Java Main Deploy

# Template: Deploy on merge to main (CERT environment)
# Copy to: .github/workflows/main-deploy.yml
#
# Triggers on push to main branch (after release merge)
# Runs: build + artifact + deploy (CERT environment)
#
# Production is NOT deployed here. Promotion to prod is a MANUAL git tag (vX.Y.Z)
# handled by tag-deploy.yml — do NOT enable run_tag here (tags must be created by a human).
#
# Required secrets: Same as develop-deploy.yml. Slack notifications are built into the
# pipeline (its notify job); see develop-deploy.yml or the README for the org settings.

name: Deploy to Cert

on:
  push:
    branches:
      - main

# Deploys on one ref run one at a time, in order. Never cancel one mid-flight:
# a half-applied deploy is worse than a late one.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read
  id-token: write

jobs:
  pipeline:
    if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
    uses: <org>/ci-templates/.github/workflows/java-main-pipeline.yml@v2
    with:
      run_build: true
      run_test: false
      run_artifact: true
      artifact_registry: 'ecr'
      run_deploy: true
      deploy_target: 'ec2-vpn'
      environment: 'cert'
      # spring_profiles: additional profiles only (concatenated with the environment 'cert'). None needed here.
      # run_tag intentionally omitted: prod promotion is a manual tag (see tag-deploy.yml)
      # Mount TLS material/keystore from host into the container (read-only).
      # Place files at /opt/docker/<repo>/certs/ on the EC2 host before deploy.
      # Pair with container_env_vars (set in the pipeline) to point Spring Boot at them.
      # extra_volumes: |
      #   - ./certs:/etc/ssl/app:ro
    secrets: inherit