From 825b08d0c807eea2d1d9d0e24981fc6259303201 Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Sat, 27 Jun 2026 09:19:59 +0800
Subject: [PATCH] Deploy Cloud Run only after CI passes on main push.

Trigger deploy via workflow_run instead of parallel push, so main
only publishes when unit tests succeed. Manual workflow_dispatch unchanged.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/sync-cloud-run-env.yml | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/sync-cloud-run-env.yml b/.github/workflows/sync-cloud-run-env.yml
index 1b5ee45..25e03ba 100644
--- a/.github/workflows/sync-cloud-run-env.yml
+++ b/.github/workflows/sync-cloud-run-env.yml
@@ -1,8 +1,10 @@
 name: Deploy Cloud Run
 
 on:
-  push:
-    branches: [ main ]
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [main]
   workflow_dispatch:
 
 env:
@@ -22,9 +24,17 @@ concurrency:
 jobs:
   deploy-cloud-run:
     name: Deploy Cloud Run
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      (
+        github.event_name == 'workflow_run' &&
+        github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.event == 'push'
+      )
     runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions:
+      actions: read
       contents: read
       id-token: write
     env:
@@ -169,6 +179,8 @@ jobs:
       - name: Checkout repository
         if: steps.deploy_config.outputs.enabled == 'true'
         uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
 
       - name: Validate deploy inputs
         if: steps.deploy_config.outputs.enabled == 'true'