diff --git a/.gitea/workflows/ci-pipeline.yml b/.gitea/workflows/ci-pipeline.yml
index f5d15942b..ec7230ee8 100755
--- a/.gitea/workflows/ci-pipeline.yml
+++ b/.gitea/workflows/ci-pipeline.yml
@@ -1462,7 +1462,7 @@ jobs:
       - unit-tests
       - frontend-lint
       - frontend-unit-test
-    if: startsWith(github.ref_name, 'v') || (github.event_name == 'push' && github.ref_name == 'main')
+    if: github.event_name == 'push' && !failure() && !cancelled()
     strategy:
       fail-fast: false
       matrix:
@@ -1546,11 +1546,7 @@ jobs:
         set -eu
         REGISTRY="xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji"
         # 根据ref类型设置镜像标签：tag用版本号，分支用分支名+sha
-        if [[ "$GITHUB_REF" == refs/tags/* ]]; then
-          TAG_NAME="${GITHUB_REF_NAME}"
-        else
-          TAG_NAME="${GITHUB_REF_NAME}-${GITHUB_SHA::8}"
-        fi
+        TAG_NAME="${GITHUB_SHA}"
         IMAGE_TAG="${REGISTRY}/${{ matrix.image_name }}:${TAG_NAME}"
         CACHE_REF="${REGISTRY}/${{ matrix.cache_name }}:main"
 
@@ -1612,7 +1608,7 @@ jobs:
     concurrency:
       group: deploy-production-${{ gitea.ref }}
       cancel-in-progress: false
-    if: startsWith(github.ref_name, 'v')
+    # if: removed - runs after build-production succeeds
     needs:
     - build-production
     steps:
@@ -1685,7 +1681,7 @@ jobs:
         echo "SSH connection verified"
 
         # 通过环境变量传递凭证，避免命令行引号转义问题
-        cat scripts/ci_production_deploy.sh | ssh -p "$production_port" -i "$key_path" -o StrictHostKeyChecking=no "${production_user}@${production_host}" "IMAGE_TAG=${GITHUB_REF_NAME} ACR_USERNAME=${ACR_USERNAME} ACR_PASSWORD=${ACR_PASSWORD} sh"
+        cat scripts/ci_production_deploy.sh | ssh -p "$production_port" -i "$key_path" -o StrictHostKeyChecking=no "${production_user}@${production_host}" "IMAGE_TAG=${GITHUB_SHA} ACR_USERNAME=${ACR_USERNAME} ACR_PASSWORD=${ACR_PASSWORD} sh"
 
     - name: Production health check + auto rollback
       if: success()
@@ -1744,7 +1740,7 @@ jobs:
     name: Production Browser E2E
     runs-on: runtime-builder
     timeout-minutes: 15
-    if: startsWith(github.ref_name, 'v')
+    # if: removed - runs after deploy-production succeeds
     needs: deploy-production
     steps:
     - name: Checkout code