From 5297cb97a677963c617e6320b522a34538783abd Mon Sep 17 00:00:00 2001 From: Jesse_Chen Date: Mon, 20 Jul 2026 11:39:38 +0800 Subject: [PATCH] ci: require manual GitHub Actions runs --- .github/workflows/ci.yml | 5 +---- .github/workflows/deploy-production.yml | 12 ++---------- .github/workflows/publish-pypi.yml | 3 --- .github/workflows/release-quality-gate.yml | 7 ------- .github/workflows/test.yml | 5 +---- AGENTS.md | 2 +- deploy/README.md | 6 +++--- 7 files changed, 8 insertions(+), 32 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b65b6cff..bae554e4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,10 +1,7 @@ name: Jyotish Skill CI on: - push: - branches: [main] - pull_request: - branches: [main] + workflow_dispatch: jobs: validate: diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml index 964e37fd..c5f65174 100644 --- a/.github/workflows/deploy-production.yml +++ b/.github/workflows/deploy-production.yml @@ -1,9 +1,6 @@ name: Deploy production on: - workflow_run: - workflows: ["Jyotish Skill CI"] - types: [completed] workflow_dispatch: permissions: @@ -21,11 +18,6 @@ env: jobs: deploy: - if: >- - github.event_name == 'workflow_dispatch' || - (github.event.workflow_run.conclusion == 'success' && - github.event.workflow_run.event == 'push' && - github.event.workflow_run.head_branch == 'main') runs-on: ubuntu-latest timeout-minutes: 30 @@ -33,7 +25,7 @@ jobs: - name: Checkout tested revision uses: actions/checkout@v4 with: - ref: ${{ github.event.workflow_run.head_sha || github.sha }} + ref: ${{ github.sha }} - name: Configure SSH env: @@ -46,7 +38,7 @@ jobs: - name: Sync and rebuild env: - DEPLOY_GIT_SHA: ${{ github.event.workflow_run.head_sha || github.sha }} + DEPLOY_GIT_SHA: ${{ github.sha }} run: | SSH_OPTIONS="-i $HOME/.ssh/jyotisha-production -p $DEPLOY_PORT -o BatchMode=yes -o IdentitiesOnly=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=20" RSYNC_SSH="ssh $SSH_OPTIONS" diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml index 13aaebaa..ebb83717 100644 --- a/.github/workflows/publish-pypi.yml +++ b/.github/workflows/publish-pypi.yml @@ -1,9 +1,6 @@ name: Publish to PyPI on: - push: - tags: - - 'v*' workflow_dispatch: permissions: diff --git a/.github/workflows/release-quality-gate.yml b/.github/workflows/release-quality-gate.yml index 49653162..7dc92841 100644 --- a/.github/workflows/release-quality-gate.yml +++ b/.github/workflows/release-quality-gate.yml @@ -2,13 +2,6 @@ name: Jyotish Release Quality Gate on: workflow_dispatch: - pull_request: - branches: [main] - paths: - - '.github/workflows/release-quality-gate.yml' - - 'frontend/**' - - 'scripts/run_quality_gate.py' - - 'tests/**' jobs: release-quality-gate: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index d7fc1fe2..a9b52797 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -1,10 +1,7 @@ name: Jyotish Skill Tests on: - push: - branches: [main] - pull_request: - branches: [main] + workflow_dispatch: jobs: test: diff --git a/AGENTS.md b/AGENTS.md index 0469359f..0164f7f1 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -22,7 +22,7 @@ Deployment safety rules: 3. Keep Supabase Auth Site URL and redirect URLs aligned with `https://jyotisha.chat`. 4. After deployment, verify `/login`, logged-out `/api/account` = `401`, internal `/api/health` = `200`, and `swisseph_available = true`. 5. Never expose port `5200`, `SUPABASE_SERVICE_ROLE_KEY`, model keys, user JWTs, passwords, or SSH private keys. -6. Pushes to `main` deploy automatically only after `Jyotish Skill CI` succeeds; the production workflow and required secret are documented in `deploy/README.md`. +6. GitHub Actions workflows are manual-only. Run the required validation workflows from the Actions page before manually starting production deployment; the production workflow and required secret are documented in `deploy/README.md`. ## 1. High-Rigor Override diff --git a/deploy/README.md b/deploy/README.md index 174dd7b6..7c37ff94 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -118,9 +118,9 @@ docker stats --no-stream The server has a persistent 2 GB `/swapfile`. UFW permits only SSH `22000/tcp`, HTTP `80/tcp`, HTTPS `443/tcp`, and the pre-existing WireGuard `51820/udp` rule. -## Automatic deployment +## Manual deployment with GitHub Actions -A successful `Jyotish Skill CI` run for a push to `main` triggers `.github/workflows/deploy-production.yml`. The workflow syncs the tested revision with `rsync`, preserves `/opt/jyotisha-app/.env.production`, rebuilds both Docker services, and verifies the public login route, logged-out account response, and private Python health endpoint. +Pushes and pull requests do not start GitHub Actions automatically. Run the required validation workflows from the Actions page, then manually start `.github/workflows/deploy-production.yml` for the tested branch. The deployment workflow syncs that revision with `rsync`, preserves `/opt/jyotisha-app/.env.production`, rebuilds both Docker services, and verifies the public login route, logged-out account response, and private Python health endpoint. Required GitHub Actions secret: @@ -128,7 +128,7 @@ Required GitHub Actions secret: PRODUCTION_SSH_PRIVATE_KEY = dedicated production deploy private key ``` -The workflow pins the VPS Ed25519 host key and serializes deployments with the `production` concurrency group. It can also be run manually from GitHub Actions. +The workflow pins the VPS Ed25519 host key and serializes deployments with the `production` concurrency group. ## Manual deployment fallback