fix(ci): address review feedback

.github/workflows/ci.yaml

@@ -58,11 +58,13 @@ jobs:
     steps:
       - name: Require portions
         env:
+          AUTOFIX: ${{ needs.autofix.result }}
           CI: ${{ needs.ci.result }}
           STATIC: ${{ needs.static.result }}
           TERRAFORM: ${{ needs.terraform.result }}
         run: |
           set -euo pipefail
+          test "${AUTOFIX}" = success -o "${AUTOFIX}" = skipped
           test "${CI}" = success
           test "${STATIC}" = success
           test "${TERRAFORM}" = success

.github/workflows/deploy.yaml

@@ -14,9 +14,12 @@ on:
   push:
     branches: [main]
     paths-ignore:
+      # deploy.yaml is included so this transition commit does not start a
+      # prod deploy before the exec role can write the SSM contract.
       - "terraform/**"
       - "**/*.md"
       - ".github/workflows/ci.yaml"
+      - ".github/workflows/deploy.yaml"
       - ".github/workflows/labeler.yml"
       - ".github/workflows/dependency-review.yml"
   schedule: