ci: gate manual staging on verified main (#27)

* ci: gate manual staging on verified main

* test: harden staging gate contract

Author: Programcode

.github/workflows/staging-e2e.yml

@@ -7,6 +7,8 @@ on:
   workflow_dispatch:
 
 permissions:
+  # Manual dispatch queries workflow runs for the selected main commit.
+  actions: read
   contents: read
 
 concurrency:
@@ -32,6 +34,20 @@ jobs:
           persist-credentials: false
           ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
 
+      - name: Verify selected commit passed the quality workflow
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          successful_runs="$(gh api \
+            "repos/${GITHUB_REPOSITORY}/actions/workflows/deploy.yml/runs?head_sha=${GITHUB_SHA}&event=push&status=success&per_page=1" \
+            --jq '.workflow_runs | length')"
+          if [ "$successful_runs" -ne 1 ]; then
+            echo "::error::The selected main commit has no successful push run of Build and Push Docker Image"
+            exit 1
+          fi
+
       - name: Set up Node
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:

src/test/runtime-contracts.test.ts

@@ -25,6 +25,12 @@ describe('runtime integration contracts', () => {
     const workflow = readProjectFile('.github/workflows/staging-e2e.yml');
     expect(workflow).not.toContain('actions/upload-artifact');
     expect(workflow).not.toContain('test-results/**/*.webm');
+    expect(workflow).toContain('actions: read');
+    expect(workflow).toContain('Verify selected commit passed the quality workflow');
+    expect(workflow).toContain("if: github.event_name == 'workflow_dispatch'");
+    expect(workflow).toContain('head_sha=${GITHUB_SHA}&event=push&status=success');
+    expect(workflow).toContain('if [ "$successful_runs" -ne 1 ]');
+    expect(workflow).toContain('exit 1');
   });
 
   it('keeps pull-request browser checks separate from Docker publication', () => {