git-workflow.yml

name: Site CI

on:
  workflow_call:

permissions:
  contents: read

env:
  NODE_VERSION: 24.16.0
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
  PLAYWRIGHT_BROWSERS_PATH: ~/.cache/ms-playwright
  NG_CLI_ANALYTICS: 'false'

jobs:
  # Always run: customHttp.yml SSOT, no customHeaders in amplify.yml, angular.json CSP parity.
  custom-headers-parity:
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v7
        with:
          node-version: 24.16.0
          cache: npm

      - name: Verify CSP SSOT (customHttp.yml + angular.json parity)
        run: node scripts/verify-custom-http-yaml.mjs

      - name: Verify CSP inline-style policy (Angular d22973b regression guard)
        run: npm run test:csp-inline-style-policy

  # Advisory check only. @playwright/mcp is IDE-only (npx @latest per .cursor/mcp.json + docs).
  # It is never a project dependency; the old require() would always fail after npm ci.
  verify-playwright-mcp-package:
    runs-on: ubuntu-latest
    timeout-minutes: 3
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v7
        with:
          node-version: 24.16.0
          cache: npm

      - name: Install dependencies (no scripts)
        run: npm ci --ignore-scripts --no-fund

      - name: Confirm @playwright/mcp is IDE-only (advisory; never a project dep)
        run: npm run verify:playwright-mcp

  csp-angular-sync-check:
    runs-on: ubuntu-latest
    needs: detect-changes
    if: needs.detect-changes.outputs.custom_http_changed == 'true'
    timeout-minutes: 3
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v7
        with:
          node-version: 24.16.0

      - name: Require angular.json synced from customHttp.yml
        run: |
          npm run sync:angular-serve-csp
          git diff --exit-code angular.json

  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      app_changed: ${{ steps.classify.outputs.app_changed }}
      e2e_changed: ${{ steps.classify.outputs.e2e_changed }}
      site_proxy_changed: ${{ steps.classify.outputs.site_proxy_changed }}
      site_monitor_changed: ${{ steps.classify.outputs.site_monitor_changed }}
      weather_alerts_changed: ${{ steps.classify.outputs.weather_alerts_changed }}
      email_alias_changed: ${{ steps.classify.outputs.email_alias_changed }}
      community_calendar_changed: ${{ steps.classify.outputs.community_calendar_changed }}
      infra_manifest_changed: ${{ steps.classify.outputs.infra_manifest_changed }}
      custom_http_changed: ${{ steps.classify.outputs.custom_http_changed }}
      terraform_changed: ${{ steps.classify.outputs.terraform_changed }}
      docs_only: ${{ steps.classify.outputs.docs_only }}
      changed_files: ${{ steps.classify.outputs.changed_files }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Classify paths
        id: classify
        shell: bash
        run: |
          set -euo pipefail

          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            git fetch origin "${{ github.base_ref }}" --depth=1
            mapfile -t FILES < <(git diff --name-only "origin/${{ github.base_ref }}...${{ github.sha }}")
          elif [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            # Manual runs have no push before/after range; compare to main so path filters work.
            git fetch origin main --depth=1
            mapfile -t FILES < <(git diff --name-only "origin/main...${{ github.sha }}")
          elif [[ "${{ github.event.before }}" == "0000000000000000000000000000000000000000" ]]; then
            mapfile -t FILES < <(git diff-tree --no-commit-id --name-only -r "${{ github.sha }}")
          else
            mapfile -t FILES < <(git diff --name-only "${{ github.event.before }}...${{ github.sha }}")
          fi

          APP_CHANGED=false
          E2E_CHANGED=false
          SITE_PROXY_CHANGED=false
          SITE_MONITOR_CHANGED=false
          WEATHER_ALERTS_CHANGED=false
          EMAIL_ALIAS_CHANGED=false
          COMMUNITY_CALENDAR_CHANGED=false
          INFRA_MANIFEST_CHANGED=false
          CUSTOM_HTTP_CHANGED=false
          TERRAFORM_CHANGED=false
          DOCS_ONLY=true

