Nginx Release Deploy

# Template: Deploy on release branch
# Copy to: .github/workflows/release-deploy.yml
#
# Triggers on push to release/* branches
# Runs: build + test + artifact + deploy (STAGING)
#
# Required secrets: same as nginx-develop-deploy.yml

name: Deploy to STAGING

on:
  push:
    branches:
      - 'release/**'

# Deploys on one ref run one at a time, in order. Never cancel one mid-flight:
# a half-applied deploy is worse than a late one.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read
  id-token: write

jobs:
  deploy:
    if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
    uses: <org>/ci-templates/.github/workflows/nginx-main-pipeline.yml@v2
    with:
      run_build: true
      run_test: true
      run_artifact: true
      run_deploy: true
      deploy_target: 'ec2-vpn'
      environment: 'staging'
      internal_port: '8080'
    secrets: inherit