Stage

[maxakuru]

Summary

Changes the CI deploy strategy so that stage deployments are gated behind merges to the stage branch rather than triggered by any PR to main. Previously, anyone with push permissions could deploy to stage just by opening a PR, meaning testing happened against a shared stage environment that any open PR could overwrite.

Changes

• deploy_stage.yml — trigger changed from pull_request → main to push → stage. The full pipeline (test → deploy → post-deploy smoke test) now runs only when code is merged into stage.
• test.yml (new) — runs the test job on PRs to both main and stage, so unit tests still gate every PR without touching a live environment.

Resulting flow

Branch	Trigger	Deploys to
PR → main / stage	pull request	nothing (tests only)
stage	push (merge)	Stage
main	push (merge)	Production

Notes

• The post-deploy smoke test hits the real deployed /version endpoint on the stage namespace, and now only runs post-merge — PRs never touch a live environment.
• deploy_stage.yml still runs test before deploying, so a broken merge to stage won't deploy.
• To fully enforce "only merges deploy," consider adding branch protection on stage (require PR + the Test check).