name: Rollback (re-point env to a prior release)

# Roll an env back to a previously published release without rebuilding. Re-points
# releases/latest/ at the chosen release and re-fires the open-swe-<env>-deploy SSM
# document — same fire/wait/gate path as a forward deploy (roll-box.sh).
#
#   env=dev,  sha blank → restore open-swe-dev-assets/releases/last-good/  (AUTO)
#   env=prod, sha blank → restore open-swe-prod-assets/releases/last-good/ (manual
#                         approval: Environment "prod", same gate as a prod deploy)
#   sha=<commit>        → restore that exact releases/<sha>/ instead of last-good.
#
# No new IAM: reuses the githubdeploy-open-swe-app-<env> role's existing releases/*
# write + tag-scoped ssm:SendCommand. OIDC subject alignment matches build-artifacts:
#   - rollback-dev  declares NO `environment:` → sub = repo:…:ref:refs/heads/<branch>
#   - rollback-prod declares `environment: prod` → sub = repo:…:environment:prod

permissions:
  contents: read

on:
  workflow_dispatch:
    inputs:
      env:
        description: "Which environment to roll back"
        required: true
        type: choice
        options: [dev, prod]
      sha:
        description: "Release SHA to restore (blank = releases/last-good)"
        required: false
        type: string

concurrency:
  # never overlap a rollback with another rollback/deploy of the same env.
  group: rollback-${{ inputs.env }}
  cancel-in-progress: false

jobs:
  rollback-dev:
    name: Rollback (dev)
    if: ${{ inputs.env == 'dev' }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      id-token: write
      contents: read
    env:
      ENV: dev
      BUCKET: open-swe-dev-assets
      DEPLOY_DOC: open-swe-dev-deploy
      TARGET_SHA: ${{ inputs.sha }}
    steps:
      - uses: actions/checkout@v7
      - uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_APP_DEV }}
          aws-region: us-east-1
      - name: Re-point releases/latest + redeploy
        run: bash .github/scripts/rollback.sh

  rollback-prod:
    name: Rollback (prod)
    if: ${{ inputs.env == 'prod' }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    # Manual-approval gate: the "prod" Environment requires a reviewer (Adam). Also
    # makes the OIDC sub …:environment:prod (matches the prod app-role trust).
    environment: prod
    permissions:
      id-token: write
      contents: read
    env:
      ENV: prod
      BUCKET: open-swe-prod-assets
      DEPLOY_DOC: open-swe-prod-deploy
      TARGET_SHA: ${{ inputs.sha }}
    steps:
      - uses: actions/checkout@v7
      - uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_APP_PROD }}
          aws-region: us-east-1
      - name: Re-point releases/latest + redeploy
        run: bash .github/scripts/rollback.sh