ci: notify cloud when master gains code it builds against

[otavio]

What

Dispatches a shellhub-master event to shellhub-io/cloud after a master push that touches the
Go trees cloud builds against, so cloud can re-validate its own master.

Why

Cloud consumes this repository through the replace directives in its go.mod. Two workflows
already notify it: notify-cloud.yml on every pull request, and notify-cloud-deps.yml when
go.mod or go.sum move. Neither covers a master push that only changes Go source.

That gap turned a merge-order race into a lasting red. Cloud master QA resolves the shellhub ref
by branch name and falls back to master, so a change spanning both repositories lands as two
merges and the first one builds against a sibling missing the other half.

On 2026-08-18 the cloud half of session recording retention merged at 18:14:19 and this
repository's half at 18:14:40. Cloud's QA run started three seconds after the first merge and
eighteen seconds before the second, and failed on symbols that had not landed yet. Nothing told
cloud when they did, so its master stayed red for about fifteen hours, until an unrelated push
happened to re-run QA.

Changes

• notify-cloud-master.yml: on a master push touching pkg/**, server/**, go.mod or
  go.sum, dispatch shellhub-master to cloud. Path-filtered to the two modules cloud replaces;
  the ui, docs, gateway and agent trees are not on its build path.
• Reuses the existing CLOUD_DISPATCH_APP_ID app token and the pinned action SHAs the two
  sibling workflows already use. permissions: {} — the job needs none of its own.

Beyond repairing the race, this also surfaces the other direction: a commit here that removes a
symbol cloud uses now reddens cloud master when it lands, instead of whenever cloud next pushes.

Testing

Cannot be exercised before merge — the trigger only fires from the default branch. actionlint
reports no findings on the new file.

Pairs with shellhub-io/cloud#2503, which adds the matching repository_dispatch trigger.
Until that merges the dispatch is simply ignored, so the two can land in either order.

[github-actions]

Code Review Complete

The automated review ran but did not post an updated summary — this usually means no new issues were found since the previous review. If you've pushed changes and want a fresh pass, comment /review.

View job