From 954b230d05b894018a638efbceb32ae3166be1c3 Mon Sep 17 00:00:00 2001
From: Kevin <ksloan90@gmail.com>
Date: Wed, 2 Sep 2026 10:47:46 -0400
Subject: [PATCH] Automate primary production deployments from main

---
 .gitea/workflows/deploy-blog.yml          |  2 +-
 .gitea/workflows/deploy.yml               |  2 +-
 .gitea/workflows/production-candidate.yml | 25 ++++++++++++++++-------
 README.md                                 |  7 ++++---
 docs/cutover-runbook.md                   | 13 ++++++------
 5 files changed, 31 insertions(+), 18 deletions(-)

diff --git a/.gitea/workflows/deploy-blog.yml b/.gitea/workflows/deploy-blog.yml
index de3ce3c..f89a8fc 100644
--- a/.gitea/workflows/deploy-blog.yml
+++ b/.gitea/workflows/deploy-blog.yml
@@ -2,7 +2,7 @@ name: Deploy blog static Worker preview
 
 on:
   push:
-    branches: [astro-platform-pilot, markdown-content-pilot]
+    branches-ignore: [main]
     paths:
       - .gitea/workflows/deploy-blog.yml
       - astro.config.mjs
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 08f7925..b75a66a 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -2,7 +2,7 @@ name: Deploy primary static Worker preview
 
 on:
   push:
-    branches: [astro-platform-pilot, markdown-content-pilot]
+    branches-ignore: [main]
     paths:
       - .gitea/workflows/deploy.yml
       - astro.config.mjs
diff --git a/.gitea/workflows/production-candidate.yml b/.gitea/workflows/production-candidate.yml
index 75d9bbb..80db176 100644
--- a/.gitea/workflows/production-candidate.yml
+++ b/.gitea/workflows/production-candidate.yml
@@ -1,14 +1,25 @@
-name: Deploy primary production Worker candidate
+name: Deploy primary production Worker
 
 on:
   push:
-    branches: [astro-platform-pilot]
-    paths: [.gitea/workflows/production-candidate.yml]
+    branches: [main]
+    paths:
+      - .gitea/workflows/production-candidate.yml
+      - astro.config.mjs
+      - package.json
+      - package-lock.json
+      - public/**
+      - schemas/**
+      - scripts/**
+      - sites.json
+      - sites/www/**
+      - src/**
+      - wrangler/www.production.jsonc
   workflow_dispatch:
 
 jobs:
-  candidate:
-    name: Build and deploy 3031023.xyz candidate
+  production:
+    name: Build and deploy 3031023.xyz production
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -25,9 +36,9 @@ jobs:
           node-version: 22
       - name: Install locked dependencies
         run: npm ci
-      - name: Validate and build production candidate
+      - name: Validate and build production site
         run: npm run build:site
-      - name: Verify production candidate output
+      - name: Verify production output
         run: npm run verify:build
       - name: Deploy Worker without custom domains or routes
         run: npx wrangler deploy --config wrangler/www.production.jsonc
diff --git a/README.md b/README.md
index b32e2e0..639e0e6 100644
--- a/README.md
+++ b/README.md
@@ -33,9 +33,10 @@ routes, account IDs, or secrets.
 
 ## Preview deployment
 
-The Gitea workflows deploy scoped non-production Workers from the pilot and
-Markdown-test branches: `3031023-xyz-www-preview` for primary-site changes and
-`3031023-xyz-blog-preview` for blog changes.
+The Gitea workflows deploy scoped non-production Workers from every non-`main`
+branch: `3031023-xyz-www-preview` for primary-site changes and
+`3031023-xyz-blog-preview` for blog changes. Relevant primary-site pushes to
+`main` deploy the existing `3031023-xyz-www` production Worker automatically.
 It uses the existing `CF_API_TOKEN` and `CF_ACCOUNT_ID`. The token retains the
 Pages permissions needed for the `main` rollback target and now also permits
 the non-production Worker preview deployment.
diff --git a/docs/cutover-runbook.md b/docs/cutover-runbook.md
index b2f791b..21f6dba 100644
--- a/docs/cutover-runbook.md
+++ b/docs/cutover-runbook.md
@@ -20,10 +20,10 @@ static assets to a distinct Worker.
 - Existing Pages production deployment: `2fb1b659-5928-4470-bb04-ef4c9105b843`
   from the `main` branch.
 - Preview Worker: `3031023-xyz-www-preview`, with no custom domains or routes.
-- Production candidate Worker: `3031023-xyz-www`, deployed only through the
-  dedicated `Deploy primary production Worker candidate` workflow. Its push
-  trigger is limited to changes to that workflow file; ordinary site commits
-  cannot update this Worker.
+- Production Worker: `3031023-xyz-www`, deployed by the dedicated `Deploy
+  primary production Worker` workflow for relevant pushes to `main`. The
+  workflow updates static assets only; it cannot change DNS, custom domains,
+  routes, or redirect rules.
 
 ## Cutover sequence (requires separate approval)
 
@@ -76,8 +76,9 @@ the cutover. Review it with the site's AI-search policy before final acceptance.
 
 - Source commit: `2b7f8d8` (`main`), the accepted Git-backed Markdown content
   pilot.
-- Release path: the manually approved `Deploy primary production Worker
-  candidate` workflow completed successfully in 22 seconds.
+- Release path: the manually approved production workflow completed
+  successfully in 22 seconds. Subsequent relevant `main` pushes use the same
+  static-asset-only workflow automatically.
 - Scope: updated only the static assets of the existing `3031023-xyz-www`
   Worker. No custom domain, DNS, redirect rule, Pages project, form workflow,
   CMS, or client-editing boundary changed.