ci(sb2): restore the single Coolify webhook redeploy

Reverts the workflow part of f82a4f9. The step-level env was visible to the
step's if after all (the webhook fired on 40de5bc), and development
deploys use the same COOLIFY_WEBHOOK, so the per-branch secret only made
development skip its redeploy. The STUDIO_IMAGE_TAG pin is dropped too: the
CI webhook redeploy already pulls the image it just pushed.

Author: zbcoding

.github/workflows/build-studio-image.yml

@@ -29,11 +29,6 @@ env:
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
-    env:
-      # Job-level, not step-level: a step's own `env` is not visible to its `if`.
-      # Each branch redeploys its own Coolify application, so a development
-      # push can never redeploy production.
-      COOLIFY_WEBHOOK: ${{ github.ref_name == 'master' && secrets.COOLIFY_WEBHOOK || github.ref_name == 'development' && secrets.COOLIFY_WEBHOOK_DEVELOPMENT || '' }}
     steps:
       - uses: actions/checkout@v4
 
@@ -60,33 +55,12 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-      # A missing secret would otherwise skip the redeploy without a trace.
-      - name: Warn when no Coolify webhook is set for this branch
-        if: success() && env.COOLIFY_WEBHOOK == '' && (github.ref_name == 'master' || github.ref_name == 'development')
-        run: |
-          echo "::warning title=Coolify redeploy skipped::Repository secret ${{ github.ref_name == 'master' && 'COOLIFY_WEBHOOK' || 'COOLIFY_WEBHOOK_DEVELOPMENT' }} is not set, so Coolify was not redeployed with this image."
-
-      # Pin the Coolify app to the image this run just built, then redeploy.
-      # A moving tag (:latest / :development) lets a redeploy pull a Studio
-      # built from a different commit than the compose file and agent it runs
-      # beside. Requires a STUDIO_IMAGE_TAG variable to exist on the Coolify
-      # application (the API only updates existing variables).
       - name: Trigger Coolify redeploy
         if: success() && env.COOLIFY_WEBHOOK != ''
         env:
+          COOLIFY_WEBHOOK: ${{ secrets.COOLIFY_WEBHOOK }}
           COOLIFY_TOKEN: ${{ secrets.COOLIFY_TOKEN }}
         run: |
-          # The deploy webhook is <coolify>/api/v1/deploy?uuid=<app-uuid>[&...].
-          COOLIFY_API="${COOLIFY_WEBHOOK%%/api/v1/*}/api/v1"
-          APP_UUID=$(printf '%s' "$COOLIFY_WEBHOOK" | sed -n 's/.*[?&]uuid=\([^&]*\).*/\1/p')
-          if [ -z "$APP_UUID" ]; then
-            echo "COOLIFY_WEBHOOK has no uuid= parameter: expected <coolify>/api/v1/deploy?uuid=<app-uuid>" >&2
-            exit 1
-          fi
-          curl --fail-with-body -X PATCH "$COOLIFY_API/applications/$APP_UUID/envs" \
-            -H "Authorization: Bearer $COOLIFY_TOKEN" \
-            -H "Content-Type: application/json" \
-            -d "{\"key\":\"STUDIO_IMAGE_TAG\",\"value\":\"${{ github.sha }}\"}"
           curl --fail-with-body -X GET "$COOLIFY_WEBHOOK" \
             -H "Authorization: Bearer $COOLIFY_TOKEN"
 

docker/superbase2/.env.coolify

@@ -85,12 +85,10 @@ SITE_URL=https://app.yourdomain.com
 
 # ── Optional overrides (safe defaults exist — only set if needed) ────────────
 
-# Which pre-built Studio image to run. Leave unset to follow the moving tag
-# (master publishes :latest). When the GitHub workflow redeploys this app
-# (COOLIFY_WEBHOOK secret), it sets this to the commit SHA it just built so
-# Studio always matches the deployed compose file — create the variable here
-# (any value) for that to work, since Coolify's API only updates existing ones.
-# STUDIO_IMAGE_TAG=latest
+# Which pre-built Studio image to run. master publishes :latest, the
+# development branch publishes :development. Leave unset for latest; set it
+# to development on a test deployment so it tracks that branch instead.
+# STUDIO_IMAGE_TAG=development
 
 # App-layer basic-auth (defense-in-depth, on top of Kong). Enabled by default
 # in the compose. Set to false only if you must disable the in-app credential

docker/superbase2/README.md

@@ -165,7 +165,7 @@ Coolify expects a single compose file — it does not support the multi-file `-f
 
 10. Deploy — Coolify pulls the pre-built Studio image from ghcr.io (fast, no build step).
 
-11. (Optional) **Redeploy from CI.** `.github/workflows/build-studio-image.yml` builds the Studio image on pushes to `master` and `development` and can redeploy Coolify afterwards. Add GitHub secrets `COOLIFY_WEBHOOK` (master's app) and/or `COOLIFY_WEBHOOK_DEVELOPMENT` (a separate test app), plus `COOLIFY_TOKEN` (a Coolify API token with deploy and write access). Also create a `STUDIO_IMAGE_TAG` variable on each Coolify app: the workflow sets it to the commit SHA it just built before redeploying, so Studio always matches the compose file and agent deployed next to it.
+11. (Optional) **Redeploy from CI.** `.github/workflows/build-studio-image.yml` builds the Studio image on pushes to `master` (`:latest`) and `development` (`:development`) that touch Studio, then calls the Coolify deploy webhook. Add GitHub secrets `COOLIFY_WEBHOOK` (the app's deploy webhook URL) and `COOLIFY_TOKEN` (a Coolify API token with deploy access). With auto-deploy on, a push deploys twice: Coolify deploys the compose and agent right away with the previous Studio image, then the webhook redeploys once CI has pushed the new one.
 
 ### What happens on first boot