ci: Pass the resolved build run ID to the release trigger

[mimartin12]

Tracking

https://bitwarden.atlassian.net/browse/SHOT-250. Follow-up to the 2.2.0 release that published nothing on 2026-08-10.

Objective

The release job triggers deploy's release-helm-charts with no payload, so deploy picks the chart package itself using "newest successful self-host.yml build on main". On 2026-08-10 GitHub served that listing stale and returned a June 23 run holding self-host 2.0.1. cr upload skipped it as already released, cr index reported no change, and every job went green. 2.2.0 is on main but was never published.

wait-for-build already resolves the run that packaged the bumped version, then throws the ID away. This passes it through so deploy publishes that exact artifact.

Four lines: a job output, an id on the existing step, one $GITHUB_OUTPUT write, and the data: payload.

Two things to know:

1. Deploy needs a matching build_run_id input before this merges. workflow_dispatch rejects inputs it doesn't declare, so the trigger would fail outright.
2. Matrix legs share one output name and last writer wins, so a PR bumping both charts pins whichever leg finished last. Single-chart bumps, which is every release this year, are correct.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the four-line change to .github/workflows/cd.yml that promotes the wait-for-build job's resolved run ID to a job output and forwards it to deploy's release-helm-charts trigger as a data payload. The run_id= write is the last statement after gh run watch --exit-status, so any path where release runs is guaranteed a non-empty, verified run ID, and the interpolated value is a numeric databaseId with no injection surface inside the single-quoted JSON payload. The two known constraints — deploy must declare the matching build_run_id input before this merges, and matrix job outputs are last-writer-wins for a dual-chart bump — are explicitly documented and accepted in the PR description, so they are not raised as findings.

Code Review Details

No blocking findings.