Deploy Cloud Run only after CI passes on main push. (#134)

Trigger deploy via workflow_run instead of parallel push, so main
only publishes when unit tests succeed. Manual workflow_dispatch unchanged.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Pigbibi

.github/workflows/sync-cloud-run-env.yml

@@ -1,8 +1,10 @@
 name: Deploy Cloud Run
 
 on:
-  push:
-    branches: [ main ]
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [main]
   workflow_dispatch:
 
 env:
@@ -22,9 +24,17 @@ concurrency:
 jobs:
   deploy-cloud-run:
     name: Deploy Cloud Run
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      (
+        github.event_name == 'workflow_run' &&
+        github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.event == 'push'
+      )
     runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions:
+      actions: read
       contents: read
       id-token: write
     env:
@@ -169,6 +179,8 @@ jobs:
       - name: Checkout repository
         if: steps.deploy_config.outputs.enabled == 'true'
         uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
 
       - name: Validate deploy inputs
         if: steps.deploy_config.outputs.enabled == 'true'