# Generated by `sfdt ci init --provider github --type deploy`.
# Smart delta validation on pull requests: runs a code quality scan (results
# appear under Security > Code scanning), then computes the changed-metadata
# delta against the PR base branch and runs a check-only deploy (no changes
# applied). Generate the matching real-deploy pipeline with --type release.
#
# The quality scan expects a committed .sfdt/config.json (run `sfdt init`); it
# is non-blocking, so a failed or skipped scan never blocks the validation.
#
# Required repository secrets (Settings > Secrets and variables > Actions):
{{authSecretsDoc}}
name: SFDT Smart Deploy
on:
  pull_request:
    types: [opened, synchronize, reopened]
  workflow_dispatch: {}
permissions:
  contents: read
  security-events: write
jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: '{{nodeVersion}}'
      - name: Install Salesforce CLI
        run: npm install --global @salesforce/cli
      {{authSteps}}
      {{qualitySteps}}
      - name: Smart delta validation
        # base.ref goes through `env:` rather than straight into the `run:` text.
        # Actions substitutes ${{ }} into the script *before* bash parses it, and
        # a git ref may contain $, backticks, (, ), ; and | — so a branch named
        # `main$(...)` would execute. As an env var it is only ever data.
        env:
          BASE_REF: ${{ github.event.pull_request.base.ref }}
        run: npx --yes @sfdt/cli@latest deploy --smart --org {{org}} --delta-base "origin/$BASE_REF" --dry-run