fix(ci): add frontend P2 digest promotion controls

[yashkrishan]

Summary

• capture image digests in staging/prod/pr/upload workflows and deploy Cloud Run services by immutable digest references
• add prod promotion input support for digest-based deployment without rebuilds
• grant id-token: write to PR cleanup job for OIDC auth parity

Test plan

• Trigger staging deploy and verify deploy image is repo@sha256:*
• Trigger prod deploy with digest input and verify no rebuild path executes
• Trigger PR open/close workflow and verify cleanup auth succeeds with OIDC

Made with Cursor

[coderabbitai]

Warning

Rate limit exceeded

@yashkrishan has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 49 minutes and 58 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8eca493a-d676-4f4a-87cf-f2fe126ef5df

📥 Commits

Reviewing files that changed from the base of the PR and between 56321d3 and 69cd68d.

📒 Files selected for processing (4)

• .github/workflows/deploy-prod.yaml
• .github/workflows/deploy-staging.yaml
• .github/workflows/pr-cloud-run.yaml
• .github/workflows/upload-image.yaml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch clean/frontend-ci-p2-main-direct

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Review rate limit: 0/1 reviews remaining, refill in 49 minutes and 58 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[yashkrishan]

CI/CD hardening update:

• PR preview failure was caused by a missing Artifact Registry repository before digest capture/promotion steps could run.
• Added repository creation guard and explicit project scoping for Cloud Run describe/delete paths.
• Digest promotion implementation remains scoped to this PR: staging/prod/pr/upload workflows capture digests and deploy immutable refs.