[cbetta]

Reviewer check	This PR
Auth / permissions	No
Data access widened	No
New secret, env var or key	No
CI, deploy or infra	Yes: .github/workflows/publish.yml
Dependencies added or bumped	No
Copilot	Clean: no findings
Security review	Not run (two-line CI guard)

A manual workflow_dispatch run on a branch pushed that branch as :master, which jiji then deploys; now only master publishes.

  publish:
    needs: ci
    # A manual run can pick any branch; only master ever becomes :master.
    if: github.ref == 'refs/heads/master'

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The condition blocks non-master publishing while preserving the existing CI gate and publishing permissions.

No open issues 🎉

What changed in this PR

Restricts image publishing to master, preventing manual runs on other branches from publishing an image tagged :master for deployment.

Changes:

• Adds a job-level branch condition while preserving the existing CI dependency.
• Documents why manual runs need this restriction.

File	Description
.github/​workflows/​publish.yml	Allows the publish job to run only for refs/heads/master.

_{Review effort: Balanced}