feat: release-gate production Vercel deploys

[suguanYang]

Summary

• deploy the production Vercel project only from a published semantic release whose commit belongs to main
• run the production database migration with a dedicated credential before the Vercel deployment
• serialize environment deployment runs so production migrations cannot race
• retain the existing EKS release deployment during the rollback window
• relate this change to Ontos-AI/knowhere-api-infra#20

Verification

• actionlint v1.7.12 .github/workflows/deploy.yml
• git diff --check
• verified Vercel CLI 59.1.3 pull, build, and deploy flags
• exercised the main-ancestry guard against the current v1.0.18 production tag
• no deployment or database migration was run

Screenshots or Recordings

Not applicable; this is a deployment workflow change.

Deployment Notes

• requires DATABASE_MIGRATION_URL_PROD and VERCEL_TOKEN repository secrets before publishing a production release
• the production Vercel project remains disconnected from Git auto-deployments
• pushes to main do not deploy production
• production deployment order is EKS image build, database migration, then EKS and Vercel deployment; EKS remains available for rollback until the observation gate closes
• the first production release and domain cutover require separate approvals

Checklist

• Tests were added or updated when behavior changed, or workflow validation covers this deployment-only change
• Public docs, examples, or screenshots were updated when needed, or are not applicable
• User-visible UI changes were checked on responsive layouts, or are not applicable
• Auth, billing, and API proxy changes avoid leaking secrets or user data
• The pull request description explains any breaking or user-visible change

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
knowhere-dashboard-staging	Error		Aug 16, 2026 3:51am