name: Boundaries Deploy

# The merge applies the pack. Same two gates as the PR, then push.
on:
  push:
    branches: [main]
    paths:
      - "boundaries/**"
      - "taints/**"
      - "variables/**"
  workflow_dispatch:

permissions:
  contents: read

# Never two pushes at once: push reconciles the whole account to these files.
concurrency:
  group: boundaries-deploy
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    # A GitHub environment with required reviewers is the approval gate. push is
    # desired-state — a resource deleted from these files is deleted in the account.
    environment: zenity-account
    env:
      ZENITY_ENV: ${{ vars.ZENITY_ENV }}
      ZENITY_ACCOUNT: ${{ vars.ZENITY_ACCOUNT }}
      ZENITY_CLIENT_ID: ${{ secrets.ZENITY_CLIENT_ID }}
      ZENITY_CLIENT_SECRET: ${{ secrets.ZENITY_CLIENT_SECRET }}
    steps:
      - uses: actions/checkout@v4

      - uses: sigstore/cosign-installer@v3

      - name: Install zenityctl
        env:
          ZENITYCTL_VERSION: ${{ vars.ZENITYCTL_VERSION }}
        run: |
          curl -fsSL https://get.zenity.io/install.sh | sh -s -- \
            ${ZENITYCTL_VERSION:+--version "$ZENITYCTL_VERSION"} --dir "$RUNNER_TEMP/bin"
          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"

      - name: Validate
        run: zenityctl boundaries validate

      - name: Test
        run: zenityctl boundaries test

      - name: Record what is about to be applied
        run: |
          {
            echo "## Applying to \`${ZENITY_ACCOUNT}\`"
            echo
            echo '```'
            zenityctl boundaries diff
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

      # --yes skips the interactive delete confirmation, which no CI run can answer.
      - name: Push
        run: zenityctl boundaries push --yes