_AGENT_VERSION is flipped. The `environment:` below is kept only
+# to scope the deploy token per environment; its required-reviewers rule is
+# removed in repo settings so pushes deploy unattended. workflow_dispatch takes an
+# optional ref (SHA, branch, or tag) to deploy a specific commit instead of head.
 
 on:
   push:
@@ -14,6 +20,11 @@ on:
       - "internal-packages/dashboard-agent/**"
       - "internal-packages/dashboard-agent-db/**"
   workflow_dispatch:
+    inputs:
+      ref:
+        description: "Commit SHA, branch, or tag to deploy. Defaults to the ref the workflow runs from."
+        required: false
+        type: string
 
 permissions: {}
 
@@ -27,11 +38,14 @@ jobs:
       max-parallel: 1
       matrix:
         environment: [staging, prod]
-    # Per-environment reviewer gate + source of the scoped deploy PAT.
+    # Kept to scope the deploy token per environment. The required-reviewers rule
+    # on these environments is removed in repo settings, so this no longer gates.
     environment: dashboard-agent-${{ matrix.environment }}
     concurrency:
+      # Latest deploy per environment wins; supersede an in-flight one rather
+      # than queueing behind it.
       group: dashboard-agent-deploy-${{ matrix.environment }}
-      cancel-in-progress: false
+      cancel-in-progress: true
     permissions:
       contents: read
     env:
@@ -41,6 +55,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          # push: the pushed commit. workflow_dispatch: the input ref if given,
+          # otherwise the head of the ref the run was launched from.
+          ref: ${{ github.event.inputs.ref || github.sha }}
           persist-credentials: false
 
       - name: Setup pnpm