# The per-repo footprint of sandbox publishing: on a push to a sandbox/* branch,
# run the deploy workflow that lives in THIS repo. Both this file and
# _deploy-sandbox.yml are distributed to every repo by the ci-cd file sync.
#
# Each prototype configures its own deploy with a committed sandbox.json:
#   { "stack": "spa" | "static" | "node", "apiBaseUrl": "https://staging-api…" }
name: Sandbox

on:
  push:
    branches: ["sandbox/**"]

# Must be granted by the caller — a reusable workflow can't raise these itself,
# and id-token (OIDC) is never on by default.
permissions:
  id-token: write
  contents: read
  deployments: write

jobs:
  deploy:
    uses: ./.github/workflows/_deploy-sandbox.yml