deploy: staging-first — main uploads a staging version, production deploys only on v* tags

Pushing to main must never claim api.interscript.org. Production
flips exclusively via a tagged release, behind the production
environment gate. AWS Lambda remains the live fallback until the
explicit cutover tag.

Author: ronaldtse

.github/workflows/deploy.yml

@@ -6,15 +6,31 @@ on:
     tags: ["v*"]
 
 jobs:
-  deploy:
+  deploy-staging:
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with: { node-version: "22" }
       - run: npm install
-      - name: Deploy (staging on main, production on tags)
-        run: npx wrangler deploy
+      # Staging only: the workers.dev preview URL, never the production
+      # route. Production flips exclusively via a v* tag.
+      - run: npx wrangler versions upload --name interscript-api-staging
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+
+  deploy-production:
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: "22" }
+      - run: npm install
+      - run: npx wrangler deploy
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}