          for FILE in "${FILES[@]}"; do
            [[ -z "$FILE" ]] && continue

            case "$FILE" in
              customHttp.yml)
                CUSTOM_HTTP_CHANGED=true
                APP_CHANGED=true
                DOCS_ONLY=false
                ;;
              src/*|public/*|package.json|package-lock.json|.nvmrc|.node-version|.tool-versions|mise.toml|angular.json|amplify/*|amplify.yml|playwright.config.ts|tsconfig*.json|eslint.config.js|scripts/deploy-static-site.sh|scripts/deploy-static-site.manifest.test.mjs|scripts/lib/read-hosting-manifest.mjs|scripts/generate-runtime-config.mjs|scripts/generate-static-route-entrypoints.mjs|scripts/convert-hero.mjs|scripts/verify-custom-http-yaml.mjs|scripts/verify-csp-inline-style-policy.mjs|scripts/verify-csp-inline-style-policy.test.mjs|scripts/verify-public-cms-query.mjs|scripts/sync-angular-serve-csp.mjs|scripts/lib/custom-http-csp.mjs|scripts/lib/csp-inline-style-policy.mjs|scripts/sync-amplify-custom-headers.sh|scripts/sync-amplify-spa-rules.sh|scripts/amplify-spa-rewrite-rules.json|static-routes.txt|.github/workflows/ci.yml|.github/workflows/git-workflow.yml|.github/workflows/deploy-production.yml|.github/workflows/hosting-headers-drift-watch.yml|.github/workflows/ollama-ci-diagnosis.yml|.github/workflows/ollama-pr-review.yml|.github/workflows/copilot-setup-steps.yml|.github/actions/**|scripts/ollama_ci_diagnosis.sh|scripts/ollama-pr-review.mjs|scripts/ollama-run-prompt.mjs|scripts/extract-ci-failure-facts.mjs|scripts/ci-collect-ollama-improvements.mjs|scripts/lib/ollama-*.mjs|scripts/lib/ci-failure-facts.mjs|scripts/lib/ollama-ci-system-prompt.txt|docs/ci-ollama-review.md|docs/third-party-csp-registry.md)
                APP_CHANGED=true
                DOCS_ONLY=false
                ;;
              e2e/*)
                E2E_CHANGED=true
                DOCS_ONLY=false
                ;;
              infrastructure/nws-weather-proxy/*)
                SITE_PROXY_CHANGED=true
                DOCS_ONLY=false
                ;;
              infrastructure/site-monitor/**|infrastructure/ops_lib/**|scripts/deploy-site-monitor.py|scripts/ops_ci_on_failure.py|docs/ops-observability.md)
                SITE_MONITOR_CHANGED=true
                DOCS_ONLY=false
                ;;
              infrastructure/severe-weather-signup/*)
                WEATHER_ALERTS_CHANGED=true
                DOCS_ONLY=false
                ;;
              infrastructure/email-alias-router/*|scripts/deploy-email-alias-router.py)
                EMAIL_ALIAS_CHANGED=true
                DOCS_ONLY=false
                ;;
              infrastructure/community-calendar/*|scripts/deploy-community-calendar-backend.py)
                COMMUNITY_CALENDAR_CHANGED=true
                DOCS_ONLY=false
                ;;
              infrastructure/aws-infrastructure.manifest.json|infrastructure/amplify-branch-env.manifest.json|infrastructure/iam/**|scripts/verify-aws-infrastructure.mjs|docs/AWS_INFRASTRUCTURE_SOT.md|docs/contact-intake-decommission.md)
                INFRA_MANIFEST_CHANGED=true
                DOCS_ONLY=false
                ;;
              infrastructure/terraform/**|scripts/terraform-*.sh)
                TERRAFORM_CHANGED=true
                DOCS_ONLY=false
                ;;
              docs/*|README.md|CLERK-CMS-GUIDE.md|bot-training/*|scripts/deploy-severe-weather-backend.py|scripts/user-secrets.mjs)
                ;;
              *)
                DOCS_ONLY=false
                ;;
            esac
          done

          {
            echo "app_changed=$APP_CHANGED"
            echo "e2e_changed=$E2E_CHANGED"
            echo "site_proxy_changed=$SITE_PROXY_CHANGED"
            echo "site_monitor_changed=$SITE_MONITOR_CHANGED"
            echo "weather_alerts_changed=$WEATHER_ALERTS_CHANGED"
            echo "email_alias_changed=$EMAIL_ALIAS_CHANGED"
            echo "community_calendar_changed=$COMMUNITY_CALENDAR_CHANGED"
            echo "infra_manifest_changed=$INFRA_MANIFEST_CHANGED"
            echo "custom_http_changed=$CUSTOM_HTTP_CHANGED"
            echo "terraform_changed=$TERRAFORM_CHANGED"
            echo "docs_only=$DOCS_ONLY"
            echo "changed_files<<EOF"
            printf '%s\n' "${FILES[@]}"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Write summary
        shell: bash
        run: |
          cat >> "$GITHUB_STEP_SUMMARY" <<'EOF'
          ## Change Classification

