ci(release): protect Cloudflare deployment dispatch

Gate Worker releases on protected-main environment policy and an
exact-SHA successful Static Checks run. Reject invalid refs before
checkout or dependency installation.

Author: iamjr15

.github/workflows/deploy-cloudflare.yml

@@ -8,14 +8,36 @@ concurrency:
   cancel-in-progress: false
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   deploy:
     name: Deploy Workers
     runs-on: ubuntu-24.04
     timeout-minutes: 45
+    environment: Production
     steps:
+      - name: Require main
+        run: test "$GITHUB_REF" = "refs/heads/main"
+
+      - name: Require successful static checks for this commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          successful_runs="$(gh api --method GET \
+            "repos/${GITHUB_REPOSITORY}/actions/workflows/static-checks.yml/runs" \
+            --field branch=main \
+            --field event=push \
+            --field head_sha="$GITHUB_SHA" \
+            --field per_page=1 \
+            --field status=success \
+            --jq '.total_count')"
+          if [ "$successful_runs" -lt 1 ]; then
+            echo "Static Checks has not succeeded for $GITHUB_SHA on main." >&2
+            exit 1
+          fi
+
       - name: Checkout reviewed release
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
@@ -25,9 +47,6 @@ jobs:
         with:
           release-sha: ${{ github.sha }}
 
-      - name: Require main
-        run: test "$GITHUB_REF" = "refs/heads/main"
-
       - name: Build Worker release
         run: >-
           pnpm exec turbo run build

README.md

@@ -238,6 +238,11 @@ declared workspace dependencies changed. Dispatch `Deploy Cloudflare` from
 gh workflow run deploy-cloudflare.yml --ref main
 ```
 
+The job runs under the protected `Production` environment, rejects non-`main`
+dispatches before checkout, and requires a successful `Static Checks` push run
+for the exact release commit before installing dependencies or accessing
+deployment credentials.
+
 The workflow builds the four Workers once, binds the reviewed commit SHA into
 each deployment, and publishes agent, webhooks, preview proxy, then gateway.
 Gateway goes last so public traffic sees the new backend only after its service