name: Deploy and diagnose (template)

on:
  workflow_dispatch:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4

      # Keep your existing auth block here (OIDC role, secrets, or static creds).
      - name: Deploy
        shell: bash
        run: |
          set -o pipefail
          # Replace this line with your actual deployment command.
          sam deploy --no-confirm-changeset 2>&1 | tee deployment.log

      - name: Diagnose deployment log
        if: always()
        id: sam-doctor
        uses: jakegold1647/sam-doctor@v0
        with:
          log-file: deployment.log
          summary: true
          # Optional: fail this workflow when supported failures are detected.
          # fail-on-findings: true
          # Optional gentler gate: fail only on high-confidence findings.
          # fail-on-confidence: high
          # Optional: enable if a single file path may not capture all logs.
          # batch: false
          # Optional: disable the one default Actions notice if not desired.
          # annotations: false

      - name: Publish diagnosis summary
        if: always()
        run: |
          echo "Supported findings: ${{ steps.sam-doctor.outputs.finding-count }}"