fix(ci): refresh-amis must dispatch the publisher, not rely on its push

[defangdevs]

Commits pushed with GITHUB_TOKEN do not trigger workflows, so refresh-amis.yml's push never fired publish-template.yml — which watches pushes touching aws/template.yaml. The refreshed AMI map landed on master and never reached the S3 template the 1-click Launch buttons serve.

This has already happened. 5542d8f (2026-07-06) is the only AMI bump that has ever landed, and there is no publish-template run for it: 60 runs going back to 2026-07-04, 55 push-triggered and 5 workflow_dispatch, none carrying that SHA. aws-ci.yml never validated it either. Every 1-click launch since has been served a template whose AMI map was published by an unrelated merge rather than by the job that changed it.

The four subsequent refreshes (13/20/27 Jul, 3 Aug) each finished in ~10s with "No AMI changes", so nothing has re-triggered the publisher in the meantime.

The fix

Dispatch the publisher explicitly after a successful push, gated on a step output so a no-change run stays a no-op. Requires actions: write.

Why not a PAT / GitHub App

Pushing under a PAT or App would make the push itself trigger downstream workflows, and would additionally give the AMI bump a review gate — which is attractive, since aws/template.yaml defines the public launch path and is currently the one file that reaches production without review.

Rejected for now: it re-enables workflow cascades for every job sharing that identity, and this job's output is a generated map with no judgement in it. It is also the reason the bot-actor guard in #172's agent-pr.yml matters — the moment an elevated identity exists in this repo, that guard stops being redundant. Keeping the two concerns separate is deliberate: this PR changes no identity, so #172 can merge independently in either order.

Worth revisiting if the AMI bump ever needs review.

Checks run

• File validated as parsing, with permissions, the new step id, and the if: gate confirmed to resolve as intended.
• publish-template.yml already has workflow_dispatch:, so it is dispatchable; it also runs cfn-lint aws/template.yaml before uploading, so the dispatched run validates the map it is about to publish.
• The loop itself cannot be verified until this is on master and an AMI bump actually lands. To force it: workflow_dispatch on Refresh NixOS AMIs once a new AMI is available, then confirm a publish-template run appears for the resulting commit.

No AWS cost, IAM, or networking impact.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PsqGhkpjsb4kKAdVz25xKN