action.yml

name: 'Sync Deploy Docs Trigger'
description: 'Writes the canonical Deploy Docs trigger workflow to a source branch of a repository'
author: 'Spring Cloud Team'

inputs:
  repository:
    description: 'Repository to update (format: org/repo-name)'
    required: true
  branch:
    description: 'Source branch to update (e.g. main, 4.3.x, release/5.0.4)'
    required: true
  template-path:
    description: 'Path to the trigger template within this repository'
    required: false
    default: 'examples/deploy-docs-trigger.yml'
  token:
    description: 'GitHub token with contents: write permission on the repository'
    required: true
  dry-run:
    description: 'Render and diff the change without committing or pushing'
    required: false
    default: 'false'
  commit-message:
    description: 'Commit message. Keep [skip actions] unless you intend the push to trigger a docs build.'
    required: false
    default: 'Use canonical deploy-docs trigger workflow [skip actions]'
  git-user-name:
    description: 'Git author name for the commit'
    required: false
    default: 'Spring Builds'
  git-user-email:
    description: 'Git author email for the commit'
    required: false
    default: 'svc.spring-builds@broadcom.com'

outputs:
  changed:
    description: 'true if the workflow file was updated'
    value: ${{ steps.sync.outputs.changed }}
  status:
    description: 'One of: updated, unchanged, skipped-no-branch, skipped-no-trigger'
    value: ${{ steps.sync.outputs.status }}

runs:
  using: 'composite'
  steps:
    - name: Sync deploy-docs trigger workflow
      id: sync
      shell: bash
      env:
        GH_TOKEN: ${{ inputs.token }}
        REPO: ${{ inputs.repository }}
        BRANCH: ${{ inputs.branch }}
        TEMPLATE_PATH: ${{ inputs.template-path }}
        DRY_RUN: ${{ inputs.dry-run }}
        COMMIT_MESSAGE: ${{ inputs.commit-message }}
        GIT_USER_NAME: ${{ inputs.git-user-name }}
        GIT_USER_EMAIL: ${{ inputs.git-user-email }}
      run: |
        set -euo pipefail

        TARGET_FILE='.github/workflows/deploy-docs.yml'

        echo "=== Sync Deploy Docs Trigger ==="
        echo "Repository: $REPO"
        echo "Branch:     $BRANCH"
        echo "Dry run:    $DRY_RUN"
        echo ""

        if [[ ! -f "$TEMPLATE_PATH" ]]; then
          echo "::error::Template '${TEMPLATE_PATH}' not found in this repository."
          exit 1
        fi

        # Render the trigger: drop the template-only header comment and pin the
        # push allow-list to this branch. The template is the single source of
        # truth so it and what actually ships cannot drift.
        RENDERED="$(mktemp)"
        {
          echo "# Generated by the rollout-deploy-docs-trigger workflow in"
          echo "# spring-cloud/spring-cloud-github-actions."
          echo "#"
          echo "# Do not edit this file directly - update examples/deploy-docs-trigger.yml"
          echo "# there and re-run the rollout, otherwise your change will be overwritten."
          echo ""
          sed -n '/^name:/,$p' "$TEMPLATE_PATH" \
            | BRANCH="$BRANCH" perl -pe 's/^(\s*- )__BRANCH__\s*$/$1$ENV{BRANCH}\n/'
        } > "$RENDERED"

        # A surviving placeholder would silently produce a workflow that never
        # fires, so fail loudly instead.
        if grep -q '__BRANCH__' "$RENDERED"; then
          echo "::error::__BRANCH__ placeholder was not substituted - check the template."
          exit 1
        fi
        if ! grep -qF -- "- ${BRANCH}" "$RENDERED"; then
          echo "::error::Rendered trigger does not list branch '${BRANCH}' - check the template."
          exit 1
        fi

        # actions/checkout persists an http.https://github.com/.extraheader
        # credential in the local config of the repository it checked out, and
        # that header overrides credentials embedded in a remote URL. Work from
        # outside that checkout so these git calls use our token.
        WORKDIR="$(mktemp -d)"
        cd "$WORKDIR"

        REMOTE_URL="https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git"

        set +e
        HEADS="$(git ls-remote --heads "$REMOTE_URL" "refs/heads/${BRANCH}" 2>&1)"
        LS_RC=$?
        set -e

        if [[ $LS_RC -ne 0 ]]; then
          echo "::error::Could not read ${REPO}: ${HEADS//${GH_TOKEN}/<token>}"
          exit 1
        fi

        if [[ -z "$HEADS" ]]; then
          echo "No '${BRANCH}' branch in ${REPO} - nothing to do."
          echo 'changed=false' >> "$GITHUB_OUTPUT"
          echo 'status=skipped-no-branch' >> "$GITHUB_OUTPUT"
          exit 0
        fi

        git clone --quiet --depth 1 --single-branch --branch "$BRANCH" \
          "$REMOTE_URL" "${WORKDIR}/repo"

        cd "${WORKDIR}/repo"

        # This rollout only updates branches that already have a trigger. A
        # branch without one is deliberately not built, so never create it.
        if [[ ! -f "$TARGET_FILE" ]]; then
          echo "No ${TARGET_FILE} on '${BRANCH}' in ${REPO} - skipping (this rollout never creates it)."
          echo 'changed=false' >> "$GITHUB_OUTPUT"
          echo 'status=skipped-no-trigger' >> "$GITHUB_OUTPUT"
          exit 0
        fi

        git config user.name "$GIT_USER_NAME"
        git config user.email "$GIT_USER_EMAIL"

        cp "$RENDERED" "$TARGET_FILE"
        git add "$TARGET_FILE"

        if git diff --cached --quiet; then
          echo "${TARGET_FILE} on '${BRANCH}' is already up to date."
          echo 'changed=false' >> "$GITHUB_OUTPUT"
          echo 'status=unchanged' >> "$GITHUB_OUTPUT"
          exit 0
        fi

        echo "--- diff ---"
        git --no-pager diff --cached
        echo "--- end diff ---"

        if [[ "$DRY_RUN" == 'true' ]]; then
          echo ""
          echo "Dry run - not committing or pushing. Would have updated ${TARGET_FILE}."
          echo 'changed=true' >> "$GITHUB_OUTPUT"
          echo 'status=updated' >> "$GITHUB_OUTPUT"
          exit 0
        fi

        # This file triggers on push to its own branch, so the commit message
        # must keep a skip token unless a docs build is wanted.
        if [[ "$COMMIT_MESSAGE" != *'[skip actions]'* && "$COMMIT_MESSAGE" != *'[skip ci]'* ]]; then
          echo "::warning::Commit message has no skip token - this push will trigger a docs build in ${REPO}."
        fi

        git commit --quiet -m "$COMMIT_MESSAGE"
        git push --quiet origin "$BRANCH"

        echo "${TARGET_FILE} updated on '${BRANCH}' in ${REPO}."
        echo 'changed=true' >> "$GITHUB_OUTPUT"
        echo 'status=updated' >> "$GITHUB_OUTPUT"

branding:
  icon: 'zap'
  color: 'green'