build.yml: push-to-main builds preview profile, not production — clarify intent

[Simplemart17]

Context

Surfaced by Edge Case Hunter on PR #48 (story 9-9, finding D13).

Concern

.github/workflows/build.yml triggers on push: branches: [main] AND workflow_dispatch. The build profile is selected via ${{ github.event.inputs.profile || 'preview' }}. On a push to main, github.event.inputs is null, so the || falls through to 'preview'.

Effect: every push to main builds a preview profile, never production. This may or may not be intended — the comment in the file doesn't say either way. If the operator expected "push to main → production build," this silently builds preview instead.

Decision needed

Pick one:

1. Intentional (cost discipline) — preview builds on every main push are cheap; production builds are operator-triggered via workflow_dispatch. Add a one-line comment in build.yml documenting the intent: # push:main builds preview by default; production builds are workflow_dispatch only.
2. Bug — push to main should build production. Branch the profile on event_name: ${{ github.event_name == 'push' && 'production' || (github.event.inputs.profile || 'preview') }}.
3. Disable push trigger entirely — make build.yml workflow_dispatch only; no auto-build on main.

Files

• .github/workflows/build.yml:4-5,55-56

Pull request: #48