From c8762c2ff90123f56a18fa52ccd22e72518dc397 Mon Sep 17 00:00:00 2001
From: Daniel Griesser <daniel.griesser.86@gmail.com>
Date: Tue, 11 Aug 2026 10:35:26 +0200
Subject: [PATCH] feat(deploy): deploy Cloudflare production on master pushes

Run the existing verified deployment pipeline automatically after changes land on master while retaining a master-only manual retry path. Document the required Cloudflare credentials and production deployment sequence so repository setup remains reproducible.
---
 .github/workflows/deploy.yml | 14 ++++++--------
 README.md                    | 11 +++++++++++
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 6afc227..b06b511 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,12 +1,10 @@
-name: Deploy Cloudflare environment
+name: Deploy Cloudflare production
 
 on:
+  push:
+    branches:
+      - master
   workflow_dispatch:
-    inputs:
-      confirm:
-        description: Type deploy-hackweek after operator review
-        required: true
-        type: string
 
 permissions:
   contents: read
@@ -17,11 +15,11 @@ concurrency:
 
 jobs:
   verify:
-    if: inputs.confirm == 'deploy-hackweek'
+    if: github.ref == 'refs/heads/master'
     uses: ./.github/workflows/test.yml
 
   deploy:
-    name: Deploy reviewed configuration
+    name: Deploy production
     needs: verify
     runs-on: ubuntu-latest
     environment: hackweek-cloudflare
diff --git a/README.md b/README.md
index bce12a0..3c5ed6b 100644
--- a/README.md
+++ b/README.md
@@ -7,6 +7,17 @@ Hackweek is an internal React + TypeScript application served by one Hono Cloudf
 - Node.js 24.11 or newer (Volta and CI pin 24.19)
 - npm 11 or newer
 
+## Deployment
+
+Every push to `master` runs the full verification suite, applies pending D1 migrations, and deploys the Worker and static assets to Cloudflare production through [`.github/workflows/deploy.yml`](.github/workflows/deploy.yml). The workflow can also be retried manually from `master`; other refs cannot deploy production.
+
+The workflow requires these GitHub Actions secrets:
+
+- `CLOUDFLARE_ACCOUNT_ID`: the Sentry Production Cloudflare account ID.
+- `CLOUDFLARE_API_TOKEN`: an account-scoped token with **Edit Cloudflare Workers** and **D1 Edit** permissions.
+
+Production deploys use [`wrangler.production.json`](wrangler.production.json) and the `hackweek-cloudflare` GitHub environment. Do not add Cloudflare credentials to the repository.
+
 ## Deterministic local start
 
 ```bash