Verify image was published before dispatching to consumers

A manual workflow_dispatch can be run against any ref at any time,
including a feature branch commit whose Main build hasn't finished
publishing an image yet. Query the Actions API for the most recent
completed Main run at that commit and fail loudly if it didn't
succeed, before notifying any consumer.

Author: TonyCTHsu

.github/workflows/notify-consumers.yml

@@ -29,6 +29,8 @@ jobs:
   determine-inputs:
     name: "Determine trigger inputs"
     runs-on: ubuntu-24.04
+    permissions:
+      actions: read
     if: >-
       github.event_name == 'workflow_dispatch' ||
       (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main')
@@ -49,6 +51,20 @@ jobs:
           fi
           echo "run_url=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" >> "$GITHUB_OUTPUT"
 
+      # A manual dispatch can be run against any ref at any time, including
+      # before Main has built and published an image for that commit.
+      - name: Verify image was published for this commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+          COMMIT: ${{ steps.inputs.outputs.commit }}
+        run: |
+          conclusion=$(gh api "repos/${{ github.repository }}/actions/runs?head_sha=$COMMIT&status=completed" \
+            --jq '[.workflow_runs[] | select(.name == "Main")] | sort_by(.run_started_at) | last | .conclusion // "none"')
+          if [ "$conclusion" != "success" ]; then
+            echo "::error::No successful Main run found for commit $COMMIT (found: $conclusion). The image for this commit may not be published yet."
+            exit 1
+          fi
+
   notify:
     name: "Notify ${{ matrix.repo }}"
     needs: determine-inputs