Feature/ci azure improvements

[fmercadop]

What & why

Ports a set of CI/CD improvements that already exist in the equivalent Azure DevOps pipeline for this project into our two GitHub Actions workflows. Keeps our existing two-stage model (PR build → deploy) — the Azure QA/release middle tier is intentionally not ported.

Changes

pull_request_build.yml (PR build stage)

• Branch validation gate — new validate-branch job: source must start with feature/ or infra/; feature/* may target main or another feature/*, while infra/* may target only main; the source must not be behind main; and infra/* branches may not modify transform/. (Ports Azure's branch_validator.py + infra guard.)
• Change detection — new detect-changes job skips the dbt job when nothing under transform/ or automate/dbt/ changed; still runs on workflow_dispatch.
• Clone unchanged incremental/snapshot models from prod before the slim build, to speed up PR builds.
• Container image bump 3.3 → 5.0.

push-to-main.yml (deploy stage)

• [deploy:full-refresh] marker in the merge commit → appends --full-refresh to both blue/green commands.
• Deployment version bump + git tag (YYYYMMDD.N.0), committed with [skip ci] and pushed to main. Gated to if: github.event_name == 'push' to avoid double-bumping on merge and to avoid firing on unmerged-PR-close or manual dispatch. Job granted permissions: contents: write.
• Drop blue/green staging DB on failure as a safety net.
• Container image bumps — build 3.3 → 5.0, drop-pr-db-on-close 3.2 → 5.0 (previously inconsistent).

⚠️ Required before this works in CI

1. Branch protection on main must allow the Actions bot to push directly — otherwise the version-bump/tag push fails.
2. Repo "Workflow permissions" (Settings → Actions → General) must not override the job-level contents: write.

[noel]

have claude use balboa repo to validate things
you also need to know what all this stuff is doing. not just asking claude to do stuff.

[noel]

I dont think we need both versions * and **
look at this and ask claude
https://github.com/datacoves/balboa/blob/main/.github/workflows/10_feature_dbt_checks.yml#L8

[fmercadop]

It mirrors the existing transform/* + transform/**/* style already in this file so the new paths matched the established convention. But you're right that it's redundant: automate/dbt/** already covers both direct and nested files, so I'll collapse it to a single line.

[noel]

I dont know what this is for

[fmercadop]

Those two lines just make sure the "what changed?" check is accurate.

fetch-depth: 0 → pull the full git history. The default checkout only grabs the latest commit, and git diff against main needs the shared history to work correctly.
ref: ...head.sha → check out the actual PR branch. By default, on PRs GitHub checks out a temporary "PR merged into main" commit, which would make the diff show main's files too. This points it at the real PR commit so we only see what the PR actually changed.

[noel]

Are we checking branch names?

[fmercadop]

yes, I implemented the feature/* and infra/* branch names. feature can merge into feature or main, and infra can merge only to main. Following what we have in Sevita.