Restrict deploy-to-server to tagged builds

[chengzeyi]

Motivation

• Prevent automatic deployment from running on nightly builds to avoid deploying pre-release artifacts.
• Ensure production deploys only occur after a successful tagged release build.
• Keep nightly workflow focused on artifact generation and pre-release publication.

Description

• Removed the deploy-to-server job from .github/workflows/nightly.yml.
• Added a deploy-to-server job to .github/workflows/build.yml after the release job and made it depend on needs: release.
• Gated the new job with the condition if: startsWith(github.ref, 'refs/tags/v') && needs.release.result == 'success' so it only runs on tagged builds after a successful release.
• Deployment step still performs the SSH deploy sequence (ssh ... && npm install && npm run build) to the production host.

Testing

• No automated tests were run because this is a CI workflow configuration change only.
• Changes were validated locally by updating the workflow files .github/workflows/build.yml and .github/workflows/nightly.yml in the branch.
• Commit and PR creation steps completed successfully in the workspace.
• Recommend monitoring the next tagged release run to verify the deploy job triggers as expected.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Deploy the tagged commit rather than main

Because this job only runs on tag pushes, it implicitly ties the deployment to the tagged release build; however the remote commands explicitly reset to origin/main, so if the tag isn’t exactly the current HEAD of main (e.g., tagging a release branch, or main advancing after the tag is created), production will deploy a different commit than the release artifacts. That mismatch can ship untested code for that release tag. Consider checking out the tag/commit ref on the server instead of resetting to main.

Useful? React with 👍 / 👎.