Fix noninteractive Supabase deploy confirmation for v1.10.17

.github/workflows/supabase-api-candidate.yml

@@ -116,7 +116,7 @@ jobs:
       - name: Deploy candidate API function only
         # Bundled WASM static_files require the CLI's Docker builder (the default).
         # Do not add --use-api here.
-        run: supabase functions deploy api --project-ref "$STAGING_REF"
+        run: supabase functions deploy api --project-ref "$STAGING_REF" --yes
 
   smoke:
     if: startsWith(github.ref_name, 'supabase-api-staging-smoke-')

.github/workflows/supabase-production-deploy.yml

@@ -55,10 +55,12 @@ jobs:
       - uses: supabase/setup-cli@45a513f8c64c0bc8e0e3dfe572b5c95be85f6359 # v3.0.1
         with:
           version: latest
+      # The production-schema environment is the human gate. Current CLI
+      # versions also require explicit confirmation in noninteractive CI.
       - name: Deploy API from this main commit
-        run: supabase functions deploy api --project-ref "$PRODUCTION_REF"
+        run: supabase functions deploy api --project-ref "$PRODUCTION_REF" --yes
       - name: Deploy worker from this main commit without activating Cron
-        run: supabase functions deploy worker --project-ref "$PRODUCTION_REF"
+        run: supabase functions deploy worker --project-ref "$PRODUCTION_REF" --yes
       - name: Check worker boot and unsigned dispatch rejection
         env:
           WORKER_URL: https://${{ vars.SUPABASE_PRODUCTION_PROJECT_REF }}.supabase.co/functions/v1/worker

.github/workflows/supabase-worker-candidate.yml

@@ -54,7 +54,7 @@ jobs:
       - name: Configure staging-only Vault and Edge secrets
         run: python backend/tools/configure_staging_worker.py
       - name: Deploy candidate worker only to staging
-        run: supabase functions deploy worker --project-ref "$STAGING_PROJECT_REF"
+        run: supabase functions deploy worker --project-ref "$STAGING_PROJECT_REF" --yes
       - name: Install all worker schedules inactive in staging
         run: python backend/tools/install_staging_worker_cron.py
       - name: Verify one signed disabled-provider dispatch
@@ -93,7 +93,7 @@ jobs:
       - name: Install temporary staging-only provider settings
         run: python backend/tools/staging_worker_canary_secrets.py configure
       - name: Deploy staged worker with provider settings
-        run: supabase functions deploy worker --project-ref "$STAGING_PROJECT_REF"
+        run: supabase functions deploy worker --project-ref "$STAGING_PROJECT_REF" --yes
       - name: Check phone, inbox and private draft in one provider batch
         run: python backend/tools/run_all_staging_worker_canaries.py
       - name: Close every staging application job gate
@@ -182,7 +182,7 @@ jobs:
       - name: Install temporary email-only staging credentials
         run: python backend/tools/staging_worker_canary_secrets.py configure-email
       - name: Deploy staged worker with refreshed sender
-        run: supabase functions deploy worker --project-ref "$STAGING_PROJECT_REF"
+        run: supabase functions deploy worker --project-ref "$STAGING_PROJECT_REF" --yes
       - name: Retry only the unsent staging email batch
         run: python backend/tools/retry_staging_worker_email_canary.py
       - name: Report bounded email outcome

docs/WORK_LOG.md

@@ -7,6 +7,11 @@ claims as completed work.
 
 ## Current status
 
+### v1.10.17 production deploy prompt — 2026-11-02
+
+- [Release PR #475](https://github.com/Coding-Moves/one-concept/pull/475) merged at `d84ab92`. The first protected [deployment run 41448370855](https://github.com/Coding-Moves/one-concept/actions/runs/41448370855) passed the live production schema check, then stopped before deploying the API because the current Supabase CLI requires an explicit `--yes` in noninteractive CI. Its log says nothing was changed; worker deploy and health checks did not run. Release was not started and v1.10.17 was not tagged.
+- [Hotfix PR #476](https://github.com/Coding-Moves/one-concept/pull/476) adds that flag to production API/worker and staging candidate function-deploy commands. The protected environment approvals, project checks and post-deploy probes remain in place. Workflow YAML parsed and `git diff --check` passed; the live retry remains to be verified after review and merge. The next deploy and Release must use the new exact `main` SHA. No SQL migration or Cron change is involved.
+
 ### v1.10.17 release preparation — 2026-11-02
 
 - The owner asked for a production release PR to test the profile fixes on the regular phone. [PR #473](https://github.com/Coding-Moves/one-concept/pull/473) merged into `develop` at `32b7f97` after all four hosted checks passed; [preview OTA run 41444180393](https://github.com/Coding-Moves/one-concept/actions/runs/41444180393) succeeded. No physical-device result for the repaired gallery/camera or keyboard paths has been reported yet.