Merge 786e514334 into f194d65ee5

.github/workflows/deploy.yaml

@@ -6,7 +6,7 @@ name: Deploy
 #
 #   push to main       -> prod
 #   weekday cron       -> prod (Paychex listings, no commit)
-#   workflow_dispatch  -> prod
+#   workflow_dispatch  -> prod, the main commit only
 #
 # Vercel previews branches other than main.
 
@@ -27,12 +27,6 @@ on:
     # without a commit. A failed feed fetch aborts before the S3 sync.
     - cron: "0 13 * * 1-5"
   workflow_dispatch:
-    inputs:
-      ref:
-        description: "Git ref to build and deploy. Empty means the workflow ref."
-        required: false
-        type: string
-        default: ""
 
 permissions:
   contents: read
@@ -47,7 +41,6 @@ jobs:
     secrets: inherit
     with:
       environment: prod
-      ref: ${{ inputs.ref }}
       ssm-prefix: /seahaven-site/deploy
       output-dir: _site
       required-paths: _site/index.html,_site/contact/index.html,_site/404.html

terraform/iam_github_deploy.tf

@@ -1,6 +1,6 @@
 data "aws_iam_policy_document" "github_deploy_assume" {
   # Legacy branch trust. Remove after one deploy through cd-hcp-static has
-  # succeeded. The inline workflow still assumes this subject until then.
+  # succeeded. The branch subject stays until EnvironmentProd is applied.
   statement {
     sid     = "LegacyBranch"
     effect  = "Allow"