name: Deploy to Production
on:
  workflow_dispatch:

jobs:
  pre-deploy-checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Check branch
        run: |
          if [ "${{ github.ref }}" != "refs/heads/main" ]; then
            echo "❌ Can only deploy from main branch"
            exit 1
          fi
      - name: Verify CI passed
        uses: actions/github-script@v7
        with:
          script: |
            const checks = await github.rest.checks.listForRef({
              owner: context.repo.owner,
              repo: context.repo.repo,
              ref: context.sha,
            });
            const failed = checks.data.check_runs.filter(
              check => check.conclusion === 'failure'
            );
            if (failed.length > 0) {
              throw new Error('CI checks must pass before deployment');
            }