refactor(ops): standardize image-based production delivery

.github/workflows/ci.yml

@@ -15,6 +15,27 @@ env:
   PNPM_VERSION: "9.14.2"
 
 jobs:
+  guardrails:
+    name: Architecture Guardrails
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: ${{ env.PNPM_VERSION }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Check architecture guardrails
+        run: pnpm check:architecture
+
   # ──────────────────────────────────────────────
   # Typecheck — ~40s, no services needed
   # ──────────────────────────────────────────────
@@ -147,7 +168,7 @@ jobs:
   # ──────────────────────────────────────────────
   build:
     name: Build
-    needs: [typecheck]
+    needs: [guardrails, typecheck]
     runs-on: ubuntu-latest
     env:
       DATABASE_URL: postgresql://placeholder:placeholder@localhost:5432/placeholder

.github/workflows/deploy-prod.yml

@@ -44,7 +44,7 @@ jobs:
           ssh-keyscan -p "${SSH_PORT:-22}" -H "${SSH_HOST}" >> ~/.ssh/known_hosts
 
       - name: Bundle deploy assets
-        run: tar czf deploy-bundle.tgz docker-compose.cicd.yml tooling/deploy
+        run: tar czf deploy-bundle.tgz docker-compose.prod.yml tooling/deploy
 
       - name: Copy deploy assets to production
         env:

.github/workflows/deploy-staging.yml

@@ -44,7 +44,7 @@ jobs:
           ssh-keyscan -p "${SSH_PORT:-22}" -H "${SSH_HOST}" >> ~/.ssh/known_hosts
 
       - name: Bundle deploy assets
-        run: tar czf deploy-bundle.tgz docker-compose.cicd.yml tooling/deploy
+        run: tar czf deploy-bundle.tgz docker-compose.prod.yml tooling/deploy
 
       - name: Copy deploy assets to staging
         env:

.github/workflows/release-image.yml

@@ -1,6 +1,8 @@
 name: Release Image
 
 on:
+  push:
+    branches: [main]
   workflow_dispatch:
     inputs:
       image_tag:
@@ -61,3 +63,12 @@ jobs:
           tags: ${{ steps.vars.outputs.migrator_image }}
           cache-from: type=gha,scope=migrator-image
           cache-to: type=gha,mode=max,scope=migrator-image
+
+      - name: Publish release summary
+        run: |
+          {
+            echo "## Image release"
+            echo
+            echo "- App image: \`${{ steps.vars.outputs.app_image }}\`"
+            echo "- Migrator image: \`${{ steps.vars.outputs.migrator_image }}\`"
+          } >> "$GITHUB_STEP_SUMMARY"