name: ForgeFlow approved deploy

on:
  workflow_dispatch:
    inputs:
      environment:
        description: Allowlisted ForgeFlow environment
        required: true
        type: string
      commit_sha:
        description: Exact approved commit SHA
        required: true
        type: string
      request_id:
        description: Immutable AppOps request identifier
        required: true
        type: string
      approval_id:
        description: AppOps approval identifier
        required: true
        type: string
      approval_fingerprint:
        description: Immutable AppOps approval fingerprint
        required: true
        type: string
      evidence_issued_at:
        description: Signed evidence UNIX timestamp
        required: true
        type: string
      evidence_signature:
        description: Base64 Ed25519 signature over the exact deployment evidence
        required: true
        type: string

concurrency:
  group: forgeflow-approved-${{ gitea.repository }}-${{ inputs.environment }}
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: forgeflow
    steps:
      - name: Validate signed deployment inputs
        shell: bash
        env:
          FF_REPOSITORY: ${{ gitea.repository }}
          FF_ENVIRONMENT: ${{ inputs.environment }}
          FF_COMMIT_SHA: ${{ inputs.commit_sha }}
          FF_REQUEST_ID: ${{ inputs.request_id }}
          FF_APPROVAL_ID: ${{ inputs.approval_id }}
          FF_APPROVAL_FINGERPRINT: ${{ inputs.approval_fingerprint }}
          FF_EVIDENCE_ISSUED_AT: ${{ inputs.evidence_issued_at }}
          FF_EVIDENCE_SIGNATURE: ${{ inputs.evidence_signature }}
        run: |
          set -Eeuo pipefail
          [[ "$FF_REPOSITORY" =~ ^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$ ]]
          [[ "$FF_ENVIRONMENT" =~ ^[a-z0-9][a-z0-9._-]{0,63}$ ]]
          [[ "$FF_COMMIT_SHA" =~ ^[0-9a-fA-F]{40,64}$ ]]
          [[ "$FF_REQUEST_ID" =~ ^appr-[A-Za-z0-9._-]{1,75}$ ]]
          [[ "$FF_APPROVAL_ID" == "$FF_REQUEST_ID" ]]
          [[ "$FF_APPROVAL_FINGERPRINT" =~ ^[0-9a-f]{64}$ ]]
          [[ "$FF_EVIDENCE_ISSUED_AT" =~ ^[0-9]{10,11}$ ]]
          [[ "$FF_EVIDENCE_SIGNATURE" =~ ^[A-Za-z0-9+/]{86}==$ ]]

      - name: Execute root-owned verified deployment
        shell: bash
        env:
          FF_REPOSITORY: ${{ gitea.repository }}
          FF_ENVIRONMENT: ${{ inputs.environment }}
          FF_COMMIT_SHA: ${{ inputs.commit_sha }}
          FF_REQUEST_ID: ${{ inputs.request_id }}
          FF_APPROVAL_ID: ${{ inputs.approval_id }}
          FF_APPROVAL_FINGERPRINT: ${{ inputs.approval_fingerprint }}
          FF_EVIDENCE_ISSUED_AT: ${{ inputs.evidence_issued_at }}
          FF_EVIDENCE_SIGNATURE: ${{ inputs.evidence_signature }}
        run: |
          set -Eeuo pipefail
          sudo /usr/local/bin/forgeflow-deploy \
            "$FF_REPOSITORY" \
            "$FF_ENVIRONMENT" \
            "$FF_COMMIT_SHA" \
            "$FF_REQUEST_ID" \
            "$FF_APPROVAL_ID" \
            "$FF_APPROVAL_FINGERPRINT" \
            "$FF_EVIDENCE_ISSUED_AT" \
            "$FF_EVIDENCE_SIGNATURE"