Keep production tests and database copy only

.github/workflows/check-and-deploy.yml

@@ -1,10 +1,10 @@
-name: Check and deploy
+name: Production tests
 
 on:
   push:
-    branches: [main, dev]
+    branches: [main]
   pull_request:
-    branches: [main, dev]
+    branches: [main]
   workflow_dispatch:
 
 permissions:
@@ -13,7 +13,7 @@ permissions:
 jobs:
   checks:
     name: Regression and Worker checks
-    # Validate releases, including dev -> main PRs. Dev stays fast for manual testing.
+    # Preserve this job name: main branch protection requires it.
     if: github.ref == 'refs/heads/main' || (github.event_name == 'pull_request' && github.base_ref == 'main')
     runs-on: ubuntu-latest
     timeout-minutes: 20
@@ -33,51 +33,3 @@ jobs:
         run: npm test
       - name: Check Worker bundle and local database integration
         run: npm run test:worker
-
-  deploy:
-    name: Deploy selected environment
-    needs: checks
-    if: >-
-      !cancelled() &&
-      github.event_name != 'pull_request' &&
-      vars.XEVENTS_DEPLOY_ENABLED == 'true' &&
-      ((github.ref == 'refs/heads/main' && needs.checks.result == 'success') ||
-      (github.ref == 'refs/heads/dev' && needs.checks.result == 'skipped'))
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    environment:
-      name: ${{ github.ref_name == 'main' && 'production' || 'development' }}
-    # The development schema-refresh job uses this same resource lock.
-    concurrency:
-      group: ${{ github.ref_name == 'main' && 'xevents-production' || 'xevents-development' }}
-      cancel-in-progress: false
-    steps:
-      - name: Check out the selected commit
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-      - name: Reject a superseded deployment
-        run: |
-          REMOTE_COMMIT="$(git ls-remote origin "refs/heads/$GITHUB_REF_NAME" | cut -f1)"
-          if [ "$REMOTE_COMMIT" != "$GITHUB_SHA" ]; then
-            echo 'Deployment superseded by a newer branch commit. Deploy the latest commit instead.' >&2
-            exit 1
-          fi
-      - name: Set up Node.js
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
-        with:
-          node-version: 22
-          cache: npm
-      - name: Install dependencies
-        run: npm ci
-      - name: Apply migrations and deploy to the selected environment
-        env:
-          DEPLOY_ENVIRONMENT: ${{ github.ref_name == 'main' && 'production' || 'development' }}
-          GH_REF_NAME: ${{ github.ref_name }}
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          WRANGLER_CONFIG_JSON: ${{ secrets.WRANGLER_CONFIG_JSON }}
-          # Used only to reject an accidental production binding in development.
-          PRODUCTION_CONFIG_JSON: ${{ github.ref_name == 'dev' && secrets.PRODUCTION_CONFIG_JSON || '' }}
-        run: node scripts/deploy-environment.mjs

.github/workflows/copy-production-db-to-dev.yml

@@ -9,7 +9,6 @@ permissions:
 jobs:
   refresh-database:
     name: Replace dev data with a production snapshot
-    if: vars.XEVENTS_DATABASE_REFRESH_ENABLED == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 45
     # This environment is restricted to main. It has its own private credentials.
@@ -19,12 +18,31 @@ jobs:
       group: xevents-development
       cancel-in-progress: false
     steps:
-      - name: Require the trusted workflow branch
+      - name: Check database-copy setup
         env:
           SELECTED_REF: ${{ github.ref }}
+          DATABASE_REFRESH_ENABLED: ${{ vars.XEVENTS_DATABASE_REFRESH_ENABLED }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          WRANGLER_CONFIG_JSON: ${{ secrets.WRANGLER_CONFIG_JSON }}
+          PRODUCTION_CONFIG_JSON: ${{ secrets.PRODUCTION_CONFIG_JSON }}
         run: |
           if [ "$SELECTED_REF" != 'refs/heads/main' ]; then
-            echo 'Run this database-only workflow from main.' >&2
+            echo '::error::Run this database-only workflow from main.'
+            exit 1
+          fi
+          if [ "$DATABASE_REFRESH_ENABLED" != 'true' ]; then
+            echo '::error::Database copying is disabled in this mirror. Run Copy production database to dev in ehsan0921/Telegram-event-management on main.'
+            exit 1
+          fi
+          MISSING=0
+          for SECRET_NAME in CLOUDFLARE_API_TOKEN CLOUDFLARE_ACCOUNT_ID WRANGLER_CONFIG_JSON PRODUCTION_CONFIG_JSON; do
+            if [ -z "${!SECRET_NAME}" ]; then
+              echo "::error::Missing $SECRET_NAME. Add it to Settings > Environments > development-refresh > Environment secrets, then run again."
+              MISSING=1
+            fi
+          done
+          if [ "$MISSING" = '1' ]; then
             exit 1
           fi
       - name: Check out the database-copy tools

AGENTS.md

@@ -49,7 +49,9 @@ existing invitations, and users' private event data when making changes.
   production checks. Invitation, visibility, or schema changes need coverage for existing
   events, legacy modes, privacy, and stored response preservation.
 - Keep development deployments fast: automated test jobs run for PRs targeting
-  `main` and for `main` pushes/manual runs, not for `dev`. Local tests during
+  `main` and for `main` pushes/manual runs, not for `dev`. GitHub Actions contains
+  only production tests and the manual production-to-dev database copy; do not add
+  deployment or code-sync workflows. Local tests during
   development are optional when useful; require the full regression and Worker
   checks before production promotion and deployment. Keep development builds,
   environment isolation validation and deployment health checks enabled.
@@ -73,8 +75,11 @@ existing invitations, and users' private event data when making changes.
   Never merge code, deploy Workers, write production data or publish database
   exports as part of this database-only workflow. Automated tests still use
   fictional local fixtures, never actual production snapshots.
-- Run deployment automation from one canonical repository; mirrors run checks
-  only. Store private configuration in GitHub environment secrets and ignored files.
+- Enable database-copy automation in one repository only, currently
+  `ehsan0921/Telegram-event-management`. Mirrors run production checks and report
+  an actionable error if database copying is requested there. Never silently skip
+  a requested database copy. Store private configuration in GitHub environment
+  secrets and ignored files. Deploy separately with the CLI after required checks.
 
 - Inspect the final diff and stage explicit intended files. Keep local credentials,
   generated private data, deployment logs, and machine-specific helpers untracked.