name: Release Candidate

on:
  workflow_run:
    workflows: [CI]
    branches: [main]
    types: [completed]

jobs:
  package:
    name: Build verified release candidate
    runs-on: ubuntu-latest
    timeout-minutes: 30
    if: github.event.workflow_run.conclusion == 'success'
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
      - run: npm ci
      - run: python3 packages/casan-harness/scripts/bash/project_manifest.py run --root . --manifest apps/okr/domain/project.manifest.json --kind build
      - name: Package immutable application artifacts
        run: tar -czf okr-release-candidate.tgz apps/okr/backend/dist apps/okr/frontend/dist apps/okr/domain/project.manifest.json
      - uses: actions/upload-artifact@v4
        with:
          name: okr-release-candidate-${{ github.event.workflow_run.head_sha }}
          path: okr-release-candidate.tgz
          if-no-files-found: error
          retention-days: 14

      # Environment deployment is intentionally adapter-owned. Add a separate job
      # protected by the GitHub `production` environment when the target platform,
      # workload identity, health check, and rollback command are approved.