From 1ddda05d3aac30a6f9cb835a2a56d1555caf6cd2 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Tue, 6 Oct 2026 21:37:48 +0530
Subject: [PATCH 1/9] feat(*): update the deployment script

---
 .github/actions/discord-notify/action.yml | 60 ++++++++++++++++
 .github/workflows/create-release.yml      | 83 ++++++++++++++++++++---
 .github/workflows/deploy-staging.yml      | 74 ++++++++++++++------
 3 files changed, 187 insertions(+), 30 deletions(-)
 create mode 100644 .github/actions/discord-notify/action.yml

diff --git a/.github/actions/discord-notify/action.yml b/.github/actions/discord-notify/action.yml
new file mode 100644
index 0000000..e9a214f
--- /dev/null
+++ b/.github/actions/discord-notify/action.yml
@@ -0,0 +1,60 @@
+name: Discord deploy notification
+description: Post a green (healthy) or red (failed) deploy-status embed to Discord.
+
+inputs:
+  webhook-url:
+    description: Discord webhook URL. When empty, the step is a no-op.
+    required: true
+  name:
+    description: Deploy target name shown in the title (e.g. kaapi-staging).
+    required: true
+  release:
+    description: Release identifier (tag or run number).
+    required: true
+  sha:
+    description: Full commit SHA; truncated to 7 chars for display.
+    required: true
+  run-url:
+    description: Link to the workflow run.
+    required: true
+  ok:
+    description: "'true' for a healthy deploy; anything else renders as failed."
+    required: true
+  failure-reason:
+    description: Optional extra line explaining a failure (e.g. CI blocked the release).
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        DISCORD_WEBHOOK_URL: ${{ inputs.webhook-url }}
+        NAME: ${{ inputs.name }}
+        RELEASE: ${{ inputs.release }}
+        SHA: ${{ inputs.sha }}
+        RUN_URL: ${{ inputs.run-url }}
+        OK: ${{ inputs.ok }}
+        REASON: ${{ inputs.failure-reason }}
+      run: |
+        [ -z "$DISCORD_WEBHOOK_URL" ] && { echo "No webhook configured, skipping"; exit 0; }
+        if [ "$OK" = "true" ]; then
+          TITLE="🟢 $NAME deployment healthy"; COLOR=3066993   # green
+        else
+          TITLE="🔴 $NAME deployment failed";  COLOR=15158332  # red
+        fi
+        SHA_SHORT=$(echo "$SHA" | cut -c1-7)
+
+        fields=$(jq -n --arg release "$RELEASE" --arg sha "$SHA_SHORT" \
+          '[{name:"Release",value:$release,inline:true},{name:"SHA",value:$sha,inline:true}]')
+        # Only a failed deploy with a stated cause gets the extra Reason line.
+        if [ "$OK" != "true" ] && [ -n "$REASON" ]; then
+          fields=$(echo "$fields" | jq --arg r "$REASON" '. + [{name:"Reason",value:$r,inline:false}]')
+        fi
+
+        payload=$(jq -n --arg title "$TITLE" --argjson color "$COLOR" \
+          --arg url "$RUN_URL" --argjson fields "$fields" \
+          '{embeds:[{title:$title,url:$url,color:$color,fields:$fields,timestamp:(now|todate)}]}')
+        curl -sf -H "Content-Type: application/json" -X POST -d "$payload" "$DISCORD_WEBHOOK_URL" \
+          || echo "Discord notification failed to send"
diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index 1138e35..ac95016 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -5,28 +5,52 @@ on:
     tags:
       - "v[0-9]+.[0-9]+.[0-9]+" # Deploy only when tags like v1.0.0, v2.1.0, etc., are created
 
