DEVEX-1653: re-land rt_mode with transitive-skip fix

[pdodgen-revparts]

Re-lands #137 (reverted in #140) with the fix for the transitive-skip cascade in tag-and-release.

What broke

#137 added rt_mode support to the shared build-php-v1 orchestrator. Immediately after merging #137 and Batch 1 Phase 3 PRs (license_api, internal_api, rp_api, catalog_api, vin_decoder_service), all four main-builds that reached integration-deploy FAILED at helm apply with:

Error: UPGRADE FAILED: YAML parse error on <chart>/templates/deployment.yaml: mapping values are not allowed in this context

Because image_tag was empty, helm rendered image: ghcr.io/encodium/<repo>: with nothing after the colon → malformed YAML.

Root cause

tag-and-release was silently SKIPPED on all main-path runs, even though its condition if: !inputs.rt_mode and build itself both evaluate correctly.

The mechanism: tag-and-release has needs: [build]. build in turn has needs: [calculate-tag, compute-rt-tag]. On the main-path, compute-rt-tag is skipped (it's the rt-path branch). GitHub Actions' default success() gate on any job-if propagates the transitive skipped state through the needs chain — so tag-and-release inherits "one of my transitive needs was skipped, so I skip too" behavior even though its own direct need (build) succeeded.

The parallel non-needs job (calculate-tag) is unaffected because it has no transitive skipped ancestors.

Fix

Add !cancelled() to tag-and-release's condition:

tag-and-release:
  if: \${{ !cancelled() && !inputs.rt_mode }}

!cancelled() explicitly overrides the implicit success() gate, restoring intended semantics: run whenever the workflow wasn't cancelled AND we're on the non-rt path. Well-known idiom for this exact class of transitive-skip bug.

Test plan

Post-merge, canary against license_api by pushing an empty commit to main (or letting the next merge fire). Expected: Build.yaml runs cleanly, tag-and-release actually fires this time, emits a clean vX.Y.Z tag, integration-deploy consumes it, helm apply succeeds.

Only after canary passes do we resume merging the remaining 10 Phase 3 PRs (Batches 3/4).

Refs DEVEX-1653, #137 (original), #140 (revert).

[cursor]

PR Summary

Medium Risk
Changes shared PHP build/release orchestration; a regression would again break image tags and integration deploys across many services.

Overview
Re-introduces rt_mode on the shared build-php-v1 workflow so release-train builds can tag via encodium/actions _compute-rt-tag up front while the normal path still uses mathieudutour dry-run → build → tag-and-release.

On the non-rt path, tag-and-release now uses if: !cancelled() && !inputs.rt_mode so it is not transitively skipped when build depends on both calculate-tag and compute-rt-tag (one branch is always skipped). Without that gate, tag-and-release was skipped on main builds, the workflow tag output was empty, and downstream deploys failed on malformed image: tags.

build is wired to run when either tag job succeeds, and image tags pick calculate-tag or compute-rt-tag output via ||; workflow outputs.tag falls back to the rt job when the tail release job does not run.

^{Reviewed by Cursor Bugbot for commit c26ef1b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c26ef1b. Configure here.}

[cursor]

Release job ignores build result

Medium Severity

The new tag-and-release if uses !cancelled(), which disables GitHub Actions’ implicit success() gate on needs, but it never checks needs.build.result. After a failed or skipped build, the job can still run and push a tag or create a release without successful images.

 

^{Reviewed by Cursor Bugbot for commit c26ef1b. Configure here.}