# ══════════════════════════════════════════════════════════════════
#  BREAKING CHANGE? BUMP THE MAJOR IN cue/cluster/cluster.cue
# ══════════════════════════════════════════════════════════════════
# Everything pinning `@v1` gets this the moment it publishes. A change
# a consumer cannot absorb needs a new major, or it breaks them.
# ══════════════════════════════════════════════════════════════════

name: deploy
description: Render a CUE package and apply it, waiting for every workload to become ready.

inputs:
  name:
    description: Application name. Defaults to the repository name.
    required: false
  timeout:
    description: How long a workload has to become ready before the deploy fails.
    required: false
    default: 2m
  path:
    description: The CUE package to render.
    required: false
    default: .deploy
  image:
    description: The image to deploy, as name@sha256:digest. Pass build-image's `image` output.
    required: false

runs:
  using: docker

  # By digest, pinned at bootstrap and moved by a reviewed commit. A tag here
  # would let whoever can push to `ci` run code in every pipeline in the
  # cluster, holding that pipeline's deploy credential.
  image: docker://gitea.512.dev/ci/toolbox@sha256:88ed6a0562f98a35b02d0c13254d0b69b343675ac98709451d526a9c58782e40

  entrypoint: /usr/local/lib/actions/deploy-app.sh
  env:
    PLUGIN_NAME: ${{ inputs.name }}
    PLUGIN_TIMEOUT: ${{ inputs.timeout }}
    PLUGIN_PATH: ${{ inputs.path }}
    PLUGIN_IMAGE: ${{ inputs.image }}