Add internal cloud image release workflow [skip ci]

Adds a manual-only internal ECR image release path and makes Sentry optional only when explicitly disabled by that caller. Existing production callers retain strict Sentry requirements.

Author: msukkari

.github/workflows/_build-cloud.yml

@@ -22,6 +22,11 @@ on:
         required: false
         type: string
         default: us-west-1
+      require_sentry:
+        description: "Require complete Sentry build configuration and source-map upload credentials"
+        required: false
+        type: boolean
+        default: true
 
 jobs:
   build:
@@ -58,13 +63,14 @@ jobs:
           SENTRY_ORG: ${{ vars.SENTRY_ORG }}
           SENTRY_WEBAPP_PROJECT: ${{ vars.SENTRY_WEBAPP_PROJECT }}
           SENTRY_BACKEND_PROJECT: ${{ vars.SENTRY_BACKEND_PROJECT }}
+          REQUIRE_SENTRY: ${{ inputs.require_sentry }}
         run: |
           missing=0
-          for name in SENTRY_AUTH_TOKEN AWS_ECR_ROLE_ARN \
-                      NEXT_PUBLIC_SENTRY_ENVIRONMENT \
-                      NEXT_PUBLIC_SENTRY_WEBAPP_DSN \
-                      NEXT_PUBLIC_SENTRY_BACKEND_DSN \
-                      SENTRY_ORG SENTRY_WEBAPP_PROJECT SENTRY_BACKEND_PROJECT; do
+          required_names="AWS_ECR_ROLE_ARN"
+          if [ "$REQUIRE_SENTRY" = "true" ]; then
+            required_names="$required_names SENTRY_AUTH_TOKEN NEXT_PUBLIC_SENTRY_ENVIRONMENT NEXT_PUBLIC_SENTRY_WEBAPP_DSN NEXT_PUBLIC_SENTRY_BACKEND_DSN SENTRY_ORG SENTRY_WEBAPP_PROJECT SENTRY_BACKEND_PROJECT"
+          fi
+          for name in $required_names; do
             if [ -z "${!name}" ]; then
               echo "::error::${name} is not set on the '${ENVIRONMENT}' environment (or the repository)."
               missing=1
@@ -73,9 +79,12 @@ jobs:
             fi
           done
           if [ "$missing" -ne 0 ]; then
-            echo "::error::Refusing to build: the image would ship without Sentry wiring."
+            echo "::error::Refusing to build: required environment configuration is missing."
             exit 1
           fi
+          if [ "$REQUIRE_SENTRY" != "true" ]; then
+            echo "Sentry wiring is intentionally disabled for the isolated internal demo image."
+          fi
 
       - name: Check Prisma migrations
         uses: ./.github/actions/check-prisma-migrations
@@ -128,8 +137,7 @@ jobs:
             SENTRY_RELEASE=${{ steps.commit.outputs.sha }}
           # Passed as a secret, not a build-arg: build args are recorded in layer
           # metadata that `mode=max` exports to the cache. @see: Dockerfile
-          secrets: |
-            sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}
+          secrets: ${{ inputs.require_sentry && format('sentry_auth_token={0}', secrets.SENTRY_AUTH_TOKEN) || '' }}
           # Cache scope is per-environment, and distinct from the OSS build's
           # (which is keyed on platform alone). Sharing a scope would let a build
           # that never sees SENTRY_AUTH_TOKEN restore layers from one that did.
@@ -141,15 +149,20 @@ jobs:
           ENVIRONMENT: ${{ inputs.environment }}
           COMMIT_SHA: ${{ steps.commit.outputs.sha }}
           TAGS: ${{ steps.meta.outputs.tags }}
+          REQUIRE_SENTRY: ${{ inputs.require_sentry }}
         run: |
+          sentry_summary="disabled"
+          if [ "$REQUIRE_SENTRY" = "true" ]; then
+            sentry_summary="$COMMIT_SHA"
+          fi
           {
             echo "### Pushed to ECR"
             echo
             echo "| | |"
             echo "|---|---|"
             echo "| Environment | \`${ENVIRONMENT}\` |"
             echo "| Commit | \`${COMMIT_SHA}\` |"
-            echo "| Sentry release | \`${COMMIT_SHA}\` |"
+            echo "| Sentry | \`${sentry_summary}\` |"
             echo
             echo '```'
             echo "$TAGS"

.github/workflows/releaseCloudInternal.yml

@@ -0,0 +1,25 @@
+name: Release Sourcebot (Cloud - Internal Demo)
+
+permissions:
+  contents: read
+  id-token: write
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: release-cloud-internal
+  cancel-in-progress: false
+
+jobs:
+  build:
+    uses: ./.github/workflows/_build-cloud.yml
+    with:
+      environment: internal
+      # Pin the checkout and image tags to the same dispatch commit so metadata
+      # can never identify image contents as a different revision.
+      git_ref: ${{ github.sha }}
+      require_sentry: false
+      docker_tags: |
+        type=raw,value=main
+        type=raw,value=sha-${{ github.sha }}

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- Added a manually triggered cloud image release workflow for isolated internal deployments. [#1566](https://github.com/sourcebot-dev/sourcebot/pull/1566)
+
 ## [5.1.6] - 2026-08-10
 
 ### Added