name: Stack Prod (on merge to main)

# Generated by @factiii/stack v{VERSION}
# main IS the production branch. When a PR is MERGED to main, deploy prod.
# Runs on the self-hosted staging runner: it builds the prod image (linux/amd64),
# pushes to ECR, then `npx stack deploy --prod` SSHes to prod to pull/migrate/health.
# Thin per STANDARDS: trigger + secrets + bootstrap + one CLI call.
# All backup/migrate/rollback/prune logic lives in `npx stack deploy --prod`.

on:
  pull_request:
    branches: [main]
    types: [closed]

# Never cancel an in-flight production deploy.
concurrency:
  group: prod-deploy
  cancel-in-progress: false

jobs:
  prod:
    # Only deploy when the PR actually merged (not when closed without merging).
    if: github.event.pull_request.merged == true
    runs-on: [self-hosted, staging]
    steps:
      - name: Checkout merged main
        uses: actions/checkout@v4
        with:
          ref: main

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Install dependencies
        run: pnpm install

      - name: Deploy to production
        run: npx stack deploy --prod
        env:
          GITHUB_ACTIONS: 'true'
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ANSIBLE_VAULT_PASSWORD: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
          COMMIT_HASH: ${{ github.sha }}
          BRANCH: main
          PR_NUMBER: ${{ github.event.pull_request.number }}