cd.yaml

name: CD

# Manual-only. Production deploys happen automatically in the CI merge queue
# (ci.yaml deploy-prod on merge_group); this workflow covers the rare
# direct-push-to-main case, which has no merge_group event to deploy. Run it
# by hand from the Actions tab. (Dropped the 'v*' release-tag trigger — it
# re-deployed what the merge queue had already shipped.)
on:
  workflow_dispatch:

permissions: {}

# Shared with the CI merge-queue deploy-prod job (ci.yaml) so a manual deploy
# and a merge-queue deploy can never run against the prod cluster at once.
concurrency:
  group: prod-deploy
  cancel-in-progress: false

jobs:
  # The merge-queue deploy in ci.yaml cannot run without this validator passing,
  # so leaving it out here made the manual path the WAY AROUND the gate: a direct
  # push to main plus a dispatch reconciled the manifests with no authorization
  # check at all. Deliberately a separate job rather than a step folded into the
  # shared deploy-prod action — that action runs inside the prod environment with
  # deploy secrets in scope, and a gate belongs before that, not inside it.
  validate-eks-authorization:
    name: 🔐 Validate EKS Authorization
    runs-on: ubuntu-latest
    permissions:
      contents: read # checkout repository
    steps:
      - name: 📑 Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: ⚙️ Setup Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          cache: false

      - name: ⚙️ Install pinned kubectl renderer
        shell: bash
        env:
          KUBECTL_VERSION: "v1.36.2"
          KUBECTL_SHA256: "1e9045ec32bea85da43de85f0065358529ea7c7a152eca78154fba5b58c27d82"
        run: |
          set -euo pipefail
          kubectl_path="$RUNNER_TEMP/kubectl"
          curl -fsSL \
            "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
            -o "$kubectl_path"
          printf '%s  %s\n' "$KUBECTL_SHA256" "$kubectl_path" | sha256sum --check
          sudo install "$kubectl_path" /usr/local/bin/kubectl
          kubectl version --client

      - name: 🔐 Validate EKS authorization surface
        run: |
          go test ./scripts/validate-eks-ci-role-policy
          go run ./scripts/validate-eks-ci-role-policy .

  deploy-prod:
    name: 🚀 Deploy to Production
    needs: [validate-eks-authorization]
    runs-on: ubuntu-latest
    environment: prod
    permissions:
      contents: read # checkout repository
      packages: write # push OCI artifacts to GHCR
      id-token: write # mint OIDC token for cosign keyless signing (Fulcio + Rekor)
      attestations: write # write SBOM + SLSA provenance attestations (see deploy-prod action)
    steps:
      - name: 📑 Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: 🚀 Deploy to Production
        # The deploy logic (push → sign → attest → reconcile → cluster update)
        # is shared with ci.yaml's merge-queue deploy via this composite action,
        # so the two paths can never drift. Secrets are passed as inputs because
        # composite actions cannot read `secrets` directly.
        uses: ./.github/actions/deploy-prod
        with:
          sops-age-key: ${{ secrets.SOPS_AGE_KEY }}
          kube-config: ${{ secrets.KUBE_CONFIG }}
          talos-config: ${{ secrets.TALOS_CONFIG }}
          ghcr-token: ${{ secrets.GHCR_TOKEN }}
          hcloud-token: ${{ secrets.HCLOUD_TOKEN }}
          wg-server-private-key: ${{ secrets.WG_SERVER_PRIVATE_KEY }}