          - Deployable site files changed: ${{ steps.classify.outputs.app_changed }}
          - End-to-end validation files changed: ${{ steps.classify.outputs.e2e_changed }}
          - Website runtime proxy code changed: ${{ steps.classify.outputs.site_proxy_changed }}
          - Site monitor code changed: ${{ steps.classify.outputs.site_monitor_changed }}
          - Severe weather signup backend changed: ${{ steps.classify.outputs.weather_alerts_changed }}
          - Email alias router changed: ${{ steps.classify.outputs.email_alias_changed }}
          - Infrastructure manifest / SSOT changed: ${{ steps.classify.outputs.infra_manifest_changed }}
          - customHttp.yml changed: ${{ steps.classify.outputs.custom_http_changed }}
          - Terraform IaC changed: ${{ steps.classify.outputs.terraform_changed }}
          - Docs or maintainer-only change set: ${{ steps.classify.outputs.docs_only }}

          ### Changed Files

          ```text
          ${{ steps.classify.outputs.changed_files }}
          ```
          EOF

  verify-aws-infra-manifest:
    runs-on: ubuntu-latest
    needs: detect-changes
    if: needs.detect-changes.outputs.infra_manifest_changed == 'true'
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v7
        with:
          node-version: 24.16.0
          cache: npm

      - name: Validate infrastructure manifest (offline)
        run: node scripts/verify-aws-infrastructure.mjs --offline

  # Terraform is the repo IaC path (infrastructure/terraform/). Static site publish remains GHA deploy-production.
  terraform-validation:
    name: Terraform fmt + validate
    runs-on: ubuntu-latest
    needs: detect-changes
    if: needs.detect-changes.outputs.terraform_changed == 'true'
    timeout-minutes: 8
    steps:
      - uses: actions/checkout@v6

      - uses: hashicorp/setup-terraform@v4
        with:
          terraform_version: 1.9.8

      - name: terraform fmt -check
        run: terraform -chdir=infrastructure/terraform fmt -check -recursive

      - name: terraform validate (local backend)
        run: |
          set -euo pipefail
          for dir in \
            infrastructure/terraform/bootstrap/state-backend \
            infrastructure/terraform/environments/town-production \
            infrastructure/terraform/stacks/guestbook-decommission; do
            echo "==> ${dir}"
            terraform -chdir="${dir}" init -backend=false -input=false >/dev/null
            terraform -chdir="${dir}" validate
          done
  frontend-lint-build:
    runs-on: ubuntu-latest
    needs: detect-changes
    if: needs.detect-changes.outputs.app_changed == 'true' || needs.detect-changes.outputs.e2e_changed == 'true'
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v7
        with:
          node-version: 24.16.0
          cache: npm

      - name: Restore Angular CLI cache
        uses: ./.github/actions/cache-angular-cli

      - name: Prepare failure log directory
        run: mkdir -p failure-context

      - name: Verify Node version
        run: node --version | grep -qE '^v24\.' || (echo "::error::Expected Node 24.x, got $(node --version)" && exit 1)

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit

      - name: Lint
        run: |
          set -o pipefail
          npm run lint 2>&1 | tee failure-context/lint.log

      - name: Run Angular browser unit tests
        run: |
          set -o pipefail
          npm run test:unit:browser 2>&1 | tee failure-context/unit-browser.log

      - name: Run Vitest helper tests
        run: |
          set -o pipefail
          npm run test:vitest 2>&1 | tee failure-context/vitest.log

      - name: Verify WebP hero assets exist
        run: |
          for f in public/hero-wiley.webp public/hero-wiley-800.webp; do
            [ -f "$f" ] || (echo "::error::Missing required asset: $f — run npm run assets:hero" && exit 1)
          done

