From 69857c4acee8f8a67b4887530734c527f8e07e8d Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Mon, 5 Oct 2026 15:42:46 -0400
Subject: [PATCH] fix: require explicit dispatch for public demo redeployment

---
 .gitea/workflows/demo-images.yml  | 3 ++-
 .github/workflows/demo-images.yml | 3 ++-
 demo-deploy/README.md             | 4 +++-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/demo-images.yml b/.gitea/workflows/demo-images.yml
index 3ea678e2..ff6020f9 100644
--- a/.gitea/workflows/demo-images.yml
+++ b/.gitea/workflows/demo-images.yml
@@ -74,5 +74,6 @@ jobs:
             ${{ vars.DEMO_REGISTRY }}/archy-demo-web:${{ github.sha }}
 
       - name: Trigger Portainer redeploy
-        if: ${{ success() && secrets.PORTAINER_WEBHOOK != '' }}
+        # Source pushes prepare images; public deployment is an explicit post-release action.
+        if: ${{ success() && github.event_name == 'workflow_dispatch' && secrets.PORTAINER_WEBHOOK != '' }}
         run: curl -fsS -X POST "${{ secrets.PORTAINER_WEBHOOK }}"
diff --git a/.github/workflows/demo-images.yml b/.github/workflows/demo-images.yml
index 3d6feb61..a9578c8c 100644
--- a/.github/workflows/demo-images.yml
+++ b/.github/workflows/demo-images.yml
@@ -74,5 +74,6 @@ jobs:
             ${{ vars.DEMO_REGISTRY }}/archy-demo-web:${{ github.sha }}
 
       - name: Trigger Portainer redeploy
-        if: ${{ success() && secrets.PORTAINER_WEBHOOK != '' }}
+        # Source pushes prepare images; public deployment is an explicit post-release action.
+        if: ${{ success() && github.event_name == 'workflow_dispatch' && secrets.PORTAINER_WEBHOOK != '' }}
         run: curl -fsS -X POST "${{ secrets.PORTAINER_WEBHOOK }}"
diff --git a/demo-deploy/README.md b/demo-deploy/README.md
index 48a84db0..5751cbf0 100644
--- a/demo-deploy/README.md
+++ b/demo-deploy/README.md
@@ -22,7 +22,9 @@ To pick up a new build, redeploy the stack (or wire the CI Portainer webhook).
 The images are built from the Archipelago monorepo by
 `.github/workflows/demo-images.yml` on every change to `neode-ui/`, tagged `:demo`
 and `:<git-sha>`, and pushed to `REGISTRY`. Editing the real UI → CI rebuilds →
-redeploy here. No source lives in this repo.
+redeploy here. The optional Portainer webhook runs only on an explicit workflow
+dispatch after release qualification; a source push alone does not invoke it.
+No source lives in this repo.
 
 ## What's mocked