# Deploy Workflow Porting

Port deploy workflows after tests pass. Deploys often need secrets and remote side effects.

Guard required secrets explicitly and skip deploy-only steps when secrets are absent so the default branch remains green while configuration is pending.

```bash
missing=()

for required_var in SPARK_EMAIL SPARK_KEY TIPTAP_PRO_KEY DO_SPACES_KEY DO_SPACES_SECRET DO_SPACES_ENDPOINT DO_SPACES_REGION; do
  if [ -z "${!required_var}" ]; then
    missing+=("$required_var")
  fi
done

if [ "${#missing[@]}" -gt 0 ]; then
  echo "Skipping deploy because required secrets are missing: ${missing[*]}"
  echo "SKIP_DEPLOY=true" >> "$GITHUB_ENV"
fi
```

Gate deploy steps:

```yaml
if: env.SKIP_DEPLOY != 'true'
```

File follow-up work for missing secrets. Do not manually dispatch deploy workflows that upload assets or mutate production unless the user explicitly approves.