      - name: Build
        run: |
          set -o pipefail
          npm run build:ci 2>&1 | tee failure-context/build.log
        env:
          # Secretless PR workflows (Dependabot, re-runs): non-strict runtime + SSOT fallbacks.
          # Staff PRs with repository secrets keep strict validation (same as npm run build).
          STRICT_RUNTIME_CONFIG: ${{ secrets.APPSYNC_CMS_API_KEY != '' && '1' || '0' }}
          APPSYNC_CMS_ENDPOINT: ${{ secrets.APPSYNC_CMS_ENDPOINT }}
          APPSYNC_CMS_API_KEY: ${{ secrets.APPSYNC_CMS_API_KEY }}
          APPSYNC_CMS_REGION: ${{ secrets.APPSYNC_CMS_REGION }}
          NWS_PROXY_ENDPOINT: ${{ secrets.NWS_PROXY_ENDPOINT }}
          SEVERE_WEATHER_SIGNUP_API_ENDPOINT: ${{ secrets.SEVERE_WEATHER_SIGNUP_API_ENDPOINT }}
          SEVERE_WEATHER_SIGNUP_ENABLED: ${{ secrets.SEVERE_WEATHER_SIGNUP_ENABLED }}
          COMMUNITY_CALENDAR_ENDPOINT: ${{ secrets.COMMUNITY_CALENDAR_ENDPOINT }}
          EASYPEASY_API_ENDPOINT: ${{ secrets.EASYPEASY_API_ENDPOINT }}
          EASYPEASY_CHAT_URL: ${{ secrets.EASYPEASY_CHAT_URL }}
          CONTACT_UPDATE_REVIEW_API_URL: ${{ secrets.CONTACT_UPDATE_REVIEW_API_URL }}
          COGNITO_USER_POOL_ID: ${{ secrets.COGNITO_USER_POOL_ID }}
          COGNITO_USER_POOL_CLIENT_ID: ${{ secrets.COGNITO_USER_POOL_CLIENT_ID }}
          COGNITO_IDENTITY_POOL_ID: ${{ secrets.COGNITO_IDENTITY_POOL_ID }}
          COGNITO_HOSTED_UI_DOMAIN: ${{ secrets.COGNITO_HOSTED_UI_DOMAIN }}
          STORAGE_S3_BUCKET: ${{ secrets.STORAGE_S3_BUCKET }}
          STORAGE_S3_REGION: ${{ secrets.STORAGE_S3_REGION }}

      - name: Verify build output contains WebP reference
        run: grep -r 'hero-wiley.webp' dist/townofwiley-app/browser/ || (echo '::warning::hero-wiley.webp not referenced in build output' && true)

      - uses: actions/upload-artifact@v6
        with:
          name: production-browser-dist
          path: dist/townofwiley-app/browser/
          retention-days: 1
          if-no-files-found: error

      - name: Capture failure snapshot for Ollama triage
        if: failure()
        run: |
          {
            echo "job=frontend-lint-build"
            echo "sha=${{ github.sha }}"
            echo "ref=${{ github.ref }}"
            echo "event=${{ github.event_name }}"
          } > failure-context/meta.txt
          for f in lint unit-browser vitest build; do
            if [ -f "failure-context/${f}.log" ]; then
              tail -n 120 "failure-context/${f}.log" > "failure-context/${f}-tail.txt" || true
            fi
          done

      - name: Upload CI failure snapshot
        if: failure()
        uses: actions/upload-artifact@v6
        with:
          name: ci-failure-snapshot-${{ github.run_id }}
          path: failure-context/
          retention-days: 14
          if-no-files-found: ignore

  frontend-smoke:
    name: Test Browsers + Full E2E Regression
    needs: detect-changes
    if: needs.detect-changes.outputs.app_changed == 'true' || needs.detect-changes.outputs.e2e_changed == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v7
        with:
          node-version: 24.16.0
          cache: npm

      - name: Verify Node version
        run: node --version | grep -qE '^v24\.' || (echo "::error::Expected Node 24.x, got $(node --version)" && exit 1)

      - name: Install dependencies
        run: npm ci --no-audit

      - name: Cache Playwright Chromium
        id: playwright-cache
        uses: ./.github/actions/cache-playwright-chromium
        with:
          browsers_path: ${{ env.PLAYWRIGHT_BROWSERS_PATH }}

      - name: Install Playwright Chromium
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        run: |
          set -euo pipefail
          echo "Installing Chromium only (skipping --with-deps apt; prevents long CI hangs)"
          timeout 900 npm run test:e2e:install
        env:
          CI: true
          PLAYWRIGHT_BROWSERS_PATH: ${{ env.PLAYWRIGHT_BROWSERS_PATH }}

      - name: E2E preflight (Node toolchain, deps, Playwright Chromium)
        run: python3 scripts/e2e_smoke_preflight.py

      - name: Run PR smoke tier (critical paths, local ng serve)
        # Omit E2E_BASE_URL so Playwright starts local ng serve. Invalid org/repo variables fail fast in playwright.config (resolveE2eEnv).
        # Full inventory suite: npm run test:e2e:inventory (nightly workflow) or npm run test:regression:e2e locally.
        run: npm run test:e2e:smoke
        env:
          CI: true
          E2E_RUNTIME_MANIFEST_FALLBACKS: '0'
          PLAYWRIGHT_BROWSERS_PATH: ${{ env.PLAYWRIGHT_BROWSERS_PATH }}

