Refactor CI/CD: split CI from CD, tag-only deploys, manual redeploy gate

- test job runs on all push events (branch + tag); publish/deploy only on v* tags
- deploy uses semver version tag instead of SHA for traceability
- add workflow_dispatch to redeploy a specific existing version
- remove latest and SHA Docker tags; add major.minor floating tag
- update CLAUDE.md and release.md to reflect new workflow

Author: jumpbetweenrows

.claude/CLAUDE.md

@@ -26,7 +26,11 @@ git config core.hooksPath .githooks
 ```
 
 ## CI/CD
-Push to `main` → GitHub Actions runs Rust tests + admin-ui tests → builds Docker image → deploys to Fly.io.
+- Push to `main` → tests only (Rust + admin-ui)
+- Push `v*` tag → tests → build & publish Docker image (tagged `X.Y.Z` + `X.Y`) → deploy to Fly.io
+- `workflow_dispatch` in GitHub Actions → redeploy a specific existing version
+
+Use `/release` to prepare the changelog, bump versions, commit, and tag. Use `/commit` for day-to-day commits.
 
 ## Migrations (`migration/`)
 

.claude/commands/release.md

@@ -49,4 +49,7 @@ Tell the user the release is ready and show the exact command to push:
 git push && git push origin vX.Y.Z
 ```
 
-Remind them that pushing the tag triggers CI to build and publish a Docker image tagged `vX.Y.Z`.
+Remind them that:
+- Pushing the commit (`git push`) triggers CI: tests only.
+- Pushing the tag (`git push origin vX.Y.Z`) triggers CI: tests → build → publish Docker image tagged `X.Y.Z` and `X.Y` → deploy to Fly.io.
+- To redeploy an existing version without a new release, use the `workflow_dispatch` trigger in GitHub Actions with the version number (e.g. `1.2.3`).

.github/workflows/cicd.yml

@@ -1,12 +1,18 @@
-name: Publish & Deploy
+name: CI / CD
 
 on:
   push:
     branches: [main]
     tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to deploy (e.g. 1.2.3 — must already exist in GHCR)'
+        required: true
 
 jobs:
   test:
+    if: github.event_name == 'push'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -40,10 +46,13 @@ jobs:
 
   publish:
     needs: test
+    if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
+    outputs:
+      version: ${{ steps.meta.outputs.version }}
     steps:
       - uses: actions/checkout@v4
 
@@ -63,9 +72,8 @@ jobs:
         with:
           images: ghcr.io/getbetweenrows/betweenrows
           tags: |
-            type=raw,value=latest,enable={{is_default_branch}}
             type=semver,pattern={{version}}
-            type=sha,prefix=,format=long
+            type=semver,pattern={{major}}.{{minor}}
 
       - name: Build and push
         uses: docker/build-push-action@v6
@@ -79,15 +87,29 @@ jobs:
           cache-to: type=gha,mode=max
 
   deploy:
-    needs: publish
+    needs: [publish]
+    if: |
+      always() && (
+        (needs.publish.result == 'success') ||
+        (github.event_name == 'workflow_dispatch')
+      )
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
 
+      - name: Resolve version
+        id: version
+        run: |
+          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
+            echo "tag=${{ inputs.version }}" >> $GITHUB_OUTPUT
+          else
+            echo "tag=${{ needs.publish.outputs.version }}" >> $GITHUB_OUTPUT
+          fi
+
       - name: Deploy to Fly.io
         uses: superfly/flyctl-actions/setup-flyctl@master
 
-      - run: flyctl deploy --image ghcr.io/getbetweenrows/betweenrows:${{ github.sha }} --app betweenrows
+      - run: flyctl deploy --image ghcr.io/getbetweenrows/betweenrows:${{ steps.version.outputs.tag }} --app betweenrows
         env:
           FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}