From bd2842d4e1be3304b3591288552da4449e7c12b4 Mon Sep 17 00:00:00 2001
From: chappie-daemon <phoenix@ricardocabral.io>
Date: Thu, 15 Oct 2026 16:42:12 -0400
Subject: [PATCH 1/3] ci(website): deploy on nostream-website release publish,
 not on main pushes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The site now deploys when the changesets workflow tags and publishes
nostream-website@X.Y.Z (the release event this workflow filters on).
Merging relay work to main no longer touches the site deploy; a site
deploy happens exactly when a release PR that bumps nostream-website
merges. Checkout on a release event is the tagged commit, so the
deployed assets are the released build. Relay image releases keep
their v* gate in release.yml — the tag namespaces do not overlap.

workflow_dispatch remains for manual deploys of main.
---
 .github/workflows/deploy-website.yml | 32 ++++++++++------------------
 1 file changed, 11 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml
index 7080bea3..f4eda817 100644
--- a/.github/workflows/deploy-website.yml
+++ b/.github/workflows/deploy-website.yml
@@ -1,25 +1,15 @@
 name: Deploy Website
 
-# The marketing site deploys after a release lands on main: the changesets
-# release PR bumps nostream-website, merging it is the deploy trigger. Version
-# the site with a changeset, merge the release PR — never deploy from a branch.
+# The marketing site deploys when a nostream-website release is published:
+# the changesets release PR bumps the site package, and merging that PR makes
+# the changesets workflow tag + publish nostream-website@X.Y.Z and create the
+# GitHub release — this workflow deploys that tagged build. Merges to main do
+# not deploy; version the site with a changeset and merge the release PR.
 
 on:
-  push:
-    branches:
-      - main
-    paths:
-      - "website/site/**"
-      - "pnpm-lock.yaml"
-      - "package.json"
-      - "README.md"
-      - "CLI.md"
-      - "CONFIGURATION.md"
-      - "CONTRIBUTING.md"
-      - "SECURITY.md"
-      - "CHANGELOG.md"
-      - "deploy/**"
-      - "docs/**"
+  release:
+    types:
+      - published
   workflow_dispatch:
 
 concurrency:
@@ -28,9 +18,9 @@ concurrency:
 
 jobs:
   deploy:
-    # workflow_dispatch ignores the push-branch filter; a manual run must not
-    # publish a non-main branch to production.
-    if: github.event_name != 'workflow_dispatch' || github.ref == 'refs/heads/main'
+    if: >-
+      ${{ startsWith(github.event.release.tag_name, 'nostream-website@') ||
+      github.event_name == 'workflow_dispatch' }}
     name: Build and deploy to Cloudflare Workers
     runs-on: ubuntu-latest
     # Deploy credentials live in this GitHub environment: CLOUDFLARE_API_TOKEN

From 3994f7c734a090f96220714a28fb7c38c810871c Mon Sep 17 00:00:00 2001
From: chappie-daemon <phoenix@ricardocabral.io>
Date: Thu, 15 Oct 2026 16:46:00 -0400
Subject: [PATCH 2/3] ci(website): keep relay releases out of the deploy queue

Greptile P1: with the release trigger, a v* relay release entered the
workflow-level deploy-website concurrency queue before the job's tag
filter rejected it, and as a queued entry it could replace a pending
website deploy (cancel-in-progress only protects the running one).
Concurrency moves to the job so rejected events never queue.
---
 .github/workflows/deploy-website.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml
index f4eda817..48596830 100644
--- a/.github/workflows/deploy-website.yml
+++ b/.github/workflows/deploy-website.yml
@@ -12,12 +12,14 @@ on:
       - published
   workflow_dispatch:
 
-concurrency:
-  group: deploy-website
-  cancel-in-progress: false
-
 jobs:
   deploy:
+    # Concurrency lives on the job, not the workflow: a relay release
+    # (v* tag) fails the if below and must not enter this deploy queue,
+    # where it could replace a queued website deploy.
+    concurrency:
+      group: deploy-website
+      cancel-in-progress: false
     if: >-
       ${{ startsWith(github.event.release.tag_name, 'nostream-website@') ||
       github.event_name == 'workflow_dispatch' }}

From 1a24d93bd77c4754370551fed49f68126dc7877f Mon Sep 17 00:00:00 2001
From: chappie-daemon <phoenix@ricardocabral.io>
Date: Thu, 15 Oct 2026 19:24:43 -0400
Subject: [PATCH 3/3] chore: add changeset for the release-triggered website
 deploy

---
 .changeset/website-release-triggered-deploy.md | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .changeset/website-release-triggered-deploy.md

diff --git a/.changeset/website-release-triggered-deploy.md b/.changeset/website-release-triggered-deploy.md
new file mode 100644
index 00000000..aab47b4f
--- /dev/null
+++ b/.changeset/website-release-triggered-deploy.md
@@ -0,0 +1,5 @@
+---
+"nostream-website": patch
+---
+
+The site now deploys when a nostream-website release is published (changesets tags the release after the release PR merges) instead of on every push to main. Relay-only merges no longer trigger website deploys.