# Exercise 2 — Build once, promote everywhere (hard)
#
# Extend the pipeline into continuous delivery for a containerized service.
# Save as .github/workflows/delivery.yml.
#
# Requirements:
#   STEP 1: on push to main only.
#   STEP 2: job `image`: build the Docker image ONCE with buildx, tag it
#           ghcr.io/<org>/api:${{ github.sha }} (never :latest), push it, use the
#           GitHub Actions cache backend for layers, and output the image
#           DIGEST as a job output.
#   STEP 3: job `scan` (needs image): scan the pushed image with Trivy; fail on
#           CRITICAL/HIGH vulnerabilities that have a fix (ignore-unfixed).
#   STEP 4: job `deploy-staging` (needs scan): environment `staging`; obtain
#           cloud credentials via OIDC (permissions: id-token: write) — NO
#           long-lived keys in secrets; deploy the image BY DIGEST
#           (ghcr.io/<org>/api@sha256:...) using a placeholder deploy command;
#           then run smoke tests against the staging URL.
#   STEP 5: job `deploy-production` (needs deploy-staging): environment
#           `production` (configured in repo settings with required reviewers);
#           deploy the SAME digest; on failure run a rollback step to the
#           previous digest (read from a placeholder command / env).
#   STEP 6: comment answers:
#           a) why deploy by digest instead of tag?
#           b) why must production use the artifact built in `image` rather
#              than rebuilding?
#
# Verify against the CHECKLIST.

name: delivery

on:
  # TODO STEP 1

permissions:
  contents: read

jobs:
  image:
    # TODO STEP 2

  scan:
    # TODO STEP 3

  deploy-staging:
    # TODO STEP 4

  deploy-production:
    # TODO STEP 5

# STEP 6 answers:
# a)
# b)

# ---------------------------------------------------------------------------
# CHECKLIST:
# [ ] The image is built exactly once per commit; every later job references
#     the digest output from `image` (needs.image.outputs.digest).
# [ ] No `:latest` tag anywhere; staging and production run the same digest.
# [ ] Trivy runs with severity CRITICAL,HIGH, ignore-unfixed, and exit-code 1.
# [ ] Cloud auth uses OIDC (id-token: write + a cloud login action with a role),
#     no AWS_ACCESS_KEY_ID-style secrets.
# [ ] Production uses a protected environment (required reviewers) and has a
#     rollback step guarded by `if: failure()`.
# [ ] Answers: digests are immutable (a tag can be moved/overwritten);
#     rebuilding can produce a different artifact (new base image, new
#     dependency resolution) than the one that was tested.
# ---------------------------------------------------------------------------