name: "Upload CI Artifact to S3"
description: "Authenticate via OIDC and upload a file to the CI artifacts bucket"

inputs:
  aws_role:
    description: "IAM role ARN to assume via OIDC"
    required: true
  aws_region:
    description: "AWS region"
    required: true
    default: "us-east-1"
  source_path:
    description: "Local file path to upload"
    required: true
  s3_key:
    description: "S3 key (path within the bucket)"
    required: true
  bucket:
    description: "S3 bucket name"
    required: true
    default: "cogent-polis-ci-artifacts"

runs:
  using: "composite"
  steps:
    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ inputs.aws_role }}
        aws-region: ${{ inputs.aws_region }}

    - name: Upload to S3
      shell: bash
      run: |
        aws s3 cp "${{ inputs.source_path }}" "s3://${{ inputs.bucket }}/${{ inputs.s3_key }}"
        echo "Uploaded: s3://${{ inputs.bucket }}/${{ inputs.s3_key }}"