      - uses: actions/upload-artifact@v6
        if: always()
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 7
          if-no-files-found: ignore

  site-monitor-tests:
    runs-on: ubuntu-latest
    needs: detect-changes
    if: |
      needs.detect-changes.outputs.app_changed == 'true' ||
      needs.detect-changes.outputs.e2e_changed == 'true' ||
      needs.detect-changes.outputs.site_monitor_changed == 'true'
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v7
        with:
          node-version: 24.16.0
          cache: npm

      - name: Verify Node version
        run: node --version | grep -qE '^v24\.' || (echo "::error::Expected Node 24.x, got $(node --version)" && exit 1)

      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: '3.13'
          cache: pip
          cache-dependency-path: scripts/requirements-ci.txt

      - name: Run site monitor tests
        run: npm run test:infra:monitor

  site-runtime-proxy-tests:
    runs-on: ubuntu-latest
    needs: detect-changes
    if: needs.detect-changes.outputs.site_proxy_changed == 'true'
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v7
        with:
          node-version: 24.16.0
          cache: npm

      - name: Install dependencies
        run: npm ci --prefer-offline --no-audit

      - name: Run public-site proxy tests
        run: npm run test:infra

      - name: Verify NWS proxy solar fmt does not produce NaN
        run: |
          node --input-type=module <<'EOF'
          import { handler } from './infrastructure/nws-weather-proxy/index.mjs';
          // Smoke-test the solar formatter with whole-number hour values that
          // previously triggered the NaN:00 bug.
          const { computeSolarTimes } = await import('./infrastructure/nws-weather-proxy/index.mjs').catch(() => ({}));
          // If the module does not export computeSolarTimes directly, skip.
          if (typeof computeSolarTimes !== 'function') process.exit(0);
          const result = computeSolarTimes('2026-06-21');
          if (result.sunrise.includes('NaN') || result.sunset.includes('NaN')) {
            console.error('Solar formatter produced NaN:', result);
            process.exit(1);
          }
          console.log('Solar times OK:', result);
          EOF

  backend-python-tests:
    runs-on: ubuntu-latest
    needs: detect-changes
    if: |
      needs.detect-changes.outputs.weather_alerts_changed == 'true' ||
      needs.detect-changes.outputs.email_alias_changed == 'true' ||
      needs.detect-changes.outputs.community_calendar_changed == 'true'
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v7
        with:
          node-version: 24.16.0
          cache: npm

      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: '3.13'
          cache: pip
          cache-dependency-path: scripts/requirements-ci.txt

      - name: Install Python CI test dependencies
        run: python -m pip install --quiet -r scripts/requirements-ci.txt

      - name: Run Python backend tests
        run: npm run test:infra:backend

      - name: Verify email alias MIME passthrough guards
        if: needs.detect-changes.outputs.email_alias_changed == 'true'
        run: |
          npm run verify:email-alias-mime
          npm run test:infra:mail

  maintainer-only-summary:
    runs-on: ubuntu-latest
    needs: detect-changes
    if: needs.detect-changes.outputs.docs_only == 'true'
    steps:
      - name: Mark maintainer-only change set
        run: echo "Maintainer-only changes detected. Frontend regression checks were intentionally skipped."

  security-audit:
    runs-on: ubuntu-latest
    needs: detect-changes
    if: needs.detect-changes.outputs.app_changed == 'true'
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v7
        with:
          node-version: 24.16.0
          cache: npm

      - name: Install dependencies (no scripts)
        run: npm ci --ignore-scripts --no-fund

      - name: Run npm audit (fail on critical)
        run: npm audit --audit-level=critical

      - name: Run npm audit (warn on high)
        run: npm audit --audit-level=high
        continue-on-error: true

  ci-gate:
    name: CI gate (merge required)
    needs:
      - detect-changes
      - custom-headers-parity
      - verify-playwright-mcp-package
      - csp-angular-sync-check
      - verify-aws-infra-manifest
      - frontend-lint-build
      - frontend-smoke
      - site-monitor-tests
      - site-runtime-proxy-tests
      - backend-python-tests
      - security-audit
      - maintainer-only-summary
    if: always()
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - uses: actions/checkout@v6

