[devantler]

Motivation

🤖 Generated by the Daily AI Assistant

• Prevent speculative merge_group (merge-queue) refs from receiving production deployment secrets or mutating the production cluster by removing the automatic prod deploy path from the CI merge-queue workflow.
• Ensure production deployments run only from trusted main after merge or by explicit manual dispatch so deploys require the normal branch-based protections and reviewer controls.

Description

• Remove the deploy-prod and heal-prod-on-failure jobs from the CI workflow (.github/workflows/ci.yaml) so the merge-queue no longer restores production secrets or runs ksail against ksail.prod.yaml on speculative refs.
• Adjust the CI required-checks aggregation to exclude the removed prod deploy job so PR/merge-group validation remains focused on static manifest checks.
• Change the CD workflow (.github/workflows/cd.yaml) to trigger automatic production deploys on push to main (with path filters) while preserving manual workflow_dispatch and the shared deploy composite action that accepts production secrets as inputs.
• Update comments in both workflows to reflect that automatic production deploys now originate from main or manual dispatch rather than the merge-queue.

Testing

• Verified both modified workflows parse as valid YAML by loading them with ruby -e 'require "yaml"; [".github/workflows/ci.yaml",".github/workflows/cd.yaml"].each{|f| YAML.load_file(f); puts "#{f}: ok"}', which succeeded.
• Ran git diff --check to ensure there are no whitespace or patch issues, which returned cleanly.
• Searched both workflows for deployment-related keywords with rg -n "deploy-prod|environment: prod|secrets\.|github.event_name == 'merge_group'|prod-deploy" .github/workflows/ci.yaml .github/workflows/cd.yaml to confirm the prod deploy path was removed from CI and present only on main in CD, which matched expectations.

---

Codex Task

[devantler]

🤖 Generated by the Agentic Engineer

Closing this stale draft as superseded by the reviewed production contract now on main. Platform intentionally deploys the merge-group commit before merge so a failed production rollout blocks the queue, while direct pushes use the manual CD fallback. Both paths now share the exact-digest stage, verification, signing, attestation, promotion, reconciliation, and readiness proof in the deploy-prod action.

Moving the normal deploy to a post-merge push would remove the rollback-before-merge safety property and regress the current deployment design. There is no remaining valid finding to carry forward from this draft.