fix workspace deployment license and source selection

Author: OTime-Coder

.github/workflows/push.yml

@@ -4,9 +4,9 @@ on:
   workflow_dispatch:
     inputs:
       release_tag:
-        description: Existing stable Workspace release tag in vX.Y.Z form
+        description: Optional existing stable Workspace release tag in vX.Y.Z form
         type: string
-        required: true
+        required: false
 
       environment:
         description: 'Environment to run deploy'
@@ -38,6 +38,8 @@ jobs:
     name: BuildDockerImage
     runs-on: ${{ inputs.runner-name == 'github-runner' && 'ubuntu-latest' || inputs.runner-name }}
     environment: ${{ inputs.environment }}
+    outputs:
+      image_tag: ${{ steps.release.outputs.image_tag }}
     env:
       GH_ACCESS_TOKEN: ${{ secrets.GH_TOKEN }}
       CR: univer-acr-registry.cn-shenzhen.cr.aliyuncs.com
@@ -49,29 +51,35 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-          ref: refs/tags/${{ inputs.release_tag }}
+          ref: ${{ inputs.release_tag == '' && github.sha || format('refs/tags/{0}', inputs.release_tag) }}
 
-      - name: Validate release tag
+      - name: Resolve deployment source
         id: release
         shell: bash
         env:
           BASE_BRANCH: ${{ github.event.repository.default_branch }}
+          DISPATCH_SHA: ${{ github.sha }}
           RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
           set -euo pipefail
-          if [[ ! "$RELEASE_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
-            echo "release_tag must use stable vX.Y.Z form" >&2
-            exit 1
-          fi
-          if [[ "$(git rev-parse "refs/tags/$RELEASE_TAG^{commit}")" != "$(git rev-parse HEAD)" ]]; then
-            echo "Checkout does not match release tag $RELEASE_TAG" >&2
-            exit 1
-          fi
-          if ! git merge-base --is-ancestor HEAD "refs/remotes/origin/$BASE_BRANCH"; then
-            echo "Release tag commit must be contained in origin/$BASE_BRANCH" >&2
-            exit 1
+          if [[ -n "$RELEASE_TAG" ]]; then
+            if [[ ! "$RELEASE_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+              echo "release_tag must use stable vX.Y.Z form" >&2
+              exit 1
+            fi
+            if [[ "$(git rev-parse "refs/tags/$RELEASE_TAG^{commit}")" != "$(git rev-parse HEAD)" ]]; then
+              echo "Checkout does not match release tag $RELEASE_TAG" >&2
+              exit 1
+            fi
+            if ! git merge-base --is-ancestor HEAD "refs/remotes/origin/$BASE_BRANCH"; then
+              echo "Release tag commit must be contained in origin/$BASE_BRANCH" >&2
+              exit 1
+            fi
+            IMAGE_TAG="$RELEASE_TAG"
+          else
+            IMAGE_TAG="sha-$DISPATCH_SHA"
           fi
-          echo "image_tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
+          echo "image_tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT"
 
       - uses: ./.github/actions/setup
         id: setup
@@ -82,6 +90,7 @@ jobs:
       - name: Build and Push Image
         env:
           IMAGE_TAG: ${{ steps.release.outputs.image_tag }}
+          UNIVER_WORKSPACE_BROWSER_LICENSE: ${{ secrets.UNIVER_WORKSPACE_BROWSER_LICENSE }}
         run: |
           make push_image "IMAGE_TAG=$IMAGE_TAG" "CR=$CR"
 
@@ -92,12 +101,8 @@ jobs:
     environment: ${{ inputs.environment }}
     env:
       CR: univer-acr-registry.cn-shenzhen.cr.aliyuncs.com
+      IMAGE_TAG: ${{ needs.build-docker-image.outputs.image_tag }}
     steps:
-      - name: Set IMAGE_TAG environment variable
-        env:
-          RELEASE_TAG: ${{ inputs.release_tag }}
-        run: echo "IMAGE_TAG=$RELEASE_TAG" >> "$GITHUB_ENV"
-
       - name: Set FEATURE environment variable
         if: ${{ startsWith(inputs.environment, 'feature') }}
         run: echo "FEATURE=$(echo ${GITHUB_REF#refs/heads/feat/})" >> "$GITHUB_ENV"

AGENTS.md

@@ -89,8 +89,9 @@ pnpm update:sdk --sdk_version <exact-sdk-version>
   发布前必须检查整个 workspace 的单一 SDK baseline；`dev` 明确跳过该检查。
 - CLI package artifact 必须只包含运行所需代码、资源和版本匹配的 Skills，不得依赖当前 checkout。
 - `packages/reference-provider` 不增加独立发布、版本或外部 consumer 合同。
-- 稳定 `vX.Y.Z` tag 是 CLI release 与 Workspace deployment 共享的不可变源码坐标；tag push 只发布
-  CLI，部署 workflow 只手动部署所选 tag。Docker image 和 CLI artifact 的交付时机与执行流程仍然独立。
+- 稳定 `vX.Y.Z` tag 在被选择时是 CLI release 与 Workspace deployment 共享的不可变源码坐标；tag push
+  只发布 CLI。部署 workflow 也可以不选 tag，改为手动部署 workflow dispatch 的精确 commit，并使用
+  `sha-<commit>` image tag。Docker image 和 CLI artifact 的交付时机与执行流程仍然独立。
 - 当前 release workflow 只写 insider-npm；公开 npm Promotion 属于独立后续工作，不得加入该 workflow。
 
