Automate primary production deployments from main

.gitea/workflows/deploy-blog.yml

@@ -2,7 +2,7 @@ name: Deploy blog static Worker preview
 
 on:
   push:
-    branches: [astro-platform-pilot, markdown-content-pilot]
+    branches-ignore: [main]
     paths:
       - .gitea/workflows/deploy-blog.yml
       - astro.config.mjs

.gitea/workflows/deploy.yml

@@ -2,7 +2,7 @@ name: Deploy primary static Worker preview
 
 on:
   push:
-    branches: [astro-platform-pilot, markdown-content-pilot]
+    branches-ignore: [main]
     paths:
       - .gitea/workflows/deploy.yml
       - astro.config.mjs

.gitea/workflows/production-candidate.yml

@@ -1,14 +1,25 @@
-name: Deploy primary production Worker candidate
+name: Deploy primary production Worker
 
 on:
   push:
-    branches: [astro-platform-pilot]
-    paths: [.gitea/workflows/production-candidate.yml]
+    branches: [main]
+    paths:
+      - .gitea/workflows/production-candidate.yml
+      - astro.config.mjs
+      - package.json
+      - package-lock.json
+      - public/**
+      - schemas/**
+      - scripts/**
+      - sites.json
+      - sites/www/**
+      - src/**
+      - wrangler/www.production.jsonc
   workflow_dispatch:
 
 jobs:
-  candidate:
-    name: Build and deploy 3031023.xyz candidate
+  production:
+    name: Build and deploy 3031023.xyz production
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -25,9 +36,9 @@ jobs:
           node-version: 22
       - name: Install locked dependencies
         run: npm ci
-      - name: Validate and build production candidate
+      - name: Validate and build production site
         run: npm run build:site
-      - name: Verify production candidate output
+      - name: Verify production output
         run: npm run verify:build
       - name: Deploy Worker without custom domains or routes
         run: npx wrangler deploy --config wrangler/www.production.jsonc

README.md

@@ -33,9 +33,10 @@ routes, account IDs, or secrets.
 
 ## Preview deployment
 
-The Gitea workflows deploy scoped non-production Workers from the pilot and
-Markdown-test branches: `3031023-xyz-www-preview` for primary-site changes and
-`3031023-xyz-blog-preview` for blog changes.
+The Gitea workflows deploy scoped non-production Workers from every non-`main`
+branch: `3031023-xyz-www-preview` for primary-site changes and
+`3031023-xyz-blog-preview` for blog changes. Relevant primary-site pushes to
+`main` deploy the existing `3031023-xyz-www` production Worker automatically.
 It uses the existing `CF_API_TOKEN` and `CF_ACCOUNT_ID`. The token retains the
 Pages permissions needed for the `main` rollback target and now also permits
 the non-production Worker preview deployment.

docs/cutover-runbook.md

@@ -20,10 +20,10 @@ static assets to a distinct Worker.
 - Existing Pages production deployment: `2fb1b659-5928-4470-bb04-ef4c9105b843`
   from the `main` branch.
 - Preview Worker: `3031023-xyz-www-preview`, with no custom domains or routes.
-- Production candidate Worker: `3031023-xyz-www`, deployed only through the
-  dedicated `Deploy primary production Worker candidate` workflow. Its push
-  trigger is limited to changes to that workflow file; ordinary site commits
-  cannot update this Worker.
+- Production Worker: `3031023-xyz-www`, deployed by the dedicated `Deploy
+  primary production Worker` workflow for relevant pushes to `main`. The
+  workflow updates static assets only; it cannot change DNS, custom domains,
+  routes, or redirect rules.
 
 ## Cutover sequence (requires separate approval)
 
@@ -76,8 +76,9 @@ the cutover. Review it with the site's AI-search policy before final acceptance.
 
 - Source commit: `2b7f8d8` (`main`), the accepted Git-backed Markdown content
   pilot.
-- Release path: the manually approved `Deploy primary production Worker
-  candidate` workflow completed successfully in 22 seconds.
+- Release path: the manually approved production workflow completed
+  successfully in 22 seconds. Subsequent relevant `main` pushes use the same
+  static-asset-only workflow automatically.
 - Scope: updated only the static assets of the existing `3031023-xyz-www`
   Worker. No custom domain, DNS, redirect rule, Pages project, form workflow,
   CMS, or client-editing boundary changed.