      - name: Fail if any required job failed
        env:
          NEEDS_JSON: ${{ toJSON(needs) }}
        run: node scripts/ci-gate-check.mjs

  ollama-ci-diagnosis:
    name: Ollama CI failure triage (advisory)
    needs:
      - ci-gate
    if: always() && needs.ci-gate.result == 'failure'
    runs-on: ubuntu-latest
    timeout-minutes: 25
    continue-on-error: true
    permissions:
      actions: read
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v6

      - name: Run Ollama failure diagnosis
        uses: ./.github/actions/ollama-ci-diagnosis
        with:
          run_id: ${{ github.run_id }}
          workflow_name: Site CI
          model: ${{ vars.OLLAMA_CI_MODEL || 'llama3.2:3b' }}
          ollama_version: ${{ vars.OLLAMA_VERSION || '' }}

  # Optional SNS + S3 ops archive (no-op without secrets). See docs/ops-observability.md
  ops-ci-failure-notify:
    name: Ops CI failure notify (advisory)
    needs:
      - ci-gate
      - ollama-ci-diagnosis
    if: always() && needs.ci-gate.result == 'failure'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    continue-on-error: true
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v6

      - name: Configure AWS credentials (optional OIDC)
        continue-on-error: true
        uses: aws-actions/configure-aws-credentials@v4
        with:
          # Prefer dedicated ops role when present; fall back to static-site deploy role.
          role-to-assume: ${{ secrets.TOW_OPS_AWS_ROLE_ARN != '' && secrets.TOW_OPS_AWS_ROLE_ARN || 'arn:aws:iam::570912405222:role/GitHubActions-TownOfWiley-StaticSiteDeploy' }}
          aws-region: us-east-2

      - name: Download failure / Ollama artifacts when present
        continue-on-error: true
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mkdir -p failure-context outputs
          gh run download "${{ github.run_id }}" -n "ci-failure-snapshot-${{ github.run_id }}" -D failure-context 2>/dev/null || true
          gh run download "${{ github.run_id }}" -n "ollama-ci-diagnosis-${{ github.run_id }}" -D outputs 2>/dev/null || true

      - name: SNS notify + S3 archive (optional)
        env:
          TOW_OPS_SNS_TOPIC_ARN: ${{ secrets.TOW_OPS_SNS_TOPIC_ARN }}
          TOW_OPS_ARTIFACTS_BUCKET: ${{ secrets.TOW_OPS_ARTIFACTS_BUCKET }}
          CORRELATION_ID: ${{ github.run_id }}
          GITHUB_RUN_ID: ${{ github.run_id }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_SHA: ${{ github.sha }}
          GITHUB_SERVER_URL: ${{ github.server_url }}
          AWS_REGION: us-east-2
          LOG_FORMAT: json
        run: python3 scripts/ops_ci_on_failure.py --run-id "${{ github.run_id }}"

  deploy-production:
    name: Deploy production (S3 + CloudFront)
    needs: [detect-changes, frontend-lint-build, frontend-smoke]
    if: |
      github.event_name == 'push' &&
      github.ref == 'refs/heads/main' &&
      needs.detect-changes.outputs.app_changed == 'true' &&
      needs.frontend-lint-build.result == 'success' &&
      (needs.frontend-smoke.result == 'success' || needs.frontend-smoke.result == 'skipped')
    runs-on: ubuntu-latest
    environment: production
    permissions:
      id-token: write
      contents: read
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v6

      - uses: actions/download-artifact@v6
        with:
          name: production-browser-dist
          path: dist/townofwiley-app/browser

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::570912405222:role/GitHubActions-TownOfWiley-StaticSiteDeploy
          aws-region: us-east-2

      - name: Deploy static site to S3 + CloudFront
        run: bash scripts/deploy-static-site.sh --skip-build

      - name: Post-deploy smoke (homepage headers)
        run: curl -sfI https://townofwiley.gov/

      - name: Post-deploy smoke (runtime-config JSON)
        run: |
          curl -sf https://townofwiley.gov/runtime-config.js | node -e "
          const src = require('fs').readFileSync(0, 'utf8');
          const match = src.match(/window\.__TOW_RUNTIME_CONFIG__\s*=\s*(\{[\s\S]*\});?\s*$/);
          if (!match) { console.error('::error::runtime-config.js missing window.__TOW_RUNTIME_CONFIG__ payload'); process.exit(1); }
          JSON.parse(match[1]);
          console.log('runtime-config ok');
          "

      - name: Post-deploy CSP probe
        run: bash scripts/probe-live-hosting-csp.sh