+concurrency:
+  group: production-ec2-deploy
+  cancel-in-progress: false
+
 jobs:
+  verify-ci:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - name: Confirm CI passed on the tagged commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          SHA="${{ github.sha }}"
+          echo "Checking Kaapi CI conclusion for ${SHA}"
+          CONCLUSION=$(gh api \
+            "repos/${{ github.repository }}/actions/runs?head_sha=${SHA}" \
+            --jq 'first(.workflow_runs[]
+                    | select(.name == "Kaapi CI" and .status == "completed")
+                    | .conclusion) // "missing"')
+          echo "Kaapi CI conclusion: ${CONCLUSION}"
+          if [ "${CONCLUSION}" != "success" ]; then
+            echo "::error::Kaapi CI has not passed for ${SHA} (conclusion: ${CONCLUSION}). Aborting release."
+            exit 1
+          fi
+
   deploy:
+    needs: verify-ci
     runs-on: ubuntu-latest
     environment: AWS_ENV
 
     permissions:
-      packages: write
-      contents: read
-      attestations: write
       id-token: write
+      contents: read
 
     steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v6
-
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
           aws-region: ${{ secrets.AWS_REGION }}
 
-      - name: Deploy via SSM
+      - name: Trigger deploy on EC2 via SSM
         id: ssm
         env:
           BUILD_DIRECTORY: ${{ secrets.BUILD_DIRECTORY }}
@@ -34,16 +58,36 @@ jobs:
           AWS_REGION: ${{ secrets.AWS_REGION }}
           INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
           ROOT_USER: ${{ secrets.USER }}
+          DEPLOY_SHA: ${{ github.sha }}
         run: |
-          REMOTE_CMD="export HOME=/home/$ROOT_USER && export NVM_DIR="/home/$ROOT_USER/.nvm" && [ -s "\$NVM_DIR/nvm.sh" ] && \. "\$NVM_DIR/nvm.sh" && git config --global --add safe.directory ${BUILD_DIRECTORY} && set -e && cd ${BUILD_DIRECTORY} && git pull origin main && npm ci && npm run build && sudo -iu ${ROOT_USER} pm2 restart ${APP_NAME}"
+          : "${BUILD_DIRECTORY:?BUILD_DIRECTORY secret is not set}"
+          echo "Deploying commit: $DEPLOY_SHA to $BUILD_DIRECTORY"
+
+          # nvm is sourced before `set -e` since nvm.sh can return non-zero internally.
+          REMOTE_CMD="export HOME=/home/$ROOT_USER \
+            && export NVM_DIR=/home/$ROOT_USER/.nvm \
+            && . \$NVM_DIR/nvm.sh \
+            && set -e \
+            && git config --global --add safe.directory $BUILD_DIRECTORY \
+            && cd $BUILD_DIRECTORY \
+            && git fetch origin --tags --prune \
+            && git checkout $DEPLOY_SHA \
+            && npm ci \
+            && npm run build \
+            && sudo -iu $ROOT_USER pm2 restart $APP_NAME"
+
+          # Build the parameters as JSON so quoting in REMOTE_CMD can't break it.
+          PARAMS=$(jq -n --arg cmd "$REMOTE_CMD" '{commands: [$cmd]}')
+
           CMD_ID=$(aws ssm send-command \
             --instance-ids "$INSTANCE_ID" \
             --document-name "AWS-RunShellScript" \
-            --parameters commands="[\"$REMOTE_CMD\"]" \
+            --comment "Deploy kaapi-frontend ${{ github.ref_name }}" \
+            --parameters "$PARAMS" \
             --region "$AWS_REGION" \
-            --query 'Command.CommandId' \
-            --output text)
+            --query "Command.CommandId" --output text)
           echo "cmd_id=$CMD_ID" >> "$GITHUB_OUTPUT"
+          echo "Sent SSM command: $CMD_ID"
 
