name: Deploy Mobile (iOS)

on:
  push:
    branches: [main]
    paths: ["mobile/**"]
  workflow_dispatch:

concurrency:
  group: deploy-mobile
  cancel-in-progress: false

permissions:
  id-token: write
  contents: read

jobs:
  deploy-ios:
    name: Build & Upload to TestFlight
    # Fix: INF-M8 — pin to SHA for supply chain security (cd-mobile-ios.yaml@main)
    uses: Sea-Haven-Industries/.github/.github/workflows/cd-mobile-ios.yaml@c040bfaa223ac9a671cca9047cffdac45b00f3dc
    with:
      working-directory: mobile
      cache-dependency-path: mobile/package-lock.json
    secrets:
      deploy-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
      match-password: ${{ secrets.MATCH_PASSWORD }}
      asc-key-id: ${{ secrets.ASC_KEY_ID }}
      asc-issuer-id: ${{ secrets.ASC_ISSUER_ID }}
      asc-key-content: ${{ secrets.ASC_KEY_CONTENT }}