From e9e0b2c19ca213d7153641b0fab2f116e89fd224 Mon Sep 17 00:00:00 2001
From: pavlov346346-source <pavlov346346@gmail.com>
Date: Wed, 9 Sep 2026 19:08:34 +0300
Subject: [PATCH] infra: promote verified main to production

---
 .github/workflows/promote-production.yml | 45 ++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 .github/workflows/promote-production.yml

diff --git a/.github/workflows/promote-production.yml b/.github/workflows/promote-production.yml
new file mode 100644
index 0000000..00182c7
--- /dev/null
+++ b/.github/workflows/promote-production.yml
@@ -0,0 +1,45 @@
+name: Caterium Promote Production
+
+on:
+  workflow_run:
+    workflows: ["Caterium QA"]
+    types: [completed]
+
+permissions:
+  contents: write
+
+concurrency:
+  group: caterium-production-promotion
+  cancel-in-progress: false
+
+jobs:
+  promote:
+    if: >-
+      ${{ github.event.workflow_run.conclusion == 'success' &&
+          github.event.workflow_run.event == 'push' &&
+          github.event.workflow_run.head_branch == 'main' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout verified main
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Verify promoted commit
+        shell: bash
+        run: |
+          set -euo pipefail
+          expected="${{ github.event.workflow_run.head_sha }}"
+          actual="$(git rev-parse HEAD)"
+          if [ "$actual" != "$expected" ]; then
+            echo "Refusing promotion: main moved after the verified QA run."
+            echo "verified=$expected current=$actual"
+            exit 1
+          fi
+
+      - name: Promote to production branch
+        shell: bash
+        run: |
+          set -euo pipefail
+          git push origin HEAD:refs/heads/production