Update deploy.yaml trigger to be upon release publishing

[clairep94]

Issue:

Fixes #
Remake of #4252

• update deploy workflow trigger to be upon publishing a release on Github UI (instead of merges into the release branch)

Demo:

Changes:

I have verified that this pull request:

• has no linting errors (npm run lint)
• has no test errors (npm run test)
• has no typecheck errors (npm run typecheck)
• is from a uniquely-named feature branch and is up to date with the develop branch.
• is descriptively named and links to an issue number, i.e. Fixes #123
• meets the standards outlined in the accessibility guidelines

[clairep94]

Hold off on this one till #4281 is addressed

[Copilot]

🟡 Changes recommended

Deploy safety/traceability regressions are introduced by removing the previous branch/test gating and by not tagging images with the release version.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the production deployment GitHub Actions workflow to run when a GitHub Release is published, aligning deployments with the release-publishing flow instead of merges to a specific branch.

Changes:

• Switched deploy.yml trigger from workflow_run (Test on release branch) to release event (published).
• Updated checkout to build from the published release tag (github.event.release.tag_name).

File summaries

File	Description
.github/workflows/deploy.yml	Changes the deployment trigger to release.published and checks out the published release tag for the production build/deploy.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

A critical shell-injection vulnerability remains in release tag handling.

Review effort: Lite
Findings: 1

Open (1)

• Prevent shell injection through unquoted release tag · New

Resolved since last review (2)

• Switching from workflow_run on the release branch to release.published removes the previous…
• The workflow now checks out the release tag (github.event.release.tag_name), but the Docker image…

[Copilot]

Copilot review overview

🟡 Changes recommended

Passing release tags directly to Docker can block deployment for valid tags containing unsupported characters.

Review effort: Balanced
Findings: 1

Open (1)

• Avoid passing Git release tags with '+' as Docker tags · New

Resolved since last review (1)

• Prevent shell injection through unquoted release tag

[Copilot]

Copilot review overview

🟢 Approval recommended

The deployment gates and tag checkout match the documented release process, with no unresolved findings.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Avoid passing Git release tags with '+' as Docker tags