# [doc->REQ-DEP-04] [int->REQ-DEP-04]
# .github/workflows/deploy-prod.yml
# Source: 05-RESEARCH.md §Pattern 8 + 05-CONTEXT.md D-05/D-07/D-08
# Tag push v*.*.* → rebno-prod deploy. NO rebuild — uses Plan 05 dual-tagged image.

name: deploy-prod

on:
  push:
    tags: ['v*.*.*']

concurrency:
  group: deploy-prod
  cancel-in-progress: false

jobs:
  promote:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Resolve image SHA from tag
        id: sha
        run: |
          TAG_SHA=$(git rev-parse "${{ github.ref_name }}^{commit}")
          echo "Resolved tag ${{ github.ref_name }} → commit $TAG_SHA"
          echo "image=registry.fly.io/rebno-prod:${TAG_SHA}" >> "$GITHUB_OUTPUT"

      # SHA-pin must match deploy-staging.yml (Plan 05). Update both together.
      - uses: superfly/flyctl-actions/setup-flyctl@fc53c09

      - name: flyctl deploy → rebno-prod
        run: |
          flyctl deploy \
            -a rebno-prod \
            --image "${{ steps.sha.outputs.image }}" \
            --config apps/server/fly.prod.toml \
            --strategy rolling
        env:
          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
