Contracts Main Deploy

# Template: Build + test + deploy on push to main
# Copy to: .github/workflows/main-deploy.yml
#
# Flow: build + test + artifact (ECR push) + deploy to EC2 via WireGuard VPN + tag.
# ECR repository is auto-created by the pipeline if missing.
#
# Required secrets:
#   AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION, AWS_ECR_URL,
#   AWS_EC2_HOST, AWS_EC2_USER, AWS_EC2_SSH_KEY, AWS_APP_PORT,
#   WG_PRIVATE_KEY, WG_ADDRESS, WG_PEER_PUBLIC_KEY, WG_PEER_ALLOWED_IPS, WG_PEER_ENDPOINT

name: Main Build, Test & Deploy

on:
  push:
    branches:
      - main

# Deploys on one ref run one at a time, in order. Never cancel one mid-flight:
# a half-applied deploy is worse than a late one.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write   # required by run_tag to push vX.Y.Z tag and create GitHub Release
  id-token: write

jobs:
  publish:
    if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
    uses: Codehunters-IO/ci-templates/.github/workflows/contracts-main-pipeline.yml@v2
    with:
      # Node comes from the image, not from a per-run download. The tag pins
      # the version a repository declares in `engines` / `.nvmrc`.
      container_image: 'ghcr.io/codehunters-io/ci-base-images:1-node'
      run_build: true
      run_test: true
      run_artifact: true
      run_deploy: true
      deploy_target: 'ec2-vpn'
      internal_port: '8545'
      memory_limit: '1024m'
      memory_reservation: '512m'
      push_latest: true
      environment: 'production'
      run_tag: true
    secrets: inherit