/

scripts/check-artifact-pinning.sh

@@ -119,9 +119,12 @@ check_workflow_gates() {
     if ! grep -Eq '^    needs: \[build-and-push-backend, build-and-push-frontend, security-scan\]$' "$WORKFLOW"; then
         fail "deploy обязан зависеть от успешного security-scan"
     fi
-    if ! grep -Eq '^[[:space:]]{2}workflow_dispatch:[[:space:]]*$' "$WORKFLOW" \
-            || ! grep -Fq "if: \${{ gitea.event_name == 'workflow_dispatch' }}" "$WORKFLOW"; then
-        fail "production deploy должен запускаться только через ручной workflow_dispatch"
+    if ! grep -Eq '^[[:space:]]{2}push:[[:space:]]*$' "$WORKFLOW" \
+            || ! grep -Eq '^[[:space:]]{6}- main[[:space:]]*$' "$WORKFLOW"; then
+        fail "production deploy должен автоматически запускаться после push в main"
+    fi
+    if grep -Fq "if: \${{ gitea.event_name == 'workflow_dispatch' }}" "$WORKFLOW"; then
+        fail "production deploy не должен требовать ручной workflow_dispatch"
     fi
 
     if ! grep -Eq '^      KUBECTL_VERSION: v[0-9]+\.[0-9]+\.[0-9]+$' "$WORKFLOW" \