feat: per-environment approval gates for release pipeline (#1523)

* feat: per-environment approval gates for release pipeline

Replace single production-approval gate with parallel per-environment
approval jobs (production-me, production-us). Each env gets its own
approval with 72h timeout. Only one release pipeline active at a time
via concurrency group change.

DASOPS-1958

* feat: add deploy-prod-us with per-env approval gate

Consolidates das-web-react#1522 (deploy-prod-us + sync-prod-us) with
per-environment approval gates. deploy-prod-us now depends on
approve-prod-us instead of the old single production-approval gate.

Author: andersondario-er

.github/workflows/release.yml

@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}
   cancel-in-progress: true
 
 permissions:
@@ -178,15 +178,24 @@ jobs:
     secrets:
       ARGOCD_AUTH_TOKEN: ${{ secrets.ARGOCD_AUTH_TOKEN }}
 
-  approve-prod:
+  approve-prod-me:
     needs: [sync-stage]
     runs-on: ubuntu-latest
-    environment: production-approval
+    timeout-minutes: 4320
+    environment: production-me
     steps:
-      - run: echo "Production deployment approved"
+      - run: echo "Production ME deployment approved"
+
+  approve-prod-us:
+    needs: [sync-stage]
+    runs-on: ubuntu-latest
+    timeout-minutes: 4320
+    environment: production-us
+    steps:
+      - run: echo "Production US deployment approved"
 
   deploy-prod-me:
-    needs: [config, build, approve-prod]
+    needs: [config, build, approve-prod-me]
     uses: ./.github/workflows/_update-argo.yml
     with:
       app-name: das-web-react
@@ -203,3 +212,22 @@ jobs:
       app-name: das-web-react-er-prod-me
     secrets:
       ARGOCD_AUTH_TOKEN: ${{ secrets.ARGOCD_AUTH_TOKEN }}
+
+  deploy-prod-us:
+    needs: [config, build, approve-prod-us]
+    uses: ./.github/workflows/_update-argo.yml
+    with:
+      app-name: das-web-react
+      app-subdir: earthranger
+      environment: er-prod-us
+      image-tag: ${{ needs.config.outputs.image-tag }}
+    secrets:
+      ARGOCD_APPS_SSH_KEY: ${{ secrets.ARGOCD_APPS_SSH_KEY }}
+
+  sync-prod-us:
+    needs: [config, deploy-prod-us]
+    uses: ./.github/workflows/_sync-argo.yml
+    with:
+      app-name: das-web-react-er-prod-us
+    secrets:
+      ARGOCD_AUTH_TOKEN: ${{ secrets.ARGOCD_AUTH_TOKEN }}