workflow_dispatch inputs, for the deploy you run by hand

A manually triggered workflow with typed inputs replaces a shell script that lives on one person’s laptop.

on:
  workflow_dispatch:
    inputs:
      digest:
        description: 'Image digest to release'
        required: true
      environment:
        type: choice
        options: [staging, production]
      dry-run:
        type: boolean
        default: true

# gh workflow run release.yml -f digest=sha256:... 
#   -f environment=production -f dry-run=false

Defaulting the destructive flag to the safe value is the detail that matters, because the form is filled in by somebody in a hurry. The typed choice removes a class of typo that a free-text environment name allows, and the whole invocation is recorded in the run history — which turns “who deployed this” into a link rather than a question.