# Generated by `sfdt ci init --provider github --type monitor`.
# Scheduled org monitoring: runs all checks, takes a metadata backup, and pushes
# the snapshot to configured notification channels.
#
# Required repository secrets (Settings > Secrets and variables > Actions):
{{authSecretsDoc}}
#   SLACK_WEBHOOK_URL    (optional) Slack incoming webhook
#   TEAMS_WEBHOOK_URL    (optional) Microsoft Teams incoming webhook
name: SFDT Org Monitoring
on:
  schedule:
    - cron: '{{cron}}'
  workflow_dispatch: {}
jobs:
  monitor:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '{{nodeVersion}}'
      - name: Install Salesforce CLI
        run: npm install --global @salesforce/cli
      {{authSteps}}
      - name: Run org monitoring
        run: npx --yes @sfdt/cli@latest monitor all --org {{org}} --backup --notify --json
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          TEAMS_WEBHOOK_URL: ${{ secrets.TEAMS_WEBHOOK_URL }}
      # Setup-audit-trail anomalies and critical security changes. Exits
      # non-zero on a critical change or a per-user velocity spike, so the
      # scheduled run is a real gate rather than a report nobody opens.
      # `always()` so a monitor failure does not skip the security audit.
      - name: Run org audit
        if: always()
        run: npx --yes @sfdt/cli@latest audit all --org {{org}} --notify --json
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          TEAMS_WEBHOOK_URL: ${{ secrets.TEAMS_WEBHOOK_URL }}
      - name: Upload monitoring snapshot
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: sfdt-monitor-snapshot
          path: logs/monitor-latest.json
          if-no-files-found: ignore