name: ForgeFlow deployment

on:
  workflow_dispatch:
    inputs:
      environment:
        description: Fixed ForgeFlow deployment environment
        required: true
        default: production
      commit_sha:
        description: Exact commit verified by ForgeFlow
        required: true
      request_id:
        description: ForgeFlow correlation identifier
        required: true

concurrency:
  group: forgeflow-${{ gitea.repository }}-${{ inputs.environment }}
  cancel-in-progress: false

jobs:
  deploy:
    # Register a trusted runner with this label, or replace it with your own.
    runs-on: forgeflow-production
    steps:
      - name: Validate dispatch inputs
        shell: bash
        run: |
          set -euo pipefail
          [[ "${{ inputs.environment }}" =~ ^[a-z0-9][a-z0-9._-]{0,63}$ ]] || {
            echo "Invalid environment identifier" >&2
            exit 64
          }
          [[ "${{ inputs.commit_sha }}" =~ ^[0-9a-fA-F]{40,64}$ ]] || {
            echo "Invalid commit SHA" >&2
            exit 64
          }
          [[ "${{ inputs.request_id }}" =~ ^[A-Za-z0-9._:-]{1,100}$ ]] || {
            echo "Invalid request identifier" >&2
            exit 64
          }

      - name: Deploy exact allowlisted version
        shell: bash
        run: |
          set -euo pipefail
          sudo /usr/local/bin/forgeflow-deploy \
            "${{ gitea.repository }}" \
            "${{ inputs.environment }}" \
            "${{ inputs.commit_sha }}" \
            "${{ inputs.request_id }}"