ci: require manual GitHub Actions runs

.github/workflows/ci.yml

@@ -1,10 +1,7 @@
 name: Jyotish Skill CI
 
 on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
+  workflow_dispatch:
 
 jobs:
   validate:

.github/workflows/deploy-production.yml

@@ -1,9 +1,6 @@
 name: Deploy production
 
 on:
-  workflow_run:
-    workflows: ["Jyotish Skill CI"]
-    types: [completed]
   workflow_dispatch:
 
 permissions:
@@ -21,11 +18,6 @@ env:
 
 jobs:
   deploy:
-    if: >-
-      github.event_name == 'workflow_dispatch' ||
-      (github.event.workflow_run.conclusion == 'success' &&
-       github.event.workflow_run.event == 'push' &&
-       github.event.workflow_run.head_branch == 'main')
     runs-on: ubuntu-latest
     timeout-minutes: 30
 
@@ -33,7 +25,7 @@ jobs:
       - name: Checkout tested revision
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+          ref: ${{ github.sha }}
 
       - name: Configure SSH
         env:
@@ -46,7 +38,7 @@ jobs:
 
       - name: Sync and rebuild
         env:
-          DEPLOY_GIT_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+          DEPLOY_GIT_SHA: ${{ github.sha }}
         run: |
           SSH_OPTIONS="-i $HOME/.ssh/jyotisha-production -p $DEPLOY_PORT -o BatchMode=yes -o IdentitiesOnly=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=20"
           RSYNC_SSH="ssh $SSH_OPTIONS"

.github/workflows/publish-pypi.yml

@@ -1,9 +1,6 @@
 name: Publish to PyPI
 
 on:
-  push:
-    tags:
-      - 'v*'
   workflow_dispatch:
 
 permissions:

.github/workflows/release-quality-gate.yml

@@ -2,13 +2,6 @@ name: Jyotish Release Quality Gate
 
 on:
   workflow_dispatch:
-  pull_request:
-    branches: [main]
-    paths:
-      - '.github/workflows/release-quality-gate.yml'
-      - 'frontend/**'
-      - 'scripts/run_quality_gate.py'
-      - 'tests/**'
 
 jobs:
   release-quality-gate:

.github/workflows/test.yml

@@ -1,10 +1,7 @@
 name: Jyotish Skill Tests
 
 on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
+  workflow_dispatch:
 
 jobs:
   test:

AGENTS.md

@@ -22,7 +22,7 @@ Deployment safety rules:
 3. Keep Supabase Auth Site URL and redirect URLs aligned with `https://jyotisha.chat`.
 4. After deployment, verify `/login`, logged-out `/api/account` = `401`, internal `/api/health` = `200`, and `swisseph_available = true`.
 5. Never expose port `5200`, `SUPABASE_SERVICE_ROLE_KEY`, model keys, user JWTs, passwords, or SSH private keys.
-6. Pushes to `main` deploy automatically only after `Jyotish Skill CI` succeeds; the production workflow and required secret are documented in `deploy/README.md`.
+6. GitHub Actions workflows are manual-only. Run the required validation workflows from the Actions page before manually starting production deployment; the production workflow and required secret are documented in `deploy/README.md`.
 
 ## 1. High-Rigor Override
 

deploy/README.md

@@ -118,9 +118,9 @@ docker stats --no-stream
 
 The server has a persistent 2 GB `/swapfile`. UFW permits only SSH `22000/tcp`, HTTP `80/tcp`, HTTPS `443/tcp`, and the pre-existing WireGuard `51820/udp` rule.
 
-## Automatic deployment
+## Manual deployment with GitHub Actions
 
-A successful `Jyotish Skill CI` run for a push to `main` triggers `.github/workflows/deploy-production.yml`. The workflow syncs the tested revision with `rsync`, preserves `/opt/jyotisha-app/.env.production`, rebuilds both Docker services, and verifies the public login route, logged-out account response, and private Python health endpoint.
+Pushes and pull requests do not start GitHub Actions automatically. Run the required validation workflows from the Actions page, then manually start `.github/workflows/deploy-production.yml` for the tested branch. The deployment workflow syncs that revision with `rsync`, preserves `/opt/jyotisha-app/.env.production`, rebuilds both Docker services, and verifies the public login route, logged-out account response, and private Python health endpoint.
 
 Required GitHub Actions secret:
 
@@ -128,7 +128,7 @@ Required GitHub Actions secret:
 PRODUCTION_SSH_PRIVATE_KEY = dedicated production deploy private key
 ```
 
-The workflow pins the VPS Ed25519 host key and serializes deployments with the `production` concurrency group. It can also be run manually from GitHub Actions.
+The workflow pins the VPS Ed25519 host key and serializes deployments with the `production` concurrency group.
 
 ## Manual deployment fallback