 ## 文档维护

DREAMNUM.md

@@ -68,10 +68,11 @@
   persisted login session and does not pass a browser cookie, password, or OAuth access token through the agent.
 - OAuth secrets, trusted Bot credentials, registry credentials, production licenses, and deployment credentials are
   environment or build configuration and must not be committed to the repository.
-- Stable `vX.Y.Z` tags are immutable source coordinates shared by the stable CLI release and manually selected
-  Workspace deployments. Tag push publishes only the CLI; deployment remains a separate manual workflow.
-- Production images use the selected release tag and are handed off to the private deployment repository; database
-  migration and rollout ordering remain part of the Workspace application contract.
+- Stable `vX.Y.Z` tags are immutable source coordinates shared by the stable CLI release and Workspace deployments
+  that select a release tag. Tag push publishes only the CLI; deployment remains a separate manual workflow.
+- Workspace images use either the selected release tag or `sha-<commit>` for an untagged workflow dispatch and are
+  handed off to the private deployment repository; database migration and rollout ordering remain part of the
+  Workspace application contract.
 
 ## Update contract
 

Makefile

@@ -6,4 +6,4 @@ IMAGE_TAG ?= latest
 IMAGE_DIR = ./apps/workspace
 
 push_image:
-	@docker build -f $(IMAGE_DIR)/Dockerfile -t $(CR)/$(NS)/$(REPOSITORY):$(IMAGE_TAG) . --push
+	@docker build --build-arg VITE_UNIVER_LICENSE="$${UNIVER_WORKSPACE_BROWSER_LICENSE}" -f $(IMAGE_DIR)/Dockerfile -t $(CR)/$(NS)/$(REPOSITORY):$(IMAGE_TAG) . --push

README.md

@@ -84,10 +84,11 @@ that graph check. All three paths build, verify, install, and smoke-test the act
 tarball before publication. This workflow ends at insider-npm and does not perform a
 Public Registry Promotion.
 
-Workspace deployment is a separate manual workflow. It requires an existing stable
-`vX.Y.Z` release tag, builds that exact commit, pushes an image with the same tag, and
-hands the image to the selected deployment environment. Pushing the tag does not deploy
-the server.
+Workspace deployment is a separate manual workflow. It can build a selected existing
+stable `vX.Y.Z` release tag and use that tag for the image, or, when no release tag is
+provided, build the workflow dispatch commit and tag the image as `sha-<commit>`. It
+hands the resulting image to the selected deployment environment. Pushing a tag does
+not deploy the server.
 
 ## Runtime development license
 

apps/workspace/README.md

@@ -178,10 +178,12 @@ For a V6 rollout, stop every old Workspace instance, start one V6 instance and
 wait for migration and health checks to succeed, then restore normal service;
 do not let V5 and V6 processes write the same SQLite file concurrently.
 
-The manual `Deploy Workspace` workflow requires an existing stable `vX.Y.Z`
-repository tag. It checks out that exact tag, builds and pushes the container image
-with the same tag, and hands it to the selected environment. A tag push does not deploy
-Workspace automatically, and the deployment workflow does not publish the CLI.
+The manual `Deploy Workspace` workflow accepts an optional existing stable `vX.Y.Z`
+repository tag. When provided, it checks out that tag and uses it for the container
+image. When omitted, it builds the workflow dispatch commit and tags the image as
+`sha-<commit>`. It then hands the image to the selected environment. A tag push does
+not deploy Workspace automatically, and the deployment workflow does not publish the
+CLI.
 
 ## Commands
 

apps/workspace/docs/adr/0005-use-one-stable-source-tag-with-independent-delivery.md

@@ -1,5 +1,5 @@
 ---
-status: accepted
+status: superseded by ADR-0006
 ---
 
 # Use one stable source tag with independent delivery

apps/workspace/docs/adr/0006-allow-untagged-workspace-deployments.md

@@ -0,0 +1,13 @@
+---
+status: accepted
+---
+
+# Allow untagged Workspace deployments
+
+The manual Workspace deployment workflow accepts an optional stable `vX.Y.Z` release
+tag. When a tag is provided, the workflow retains the shared release coordinate from
+ADR-0005 and uses that tag for the container image. When it is omitted, the workflow
+builds the exact commit selected by the workflow dispatch and uses `sha-<commit>` as
+the immutable image tag. CLI publication remains tag-driven and independent from
+Workspace deployment. This supersedes ADR-0005 while preserving its tagged release
+behavior as one of the two supported deployment source modes.