fix(prod-build): remove ref_protected requirement, add tag input (#639)

* fix(prod-build): remove ref_type/protected requirement

It appears `ref_protected` is only true if tag creation
is protected, which prevents github-actions from tagging.

* chore(prod-build): add tag input

Allows building a tag with the current workflow,
as triggering the workflow on the tag would run
the workflow with the ref_protected issue.

* chore(build): validate tag name

Author: caugner

.github/workflows/_build.yml

@@ -38,6 +38,17 @@ jobs:
       id-token: write
 
     steps:
+      - name: Validate tag format
+        if: inputs.tag
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "❌ Invalid tag: $TAG does not match format vX.Y.Z (e.g., v1.2.3)"
+            exit 1
+          fi
+          echo "✅ Valid tag: $TAG"
+
       - name: Checkout
         uses: actions/checkout@v4
         with:

.github/workflows/prod-build.yml

@@ -6,6 +6,10 @@ on:
       - "v*"
 
   workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to build (e.g. v1.13.0)"
+        required: true
 
 permissions:
   # Read/write GHA cache.
@@ -17,10 +21,10 @@ permissions:
 
 jobs:
   build:
-    if: github.repository_owner == 'mdn' && github.ref_type == 'tag' && github.ref_protected
+    if: github.repository_owner == 'mdn'
     uses: ./.github/workflows/_build.yml
     secrets: inherit
     with:
       environment: prod
-      ref: ${{ github.ref }}
-      tag: ${{ github.ref_name }}
+      ref: ${{ inputs.tag || github.ref }}
+      tag: ${{ inputs.tag || github.ref_name }}