From dc36f0120dbbc8a96ce6e531969f3b75d0112da4 Mon Sep 17 00:00:00 2001
From: JOY <5027251+JOY@users.noreply.github.com>
Date: Thu, 10 Sep 2026 17:30:00 +0700
Subject: [PATCH] ci(sync): dispatch beta GHCR builds explicitly; make deploy
 manual-only

The sync bot pushes dev and the beta tag with GITHUB_TOKEN, and GitHub does not trigger workflows from GITHUB_TOKEN events - so build-docker.yml never ran for bot syncs and no beta image was ever published. workflow_dispatch is the documented exception, so the bot now dispatches build-docker.yml explicitly for the beta tag and for dev after pushing. Image build + GHCR push only: there is no deploy step (servers pull the image manually; no staging/blue-green in this fork).

Also: deploy.yml no longer runs on tag push (it mirrored main into a release branch and needs a GH_TOKEN secret that does not exist here); it is kept as workflow_dispatch for manual promotion. And the pre-release step no longer swallows failures with '|| true' - it checks for an existing release and fails loudly otherwise (every beta so far silently got no GitHub Release). Node bumped 22 -> 24 to match engines.
---
 .github/workflows/deploy.yml        |  9 +++++---
 .github/workflows/sync-upstream.yml | 32 ++++++++++++++++++++++-------
 2 files changed, 31 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 00132070db..aa04d6d039 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,9 +1,12 @@
 name: Deploy to Production
 
+# Fork policy: NO automated deployment. Servers pull the GHCR image built by
+# build-docker.yml manually (no staging / blue-green setup yet). This used to
+# run on every tag push and mirror main into a `release` branch; it is kept
+# for manual promotion only. Note: it requires a GH_TOKEN secret (PAT with
+# repo scope) which is not configured in this fork.
 on:
-  push:
-    tags:
-      - '*'
+  workflow_dispatch:
 
 jobs:
   deploy:
diff --git a/.github/workflows/sync-upstream.yml b/.github/workflows/sync-upstream.yml
index 65bac95160..3ae0e4e9e5 100644
--- a/.github/workflows/sync-upstream.yml
+++ b/.github/workflows/sync-upstream.yml
@@ -41,7 +41,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 24
 
       - name: Configure Git Identity
         run: |
@@ -111,12 +111,30 @@ jobs:
           git tag -fa "$BETA_TAG" -m "Beta Release $BETA_TAG - Crove Sign"
           git push origin "$BETA_TAG" --force
 
-          # 6. Create Pre-release on GitHub
-          echo "📦 Creating GitHub Pre-Release for $BETA_TAG..."
-          gh release create "$BETA_TAG" \
-            --title "Crove Sign $BETA_TAG" \
-            --prerelease \
-            --notes "Automated beta release synchronized from upstream Documenso $TARGET_TAG. Includes Crove Sign Enterprise Branding, Multi-language (Vietnamese) support, Hybrid Org Sync, and OIDC Authentication. Ready for Beta deployment." || true
+          # 6. Trigger the GHCR image builds explicitly.
+          # Pushes made with GITHUB_TOKEN do NOT trigger other workflows
+          # (GitHub blocks recursive runs), so build-docker.yml would never
+          # fire on its own - that is why beta images were never built.
+          # workflow_dispatch IS allowed from GITHUB_TOKEN, so dispatch the
+          # builds here. This only builds and pushes images to GHCR; there is
+          # NO deployment step - servers pull the image manually (no
+          # staging/blue-green automation in this fork by design).
+          echo "🐳 Dispatching GHCR image build for tag $BETA_TAG..."
+          gh workflow run build-docker.yml --ref "$BETA_TAG"
+          echo "🐳 Dispatching GHCR image build for dev branch..."
+          gh workflow run build-docker.yml --ref dev
+
+          # 7. Create Pre-release on GitHub (no silent failure: the previous
+          # `|| true` hid release-create errors for every beta so far).
+          echo "📦 Ensuring GitHub Pre-Release for $BETA_TAG..."
+          if gh release view "$BETA_TAG" >/dev/null 2>&1; then
+            echo "ℹ️ Release $BETA_TAG already exists; leaving it as-is."
+          else
+            gh release create "$BETA_TAG" \
+              --title "Crove Sign $BETA_TAG" \
+              --prerelease \
+              --notes "Automated beta release synchronized from upstream Documenso $TARGET_TAG. Includes Crove Sign Enterprise Branding, Multi-language (Vietnamese) support, Hybrid Org Sync, and OIDC Authentication. Image: ghcr.io/dos/crove-sign:$BETA_TAG (build dispatched - pull manually on the server; no auto-deploy)."
+          fi
 
           echo "synced=true" >> "$GITHUB_OUTPUT"
           echo "version_tag=$BETA_TAG" >> "$GITHUB_OUTPUT"