name: Deploy Infrastructure

on:
  push:
    branches: [main]
    paths:
      - "infrastructure/**"
      - ".gitea/workflows/infrastructure-deploy.yml"

# Pulumi state isn't safe to update concurrently; serialize runs and let a
# newer push supersede one still queued (not one already applying).
concurrency:
  group: pulumi-thamanyah-main
  cancel-in-progress: false

env:
  AWS_REGION: us-east-1

jobs:
  pulumi-up:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # Broad infra-provisioning credentials, distinct from the narrowly
      # scoped gitea-ci-user used by the app deploy workflows (ECR push +
      # ecs:UpdateService only). Pulumi needs to create/update IAM, RDS,
      # ECS, CloudFront, etc., so this identity is intentionally wider.
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.PULUMI_AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.PULUMI_AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: infrastructure/go.mod

      # Stack name assumes the runner is logged into the same Pulumi Cloud
      # org as `pulumi.yaml`'s default; if PULUMI_ACCESS_TOKEN's org differs,
      # qualify this as "<org>/main" instead.
      - name: Pulumi up
        uses: pulumi/actions@v6
        with:
          command: up
          stack-name: main
          work-dir: infrastructure
        env:
          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}