From 129a8d421c24eb7b425f7971391c3ceb6e048f3f Mon Sep 17 00:00:00 2001
From: gunshiz <spsshop1047@gmail.com>
Date: Sat, 29 Aug 2026 06:18:59 +0000
Subject: [PATCH] ci(deploy): require explicit release enablement

---
 .gitea/workflows/ci.yml | 5 ++++-
 README.md               | 3 ++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 48aa9b2..74a6ea8 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -46,7 +46,10 @@ jobs:
   build-and-deploy:
     name: Build immutable images and deploy
     needs: verify
-    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
+    if: >-
+      gitea.event_name == 'push' &&
+      gitea.ref == 'refs/heads/main' &&
+      vars.DEPLOY_ENABLED == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
diff --git a/README.md b/README.md
index fe06ee3..1607788 100644
--- a/README.md
+++ b/README.md
@@ -237,7 +237,8 @@ kubectl kustomize k8s/ >/dev/null
 
 ### Gitea Actions release
 
-`.gitea/workflows/ci.yml` verifies every push and pull request. A successful
+`.gitea/workflows/ci.yml` verifies every push and pull request. After the
+repository variable `DEPLOY_ENABLED` is explicitly set to `true`, a successful
 push to `main` builds multi-architecture images at:
 
 ```text