🚀 Release: beta → master

.github/workflows/deploy.yml

@@ -91,16 +91,26 @@ jobs:
         if: github.event_name == 'workflow_run'
         run: |
           CONCLUSION="${{ github.event.workflow_run.conclusion }}"
+          BRANCH="${{ github.event.workflow_run.head_branch }}"
           SHA="${{ github.event.workflow_run.head_sha }}"
           echo "CodeQL deep scan conclusion : $CONCLUSION"
           echo "Scanned commit SHA          : $SHA"
+          echo "Head branch                 : $BRANCH"
+          # Branch guard: only master commits deploy to production.
+          # The workflow_run trigger already filters branches: [master], but this
+          # explicit check makes the policy visible in the job log and provides a
+          # hard error if the filter is ever widened accidentally.
+          if [ "$BRANCH" != "master" ]; then
+            echo "::error::Deploy blocked — head_branch=$BRANCH (only master is allowed to deploy to production)."
+            exit 1
+          fi
           if [ "$CONCLUSION" != "success" ]; then
             echo "::error::CodeQL deep scan did not pass (conclusion=$CONCLUSION)."
             echo "  Deployment is blocked. Review findings before retrying:"
             echo "  https://github.com/${{ github.repository }}/security/code-scanning"
             exit 1
           fi
-          echo "✓ CodeQL gate passed — safe to deploy SHA $SHA"
+          echo "✓ CodeQL gate passed — safe to deploy SHA $SHA (branch=$BRANCH)"
 
   # ---------------------------------------------------------------------------
   # JOB: validate

infra/nginx/api.conf

@@ -112,9 +112,12 @@ server {
     # Enables runtime DNS resolution for Docker service names (e.g., grafana:3000).
     # Without this, Nginx fails at config-load with: "host not found in upstream".
     # Docker's embedded resolver is at 127.0.0.11:53.
-    # valid=10s caches DNS lookups for 10 seconds.
+    # valid=5s caches DNS lookups for 5 seconds — short enough that after a
+    # blue-green switch nginx re-resolves the new container within one health
+    # check cycle. ipv6=off stops AAAA queries that Docker bridge networks do
+    # not answer, which can add latency or cause spurious resolution failures.
     # ─────────────────────────────────────────────────────────────────────────────
-    resolver 127.0.0.11 valid=10s;
+    resolver 127.0.0.11 valid=5s ipv6=off;
     resolver_timeout 5s;
 
     # Variable-based backend URL — resolved at request time via Docker DNS (127.0.0.11).