# Generated by `sfdt ci init --provider github --type deploy --runner action`.
# Smart delta validation on pull requests via the SFDT action ({{actionRef}}):
# a code quality scan (results appear under Security > Code scanning), then a
# check-only deploy of the changed-metadata delta against the PR base branch.
# Generate the matching real-deploy pipeline with --type release.
#
# The quality scan expects a committed .sfdt/config.json (run `sfdt init`); it
# is non-blocking, so a failed or skipped scan never blocks the validation.
#
# Required repository secrets (Settings > Secrets and variables > Actions):
{{authSecretsDoc}}
name: SFDT Smart Deploy
on:
  pull_request:
    types: [opened, synchronize, reopened]
  workflow_dispatch: {}
permissions:
  contents: read
  security-events: write
jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Code quality scan
        uses: {{actionRef}}
        continue-on-error: true
        with:
          args-json: '["quality","--output-file","sfdt-quality.sarif"]'
          node-version: '{{nodeVersion}}'
      - name: Upload code scanning results
        if: always() && hashFiles('sfdt-quality.sarif') != ''
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: sfdt-quality.sarif
      # args-json is a JSON *string literal* in this file, and Actions substitutes
      # ${{ }} into it before the action ever runs. A git ref may legally contain
      # a double quote (`git check-ref-format --branch 'a"b'` succeeds), which
      # closes the string and injects extra array elements. action.yml parses the
      # result with jq and spawns with no shell, so this is argument injection
      # rather than RCE — but injected argv still reaches sfdt. Building the array
      # with `jq --arg` escapes the value instead of splicing it. (sfdt-private#21)
      - name: Build sfdt args
        id: sfdt-args
        env:
          BASE_REF: ${{ github.event.pull_request.base.ref }}
        run: |
          printf 'args=%s\n' "$(jq -cn --arg org '{{org}}' --arg base "origin/$BASE_REF" \
            '["deploy","--smart","--org",$org,"--delta-base",$base,"--dry-run"]')" >> "$GITHUB_OUTPUT"
      - name: Smart delta validation
        uses: {{actionRef}}
        with:
          args-json: ${{ steps.sfdt-args.outputs.args }}
          auth-method: {{authMethod}}
          org-alias: {{org}}
          node-version: '{{nodeVersion}}'
          {{authInputs}}