# M6-D5: the source-repo publish pipeline (ADR-0014 topology — doc truth +
# generation live HERE; spt-releases' gh-pages branch is a pure rendered
# snapshot, force-pushed whole each publish; history lives in this repo).
#
# Triggers: release tags (the v0.1.0 ship publishes the matching docs) and
# manual dispatch (docs-only refreshes between releases).
#
# Needs the RELEASES_TOKEN repo secret: a fine-grained PAT with
# Contents:read/write on SaberMage/spt-releases only.
#
# [impl->REQ-REL-1]
# [impl->REQ-DOCS-1]
name: docs-publish

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

jobs:
  publish:
    runs-on: [self-hosted, Linux, kitsubito]
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v5
      - name: Ensure mdbook
        # Self-healing like the traceability install: kitsubito keeps a cargo
        # toolchain; install once, reuse thereafter.
        run: |
          if ! command -v mdbook >/dev/null && [ ! -x "$HOME/.cargo/bin/mdbook" ]; then
            cargo install mdbook --locked
          fi
          export PATH="$HOME/.cargo/bin:$PATH"
          mdbook --version
      - name: Drift gates (CLI ref + llms links + schema)
        run: |
          cargo run -p xtask -- check
          cargo test -q -p spt-runtime checked_in_schema
      - name: Assemble publish tree
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          cargo run -p xtask -- site "$RUNNER_TEMP/site"
      - name: Sync repo-face files to spt-releases main
        # releases-repo/ is the truth for spt-releases' README + licenses
        # (ADR-0014: truth lives here). Push each only when it differs.
        env:
          RELEASES_TOKEN: ${{ secrets.RELEASES_TOKEN }}
        # gh's built-in --jq, not the jq binary (absent on the Linux runner —
        # the first tagged run's exit-127, on gravity).
        run: |
          export GH_TOKEN="$RELEASES_TOKEN"
          for f in README.md LICENSE-MIT LICENSE-BINARY; do
            local_b64=$(base64 -w0 "releases-repo/$f")
            remote_b64=$(gh api "repos/SaberMage/spt-releases/contents/$f" \
              --jq '.content' 2>/dev/null | tr -d '\n' || true)
            remote_sha=$(gh api "repos/SaberMage/spt-releases/contents/$f" \
              --jq '.sha' 2>/dev/null || true)
            if [ "$local_b64" != "$remote_b64" ]; then
              echo "syncing $f -> spt-releases main"
              gh api -X PUT "repos/SaberMage/spt-releases/contents/$f" \
                -f message="docs: sync $f from spt-core@${GITHUB_SHA::12}" \
                -f content="$local_b64" \
                ${remote_sha:+-f sha="$remote_sha"} >/dev/null
            else
              echo "$f up to date"
            fi
          done

      - name: Push to spt-releases gh-pages
        env:
          RELEASES_TOKEN: ${{ secrets.RELEASES_TOKEN }}
        run: |
          cd "$RUNNER_TEMP/site"
          git init -q -b gh-pages
          git -c user.name="spt-core-ci" -c user.email="ci@users.noreply.github.com" \
            add -A
          git -c user.name="spt-core-ci" -c user.email="ci@users.noreply.github.com" \
            commit -q -m "docs: publish from spt-core@${GITHUB_SHA::12} (${GITHUB_REF_NAME})"
          git push --force \
            "https://x-access-token:${RELEASES_TOKEN}@github.com/SaberMage/spt-releases" \
            gh-pages
