# Generated by `sfdt ci init --provider github --type release --runner action`.
# Release deploy on push to {{branch}} via the SFDT action ({{actionRef}}):
# deploys the changed-metadata delta since the last release tag to {{org}} —
# a real deploy, not a validation. The job runs in the '{{environment}}'
# GitHub Environment: add required reviewers there (Settings > Environments)
# to gate the deploy behind manual approval, and scope the auth secret to
# that environment.
#
# Delta base: the most recent tag (git describe). Tag each release — for example
# with `sfdt release <version>` or `sfdt deploy --tag` — to keep deltas exact;
# with no tag in history the delta falls back to {{deltaBase}}, which can miss
# earlier commits of a multi-commit merge.
#
# --notify pushes the deploy outcome through the channels configured under
# `notifications` in .sfdt/config.json (secrets referenced by env-var name).
#
# Required repository secrets (Settings > Secrets and variables > Actions):
{{authSecretsDoc}}
#   SLACK_WEBHOOK_URL    (optional) Slack incoming webhook for deploy notifications
#   TEAMS_WEBHOOK_URL    (optional) Microsoft Teams incoming webhook
name: SFDT Release Deploy
on:
  push:
    branches: ['{{branch}}']
  workflow_dispatch: {}
permissions:
  contents: read
jobs:
  release:
    runs-on: ubuntu-latest
    environment: {{environment}}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Resolve delta base
        id: base
        run: |
          BASE=$(git describe --tags --abbrev=0 2>/dev/null || echo "{{deltaBase}}")
          echo "Deploying delta since $BASE"
          echo "ref=$BASE" >> "$GITHUB_OUTPUT"
      # args-json is a JSON *string literal* in this file, and Actions substitutes
      # ${{ }} into it before the action ever runs. A git ref may legally contain
      # a double quote (`git check-ref-format --branch 'a"b'` succeeds), which
      # closes the string and injects extra array elements. action.yml parses the
      # result with jq and spawns with no shell, so this is argument injection
      # rather than RCE — but injected argv still reaches sfdt. Building the array
      # with `jq --arg` escapes the value instead of splicing it. (sfdt-private#21)
      - name: Build sfdt args
        id: sfdt-args
        env:
          BASE_REF: ${{ steps.base.outputs.ref }}
        run: |
          printf 'args=%s\n' "$(jq -cn --arg org '{{org}}' --arg base "$BASE_REF" \
            '["deploy","--smart","--org",$org,"--delta-base",$base,"--notify"]')" >> "$GITHUB_OUTPUT"
      - name: Smart delta deploy
        uses: {{actionRef}}
        with:
          args-json: ${{ steps.sfdt-args.outputs.args }}
          auth-method: {{authMethod}}
          org-alias: {{org}}
          node-version: '{{nodeVersion}}'
          {{authInputs}}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          TEAMS_WEBHOOK_URL: ${{ secrets.TEAMS_WEBHOOK_URL }}