From cc342ddff75b896a1111616c3485c4515bc876bf Mon Sep 17 00:00:00 2001
From: SennayT <wsennay@gmail.com>
Date: Thu, 11 Jun 2026 10:15:39 +0300
Subject: [PATCH] always run malware scan first

---
 .github/workflows/deploy.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index a66063ce1..42a593122 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,15 +1,16 @@
 name: Deploy Stacks
 
 on:
-  push:
+  workflow_run:
+    workflows: ["Malware & Obfuscation Scan"]
+    types: [completed]
     branches:
       - main
       - dev
       - staging
-  workflow_dispatch:
 
 concurrency:
-  group: deploy-${{ github.ref_name }}
+  group: deploy-${{ github.event.workflow_run.head_branch || github.ref_name }}
   cancel-in-progress: true
 
 jobs:
@@ -38,9 +39,10 @@ jobs:
           - project: edr-passenger
             build_env_file: passenger-web.build.env
             service: passenger-backoffice
+    if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success'
     env:
       PROJECT: ${{ matrix.project }}
-      BRANCH: ${{ github.ref_name }}
+      BRANCH: ${{ github.event.workflow_run.head_branch || github.ref_name }}
       DEPLOY_USER: tria
       BUILD_ENV_FILE: ${{ matrix.build_env_file }}
       DOCKER_BUILDKIT: "1"