ci: require manual gated releases from main

deploy/test_production_preflight.py

@@ -1,8 +1,27 @@
 import unittest
+from pathlib import Path
 
 from .production_preflight import config_errors, source_errors
 
 
+class ReleaseWorkflowTests(unittest.TestCase):
+    def test_main_push_cannot_publish_and_manual_release_is_gated(self):
+        workflow = (Path(__file__).resolve().parents[1] /
+                    '.gitea/workflows/deploy.yml').read_text()
+        release = workflow.split('  publish-and-deploy:\n', 1)[1]
+        self.assertIn("if: gitea.event_name == 'workflow_dispatch' && "
+                      "gitea.ref == 'refs/heads/main'", release)
+        preflight = release.index('python3 deploy/production_preflight.py --source-only')
+        webhook = release.index('test -n "$PORTAINER_WEBHOOK"')
+        scan = release.index('- name: Image vulnerabilities')
+        publish = release.index('- name: Publish validated images')
+        redeploy = release.index('- name: Trigger Portainer redeployment')
+        self.assertLess(preflight, scan)
+        self.assertLess(webhook, scan)
+        self.assertLess(scan, publish)
+        self.assertLess(publish, redeploy)
+
+
 def valid_config():
     digest = '1' * 64
     values = {