From 178ded7cf490dfff1470ad3d9e41b16f5e4cf031 Mon Sep 17 00:00:00 2001
From: cooper <cooper@darkmatter.io>
Date: Wed, 23 Sep 2026 04:32:10 -0700
Subject: [PATCH] fix(ci): only deploy the API to production from main

deploy-api.yaml also triggered on feat/cloud-gate-** pushes, and none of
its build, push or flyctl deploy steps checked the branch, so a push to
such a branch (or a manual dispatch from any branch) deployed to the
production Fly app. The comment claiming production still gated on main
was wrong.

Drop the temporary branch glob, gate the job on refs/heads/main, and
remove the develop/pull_request conditions that can no longer fire.

Refs: stackpanel-thq.2
---
 .github/workflows/deploy-api.yaml | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/deploy-api.yaml b/.github/workflows/deploy-api.yaml
index b44e474a..779f1c97 100644
--- a/.github/workflows/deploy-api.yaml
+++ b/.github/workflows/deploy-api.yaml
@@ -13,10 +13,7 @@ name: deploy-api
 
 on:
   push:
-    # Include feature branches matching feat/cloud-gate-* so we can verify
-    # the deploy pipeline before merging to main. Production deploys still
-    # gate on main.
-    branches: [main, "feat/cloud-gate-**"]
+    branches: [main]
     paths:
       - "apps/api/**"
       - "packages/api/**"
@@ -41,6 +38,9 @@ concurrency:
 
 jobs:
   deploy:
+    # Every step below targets the production Fly app, so a manual dispatch
+    # from any other branch must not run it.
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -110,11 +110,8 @@ jobs:
             https://stackpanel-api.fly.dev/health
 
       # Idempotent ACME cert + Cloudflare A/AAAA records pointing at the
-      # Fly app's IPs. Skipped on dev (the .fly.dev hostname is enough)
-      # and only kicks in for production / staging / pr-N stages — see
-      # apps/api/alchemy.run.ts.
+      # Fly app's IPs for the production stage (see apps/api/alchemy.run.ts).
       - name: Bind public hostname
-        if: github.ref_name == 'main' || github.ref_name == 'develop' || github.event_name == 'pull_request'
         env:
           FLY_IO_API_KEY: ${{ secrets.FLY_API_TOKEN }}
           # Cloudflare credentials come from the SOPS deploy scope via
@@ -122,7 +119,7 @@ jobs:
           # which carries Zone DNS Read/Write for the record steps). Don't
           # set CLOUDFLARE_API_TOKEN here: the repo has no such GH secret and
           # an empty env var would shadow the SOPS-provided value.
-          STAGE: ${{ github.ref_name == 'main' && 'production' || github.ref_name == 'develop' && 'staging' || format('pr-{0}', github.event.pull_request.number) }}
+          STAGE: production
         working-directory: apps/api
         run: bunx alchemy deploy --stage "$STAGE"