deploy.yml

name: Deploy to Production

# Fork policy: NO automated deployment. Servers pull the GHCR image built by
# build-docker.yml manually (no staging / blue-green setup yet). This used to
# run on every tag push and mirror main into a `release` branch; it is kept
# for manual promotion only. Note: it requires a GH_TOKEN secret (PAT with
# repo scope) which is not configured in this fork.
on:
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 60

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: main
          fetch-depth: 0
          token: ${{ secrets.GH_TOKEN }}

      - name: Push to release branch
        run: |
          git checkout release || git checkout -b release
          git merge --ff-only main
          git push origin release