       - name: Wait for SSM command to finish
         timeout-minutes: 20
@@ -83,3 +127,20 @@ jobs:
             --instance-id "$INSTANCE_ID" \
             --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
             --output json
+
+  notify:
+    needs: [verify-ci, deploy]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/discord-notify
+        with:
+          webhook-url: ${{ secrets.DISCORD_WEBHOOK_URL }}
+          name: kaapi-frontend-production
+          release: ${{ github.ref_name }}
+          sha: ${{ github.sha }}
+          run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          ok: ${{ needs.deploy.result == 'success' }}
+          # Call out the specific case where the release was blocked by CI.
+          failure-reason: ${{ needs.verify-ci.result != 'success' && 'CI never passed on the tagged commit — release blocked.' || '' }}
diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 01eafc8..715758d 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -1,49 +1,70 @@
-name: Deploy Kaapi to EC2 Staging
+name: Deploy Kaapi to Non-Prod EC2 (Staging)
 
 on:
-  push:
-    branches:
-      - main # Deploy only when changes are pushed to the main branch
+  workflow_run:
+    workflows: ["Kaapi CI"]
+    branches: [main]
+    types: [completed]
+  workflow_dispatch:
+
+concurrency:
+  group: staging-ec2-deploy
+  cancel-in-progress: false
 
 jobs:
   deploy:
     runs-on: ubuntu-latest
-    environment: AWS_ENV
+    environment: Staging
+    # workflow_dispatch runs unconditionally; workflow_run only on a green CI from a push to main (not PRs).
+    if: >-
+      ${{ github.event_name == 'workflow_dispatch' ||
+          (github.event.workflow_run.conclusion == 'success' &&
+           github.event.workflow_run.event == 'push') }}
 
     permissions:
-      packages: write
-      contents: read
-      attestations: write
       id-token: write
+      contents: read
 
     steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v6
-
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v6
         with:
-          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          role-to-assume: ${{ secrets.DEPLOY_ROLE_ARN }}
           aws-region: ${{ secrets.AWS_REGION }}
 
-      - name: Deploy via SSM
+      - name: Trigger deploy on EC2 via SSM
         id: ssm
         env:
           BUILD_DIRECTORY: ${{ secrets.BUILD_DIRECTORY }}
           APP_NAME: ${{ secrets.PM2_APP_NAME }}
           AWS_REGION: ${{ secrets.AWS_REGION }}
-          INSTANCE_ID: ${{ secrets.EC2_STAGING_INSTANCE_ID }}
-          ROOT_USER: ${{ secrets.USER }}
+          INSTANCE_ID: ${{ secrets.INSTANCE_ID }}
+          DEPLOY_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
         run: |
-          REMOTE_CMD="export HOME=/home/$ROOT_USER && export NVM_DIR="/home/$ROOT_USER/.nvm" && [ -s "\$NVM_DIR/nvm.sh" ] && \. "\$NVM_DIR/nvm.sh" && git config --global --add safe.directory ${BUILD_DIRECTORY} && set -e && cd ${BUILD_DIRECTORY} && git pull origin main && npm ci && npm run build && sudo -iu ${ROOT_USER} pm2 restart ${APP_NAME}"
+          : "${BUILD_DIRECTORY:?BUILD_DIRECTORY secret is not set}"
+          echo "Deploying commit: $DEPLOY_SHA to $BUILD_DIRECTORY"
+
+          REMOTE_CMD="set -e \
+            && git config --global --add safe.directory $BUILD_DIRECTORY \
+            && cd $BUILD_DIRECTORY \
+            && git fetch origin --tags --prune \
+            && git checkout $DEPLOY_SHA \
+            && npm ci \
+            && npm run build \
+            && pm2 restart $APP_NAME"
+
+          # Build the parameters as JSON so quoting in REMOTE_CMD can't break it.
+          PARAMS=$(jq -n --arg cmd "$REMOTE_CMD" '{commands: [$cmd]}')
+
           CMD_ID=$(aws ssm send-command \
             --instance-ids "$INSTANCE_ID" \
             --document-name "AWS-RunShellScript" \
-            --parameters commands="[\"$REMOTE_CMD\"]" \
+            --comment "Deploy kaapi-frontend kaapi-staging" \
+            --parameters "$PARAMS" \
             --region "$AWS_REGION" \
-            --query 'Command.CommandId' \
-            --output text)
+            --query "Command.CommandId" --output text)
           echo "cmd_id=$CMD_ID" >> "$GITHUB_OUTPUT"
+          echo "Sent SSM command: $CMD_ID"
 
