[nbouliol]

The BFF's publish workflow ends at the registry. The deploy on the server side can therefore only be
started by hand, which is not how the workflow-executor works: it dispatches into
forestadmin-server, whose deploy-workflow-executor.yml deploys production on the event.

This adds the same last step for the BFF, so a release reaches production the same way.

What it does

A notify-server job after merge sends a repository_dispatch to ForestAdmin/forestadmin-server:

{ "event_type": "agent-bff-published", "client_payload": { "version": "1.33.0" } }

Gating

On is_latest, which the merge job already decides against the release tags as they stand when the
manifest is written — the same reading that decides whether :latest moves. A prerelease, or a
rebuild of a version that is no longer the newest stable, must not deploy over production.

That value only existed inside the job, unlike the executor's workflow where it is an
extract-version output, so this exposes it as a merge job output rather than recomputing it.

Notes

• GITHUB_TOKEN cannot dispatch into another repository, so this uses SERVER_DEPLOY_DISPATCH_TOKEN
  — the same secret the executor's job uses, a fine-grained PAT or GitHub App with Contents:write on
  forestadmin-server. It is already configured for the executor.
• An unset token fails the job rather than passing quietly: a release that stops short of deploying,
  with nothing to show for it, is exactly the failure worth catching.

Paired with

ForestAdmin/forestadmin-server#8514, which adds the receiving deploy-agent-bff.yml. Until both are
merged, the BFF deploy stays manual — this PR alone dispatches an event nothing listens to yet, which
is harmless.

🤖 Generated with Claude Code

Note

Add notify-server job to docker-publish-bff workflow for stable releases

• The merge job now exposes an is_latest output derived from the existing recheck step, so downstream jobs know whether the published manifest is the latest stable release.
• A new notify-server job runs on non-PR workflows when is_latest is true, validates that SERVER_DEPLOY_DISPATCH_TOKEN is present, and POSTs a repository_dispatch event (agent-bff-published) to ForestAdmin/forestadmin-server with the full version in client_payload.version.
• Risk: notify-server fails the workflow if SERVER_DEPLOY_DISPATCH_TOKEN is missing or the GitHub API dispatch request fails.

^{Macroscope summarized 5057646.}

[qltysh]

Coverage Impact

This PR will not change total coverage.

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.