name: Deploy dev content

on:
  workflow_dispatch: {}

permissions:
  id-token: write
  contents: read

concurrency:
  group: deploy-dev
  cancel-in-progress: false

jobs:
  deploy:
    name: Publish content to dev
    if: github.ref == 'refs/heads/dev'
    runs-on: ubuntu-latest
    env:
      AWS_REGION: us-east-1
      VITE_API_URL: https://api.dev.seahaven.com/api
      EXPECTED_API_URL: https://api.dev.seahaven.com/api
      FORBIDDEN_API_URLS: https://api.staging.seahaven.com/api,https://api.tf-poc.seahaven.com/api
      SITE_URL: https://dev.seahaven.com
      API_SMOKE_URL: https://api.dev.seahaven.com/swagger/v1/swagger.json
      SITE_BUCKET: seahaven-shoc-frontend-dev
      EXPECTED_SITE_BUCKET: seahaven-shoc-frontend-dev
      CLOUDFRONT_DISTRIBUTION_ID: E2CWLM1AFB964P
      DEPLOY_RELEASE_ID: ${{ github.sha }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up Terraform
        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
        with:
          terraform_version: "1.9.8"
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24"
          cache: npm
      - name: Quality gates
        run: npm ci && npm run verify
      - name: Assume dev deploy role (OIDC)
        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
        with:
          role-to-assume: arn:aws:iam::396287094661:role/githubdeploy-shoc-frontend-new-dev
          aws-region: us-east-1
      - name: Build, publish, and verify SPA
        run: bash scripts/deploy-web.sh