       - name: Wait for SSM command to finish
         timeout-minutes: 20
@@ -83,3 +104,18 @@ jobs:
             --instance-id "$INSTANCE_ID" \
             --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
             --output json
+
+  notify:
+    needs: [deploy]
+    if: ${{ always() && needs.deploy.result != 'skipped' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/discord-notify
+        with:
+          webhook-url: ${{ secrets.DISCORD_WEBHOOK_URL }}
+          name: kaapi-frontend-non-prod
+          release: "#${{ github.run_number }}"
+          sha: ${{ github.event.workflow_run.head_sha || github.sha }}
+          run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          ok: ${{ needs.deploy.result == 'success' }}

From 458b0d9e1ed8d0bb6b0f8fbefd22de85b6b437f0 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Tue, 6 Oct 2026 21:41:44 +0530
Subject: [PATCH 2/9] fix(*): remove the unwanted comments

---
 .github/workflows/create-release.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index ac95016..7d110fb 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -63,7 +63,6 @@ jobs:
           : "${BUILD_DIRECTORY:?BUILD_DIRECTORY secret is not set}"
           echo "Deploying commit: $DEPLOY_SHA to $BUILD_DIRECTORY"
 
-          # nvm is sourced before `set -e` since nvm.sh can return non-zero internally.
           REMOTE_CMD="export HOME=/home/$ROOT_USER \
             && export NVM_DIR=/home/$ROOT_USER/.nvm \
             && . \$NVM_DIR/nvm.sh \

From cc12ff3c1c7a3813e0a730591396a8c572ad7767 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Wed, 7 Oct 2026 22:36:26 +0530
Subject: [PATCH 3/9] fix(*): script updates

---
 .github/workflows/create-release.yml | 9 ++-------
 .github/workflows/deploy-staging.yml | 3 +--
 2 files changed, 3 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index 7d110fb..9a5ab6b 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -57,23 +57,18 @@ jobs:
           APP_NAME: ${{ secrets.PM2_APP_NAME }}
           AWS_REGION: ${{ secrets.AWS_REGION }}
           INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
-          ROOT_USER: ${{ secrets.USER }}
           DEPLOY_SHA: ${{ github.sha }}
         run: |
           : "${BUILD_DIRECTORY:?BUILD_DIRECTORY secret is not set}"
           echo "Deploying commit: $DEPLOY_SHA to $BUILD_DIRECTORY"
 
-          REMOTE_CMD="export HOME=/home/$ROOT_USER \
-            && export NVM_DIR=/home/$ROOT_USER/.nvm \
-            && . \$NVM_DIR/nvm.sh \
-            && set -e \
-            && git config --global --add safe.directory $BUILD_DIRECTORY \
+          REMOTE_CMD="git config --global --add safe.directory $BUILD_DIRECTORY \
             && cd $BUILD_DIRECTORY \
             && git fetch origin --tags --prune \
             && git checkout $DEPLOY_SHA \
             && npm ci \
             && npm run build \
-            && sudo -iu $ROOT_USER pm2 restart $APP_NAME"
+            && pm2 restart $APP_NAME"
 
           # Build the parameters as JSON so quoting in REMOTE_CMD can't break it.
           PARAMS=$(jq -n --arg cmd "$REMOTE_CMD" '{commands: [$cmd]}')
diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 715758d..0e3ee05 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -44,8 +44,7 @@ jobs:
           : "${BUILD_DIRECTORY:?BUILD_DIRECTORY secret is not set}"
           echo "Deploying commit: $DEPLOY_SHA to $BUILD_DIRECTORY"
 
