name: Deploy · Prod

# Placeholder for the production rollout workflow. Today it only proves
# the manual entry point works; the actual `docker save | ssh prod
# docker load` + remote `docker compose up -d` pipeline is wired in
# once the production host, SSH credentials, and DNS are decided.

on:
  workflow_dispatch:
    inputs:
      image_tag:
        description: "Image tag to deploy (commit-<sha12>, produced by prod-build.yaml)"
        required: true
        type: string

jobs:
  deploy:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    steps:
      - name: Announce target
        run: |
          echo "Would deploy image tag: ${{ inputs.image_tag }}"
          echo "TODO:"
          echo "  1. Download galaxy-images-${{ inputs.image_tag }} from prod-build artifacts."
          echo "  2. scp the .tar.gz bundles to the production host."
          echo "  3. ssh prod 'docker load -i ...' for backend / gateway / engine."
          echo "  4. ssh prod 'docker compose -f /opt/galaxy/docker-compose.yml up -d'."
          echo "  5. Probe https://api.galaxy.com/healthz and roll back on failure."