ci: support workflow_dispatch, pin step versions, drop push retries

[levivannoort]

Summary

• Fall back to github.sha for the production image tag (${{ github.event.release.tag_name || github.sha }}) so manual workflow_dispatch runs — which carry no release payload — still produce a valid tag. Staging already used github.sha, so it's unchanged.
• Tighten the deploy workflows' action pins to exact-semver comments matching the ci.yml/publish.yml convention (checkout v6.0.3, login-action v3.7.0, build-push-action v6.19.2, create-github-app-token v2.2.2). SHAs are unchanged — only the comments are now precise.
• Remove the 5-attempt push/rebase retry loop in both deploy workflows. The shared concurrency.group: declarative-deploy (cancel-in-progress: false) already serializes deploys, making the retry redundant; a rejected push now fails fast.

Notes

Affects staging.yml and production.yml only. Both validate as YAML.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR improves the GitHub Actions CI workflows for staging and production deployments with three targeted changes. All modifications are confined to .github/workflows/production.yml and staging.yml.

• TAG fallback for workflow_dispatch: Production's TAG env var now uses ${{ github.event.release.tag_name || github.sha }}, so manual dispatches (which carry no release payload) produce a valid SHA-based tag instead of an empty string that would cause image tagging to silently fail.
• Precise version comments: Action pin comments are updated from coarse labels (v6, v3, v6, v2) to exact semver (v6.0.3, v3.7.0, v6.19.2, v2.2.2); the SHA pins are unchanged, so the actual code executed is unaffected.
• Retry loop removal: The 5-attempt push/rebase loop in both deploy jobs is replaced with a single git push. The shared concurrency.group: declarative-deploy with cancel-in-progress: false already ensures only one deploy job runs at a time across both workflows, eliminating push conflicts and making fail-fast the correct behavior.

Confidence Score: 5/5

Both files are safe to merge; changes are additive CI improvements with no runtime code affected.

The TAG fallback correctly handles the empty-string case that would break manual dispatch runs, the SHA pins are untouched so actual action behavior is identical, and the retry removal is properly justified by the shared deploy concurrency group that already prevents concurrent pushes from these workflows.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/production.yml	Adds workflow_dispatch support via SHA fallback for TAG, tightens action version comments to exact semver, and removes the 5-attempt retry loop in the deploy job.
.github/workflows/staging.yml	Mirrors production changes: action version comments tightened to exact semver and the 5-attempt push retry loop removed; TAG was already github.sha so no functional tag change.

_{Reviews (1): Last reviewed commit: "ci: support workflow_dispatch, pin step ..." | Re-trigger Greptile}