name: Deploy and diagnose (pilot then strict mode)

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      rollout-mode:
        description: "pilot = non-blocking, high-confidence = gate on sure findings, strict = fail on any finding"
        type: choice
        options:
          - pilot
          - high-confidence
          - strict
        default: pilot

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - name: Deploy
        shell: bash
        run: |
          set -o pipefail
          # Replace with your real deployment command.
          sam deploy --no-confirm-changeset 2>&1 | tee deployment.log

      - name: Diagnose deployment log
        if: always()
        id: sam-doctor
        uses: jakegold1647/sam-doctor@v0
        with:
          log-file: deployment.log
          summary: true
          annotations: true
          # Use this workflow in three phases:
          # - default is safe pilot mode (nothing gates the run).
          # - rollout-mode=high-confidence fails only on findings the rules
          #   are sure about; medium-confidence findings still report.
          # - rollout-mode=strict fails on any supported finding.
          fail-on-findings: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.rollout-mode == 'strict' }}
          fail-on-confidence: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.rollout-mode == 'high-confidence' && 'high' || '' }}

      - name: Route findings to triage
        if: always() && steps.sam-doctor.outputs.has-findings == 'true'
        run: |
          echo "SAM Doctor found ${{ steps.sam-doctor.outputs.finding-count }} supported finding(s)."
          echo "Start here:"
          echo "https://sam-doctor.jacobgoldstein.dev/#founder"

      - name: Continue while running in pilot mode
        if: always() && steps.sam-doctor.outputs.has-findings == 'true' && github.event_name != 'workflow_dispatch'
        run: |
          echo "Pilot mode is non-blocking; findings were captured for follow-up."