React Main Deploy

# Template: Deploy on merge to main (production)
# Copy to: .github/workflows/main-deploy.yml
#
# Triggers on push to main branch (after release merge)
# Runs: build + deploy (PRODUCTION environment)
#
# For S3 deployment:
#   Required secrets: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION, AWS_S3_BUCKET
#   Optional secrets: AWS_CLOUDFRONT_DISTRIBUTION_ID
#
# For Amplify deployment:
#   Required secrets: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION, AWS_AMPLIFY_APP_ID, AWS_AMPLIFY_BRANCH
#
# Note: Tests should have passed in release branch, only build and deploy here

name: Deploy to PRODUCTION

on:
  push:
    branches:
      - main

# Deploys on one ref run one at a time, in order. Never cancel one mid-flight:
# a half-applied deploy is worse than a late one.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write   # required by run_tag to push vX.Y.Z tag and create GitHub Release
  id-token: write

jobs:
  deploy:
    if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
    uses: <org>/ci-templates/.github/workflows/react-main-pipeline.yml@v2
    with:
      run_build: true
      run_test: false
      run_deploy: true
      deploy_target: 'amplify'
      environment: 'production'
      run_tag: true
    secrets: inherit