-          REMOTE_CMD="set -e \
-            && git config --global --add safe.directory $BUILD_DIRECTORY \
+          REMOTE_CMD="git config --global --add safe.directory $BUILD_DIRECTORY \
             && cd $BUILD_DIRECTORY \
             && git fetch origin --tags --prune \
             && git checkout $DEPLOY_SHA \

From e9dbba325ef9b7013555fdadab14349f628ad8d5 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Wed, 7 Oct 2026 22:37:03 +0530
Subject: [PATCH 4/9] fix(*): update workflow name

---
 .github/workflows/deploy-staging.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 0e3ee05..c7c59c6 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -1,4 +1,4 @@
-name: Deploy Kaapi to Non-Prod EC2 (Staging)
+name: Deploy Kaapi to EC2 Staging
 
 on:
   workflow_run:

From cdb9a9c4ad2771b91554352392e981f29c41daba Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Fri, 9 Oct 2026 10:51:01 +0530
Subject: [PATCH 5/9] fix(*): initiate build

---
 .github/workflows/deploy-staging.yml | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index c7c59c6..6fd4e35 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -1,10 +1,12 @@
 name: Deploy Kaapi to EC2 Staging
 
 on:
-  workflow_run:
-    workflows: ["Kaapi CI"]
-    branches: [main]
-    types: [completed]
+  # workflow_run:
+  #   workflows: ["Kaapi CI"]
+  #   branches: [main]
+  #   types: [completed]
+  push:
+    branches: [feat/deployment-script-improvements]
   workflow_dispatch:
 
 concurrency:
@@ -17,9 +19,8 @@ jobs:
     environment: Staging
     # workflow_dispatch runs unconditionally; workflow_run only on a green CI from a push to main (not PRs).
     if: >-
-      ${{ github.event_name == 'workflow_dispatch' ||
-          (github.event.workflow_run.conclusion == 'success' &&
-           github.event.workflow_run.event == 'push') }}
+      ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' ||
+          github.event.workflow_run.conclusion == 'success' }}
 
     permissions:
       id-token: write

From 92e0457ddf94a3ddc18f19c281d91e85a698d4e5 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Fri, 9 Oct 2026 10:54:48 +0530
Subject: [PATCH 6/9] fix(*): update the variable name

---
 .github/workflows/deploy-staging.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 6fd4e35..cbc297c 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -69,9 +69,11 @@ jobs:
       - name: Wait for SSM command to finish
         timeout-minutes: 20
         env:
-          INSTANCE_ID: ${{ secrets.EC2_STAGING_INSTANCE_ID }}
+          INSTANCE_ID: ${{ secrets.INSTANCE_ID }}
           CMD_ID: ${{ steps.ssm.outputs.cmd_id }}
         run: |
+          : "${INSTANCE_ID:?INSTANCE_ID secret is not set}"
+          : "${CMD_ID:?SSM command ID missing from previous step}"
           while true; do
             if aws ssm wait command-executed \
               --command-id "$CMD_ID" \

From 2a5e7f524a8b222aaa119e81f2d2178c35f6fbc3 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Fri, 9 Oct 2026 10:59:48 +0530
Subject: [PATCH 7/9] fix(*): initiate build

---
 .github/workflows/deploy-staging.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index cbc297c..81181b1 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -40,18 +40,23 @@ jobs:
           APP_NAME: ${{ secrets.PM2_APP_NAME }}
           AWS_REGION: ${{ secrets.AWS_REGION }}
           INSTANCE_ID: ${{ secrets.INSTANCE_ID }}
+          ROOT_USER: ${{ secrets.USER }}
           DEPLOY_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
         run: |
           : "${BUILD_DIRECTORY:?BUILD_DIRECTORY secret is not set}"
+          : "${ROOT_USER:?USER secret is not set}"
           echo "Deploying commit: $DEPLOY_SHA to $BUILD_DIRECTORY"
 
