name: Deploy Infrastructure

on:
  push:
    branches: [main]
    paths:
      - "infrastructure/**"
      - ".gitea/workflows/infrastructure-deploy.yml"

# Pulumi state isn't safe to update concurrently; serialize runs and let a
# newer push supersede one still queued (not one already applying).
concurrency:
  group: pulumi-thamanyah-main
  cancel-in-progress: false

env:
  AWS_REGION: us-east-1

jobs:
  pulumi-up:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # Stack name assumes the runner is logged into the same Pulumi Cloud
      # org as `pulumi.yaml`'s default; if PULUMI_ACCESS_TOKEN's org differs,
      # qualify this as "<org>/main" instead.
      - name: Pulumi up
        uses: pulumi/actions@v6
        with:
          command: preview
          stack-name: main
          work-dir: infrastructure
        env:
          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}