name: Deploy and diagnose (sam sync template)

on:
  workflow_dispatch:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4

      # Keep auth/workload identity configuration from your existing workflow.
      - name: Deploy with sam sync
        shell: bash
        run: |
          set -o pipefail
          sam sync --stack-name your-stack-name --watch=false 2>&1 | tee deployment.log

      - name: Diagnose deployment log
        if: always()
        id: sam-doctor
        uses: jakegold1647/sam-doctor@v0
        with:
          log-file: deployment.log
          summary: true