-          REMOTE_CMD="git config --global --add safe.directory $BUILD_DIRECTORY \
+          REMOTE_CMD="export HOME=/home/$ROOT_USER \
+            && export NVM_DIR=/home/$ROOT_USER/.nvm \
+            && . \$NVM_DIR/nvm.sh \
+            && git config --global --add safe.directory $BUILD_DIRECTORY \
             && cd $BUILD_DIRECTORY \
             && git fetch origin --tags --prune \
             && git checkout $DEPLOY_SHA \
             && npm ci \
             && npm run build \
-            && pm2 restart $APP_NAME"
+            && sudo -iu $ROOT_USER pm2 restart $APP_NAME"
 
           # Build the parameters as JSON so quoting in REMOTE_CMD can't break it.
           PARAMS=$(jq -n --arg cmd "$REMOTE_CMD" '{commands: [$cmd]}')

From b6215c6216cd36cadc83bea08b51ea26cefcded8 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Fri, 9 Oct 2026 11:04:18 +0530
Subject: [PATCH 8/9] fix(*): revert the last changes

---
 .github/workflows/deploy-staging.yml | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 81181b1..efdfc9a 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -1,12 +1,10 @@
 name: Deploy Kaapi to EC2 Staging
 
 on:
-  # workflow_run:
-  #   workflows: ["Kaapi CI"]
-  #   branches: [main]
-  #   types: [completed]
-  push:
-    branches: [feat/deployment-script-improvements]
+  workflow_run:
+    workflows: ["Kaapi CI"]
+    branches: [main]
+    types: [completed]
   workflow_dispatch:
 
 concurrency:
@@ -19,7 +17,7 @@ jobs:
     environment: Staging
     # workflow_dispatch runs unconditionally; workflow_run only on a green CI from a push to main (not PRs).
     if: >-
-      ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' ||
+      ${{ github.event_name == 'workflow_dispatch' ||
           github.event.workflow_run.conclusion == 'success' }}
 
     permissions:
@@ -121,7 +119,7 @@ jobs:
       - uses: ./.github/actions/discord-notify
         with:
           webhook-url: ${{ secrets.DISCORD_WEBHOOK_URL }}
-          name: kaapi-frontend-non-prod
+          name: kaapi-frontend-staging
           release: "#${{ github.run_number }}"
           sha: ${{ github.event.workflow_run.head_sha || github.sha }}
           run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

From 3d359f053c1c00e8dffb8c121bd2ca38f539f612 Mon Sep 17 00:00:00 2001
From: Ayush8923 <80516839+Ayush8923@users.noreply.github.com>
Date: Mon, 12 Oct 2026 14:20:43 +0530
Subject: [PATCH 9/9] fix(*): remove the unwanted echo

---
 .github/workflows/create-release.yml | 1 -
 .github/workflows/deploy-staging.yml | 1 -
 2 files changed, 2 deletions(-)

diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index 9a5ab6b..f54ef26 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -60,7 +60,6 @@ jobs:
           DEPLOY_SHA: ${{ github.sha }}
         run: |
           : "${BUILD_DIRECTORY:?BUILD_DIRECTORY secret is not set}"
-          echo "Deploying commit: $DEPLOY_SHA to $BUILD_DIRECTORY"
 
           REMOTE_CMD="git config --global --add safe.directory $BUILD_DIRECTORY \
             && cd $BUILD_DIRECTORY \
diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index efdfc9a..b92c758 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -43,7 +43,6 @@ jobs:
         run: |
           : "${BUILD_DIRECTORY:?BUILD_DIRECTORY secret is not set}"
           : "${ROOT_USER:?USER secret is not set}"
-          echo "Deploying commit: $DEPLOY_SHA to $BUILD_DIRECTORY"
 
           REMOTE_CMD="export HOME=/home/$ROOT_USER \
             && export NVM_DIR=/home/$ROOT_USER/.nvm \