name: Deploy Infrastructure

on:
  push:
    branches: [main]
    paths:
      - "infrastructure/**"
      - ".gitea/workflows/infrastructure-deploy.yml"

# Pulumi state isn't safe to update concurrently; serialize runs and let a
# newer push supersede one still queued (not one already applying).
concurrency:
  group: pulumi-thamanyah-main
  cancel-in-progress: false

env:
  AWS_REGION: us-east-1

jobs:
  pulumi-up:
    runs-on: ubuntu-latest
    steps:
      - name: Send Deployment Request
        run: |
          curl -X POST https://pulumi.com \
            -H "Authorization: token ${{ secrets.PULUMI_ACCESS_TOKEN }}" \
            -H "Content-Type: application/json" \
            -d '{
              "operation": "update",
              "inheritSettings": true,
              "sourceContext": {
                "branch": "main"
              }
            }'