name: 📦 Sync TSL Playbook

on:
  push:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: sync-tsl-playbook-${{ github.repository }}
  cancel-in-progress: true

env:
  WORKSPACE_DIR: "/home/workspace"
  TARGET_BRANCH: "tsl-playbook"

jobs:
  sync:
    name: 📦 Build and publish tsl-playbook
    runs-on: ubuntu-22.04

    steps:
      - name: 📥 准备仓库
        shell: bash
        env:
          WORKFLOW: ${{ secrets.WORKFLOW }}
        run: |
          set -euo pipefail

          echo "========================================"
          echo "📦 准备仓库到 WORKSPACE_DIR"
          echo "========================================"

          REPO_NAME="${{ github.event.repository.name }}"
          mkdir -p "$WORKSPACE_DIR"
          REPO_DIR="$(mktemp -d "$WORKSPACE_DIR/${REPO_NAME}.XXXXXX")"
          export GIT_TERMINAL_PROMPT=0
          echo "GIT_TERMINAL_PROMPT=0" >> "$GITHUB_ENV"

          if [ -n "${WORKFLOW:-}" ]; then
            ASKPASS_SCRIPT="$(mktemp "$WORKSPACE_DIR/git-askpass.XXXXXX")"
            cat > "$ASKPASS_SCRIPT" <<'EOF'
          #!/usr/bin/env sh
          case "$1" in
            *Username*) printf '%s\n' oauth2 ;;
            *Password*) printf '%s\n' "$WORKFLOW" ;;
            *) printf '\n' ;;
          esac
          EOF
            chmod 700 "$ASKPASS_SCRIPT"
            export GIT_ASKPASS="$ASKPASS_SCRIPT"
            echo "GIT_ASKPASS=$ASKPASS_SCRIPT" >> "$GITHUB_ENV"
          fi

          REPO_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"

          git clone "$REPO_URL" "$REPO_DIR"

          git -C "$REPO_DIR" fetch origin main
          git -C "$REPO_DIR" checkout -B main origin/main

          git config --global --add safe.directory "$REPO_DIR"
          echo "REPO_DIR=$REPO_DIR" >> "$GITHUB_ENV"
          echo "✅ 仓库准备完成"

      - name: 📦 Build and publish tsl-playbook
        shell: bash
        env:
          WORKFLOW: ${{ secrets.WORKFLOW }}
        run: |
          set -euo pipefail

          REPO_DIR="${REPO_DIR:-$(pwd)}"
          TARGET_BRANCH="${TARGET_BRANCH:-tsl-playbook}"
          BUILD_SCRIPT="${BUILD_SCRIPT:-scripts/build_tsl_playbook.py}"
          COMMIT_AUTHOR_NAME="${COMMIT_AUTHOR_NAME:-ci[bot]}"
          COMMIT_AUTHOR_EMAIL="${COMMIT_AUTHOR_EMAIL:-ci-bot@local}"

          cd "$REPO_DIR"

          echo "========================================"
          echo "🔨 Build bundle and sync $TARGET_BRANCH"
          echo "========================================"

          git config user.name "$COMMIT_AUTHOR_NAME"
          git config user.email "$COMMIT_AUTHOR_EMAIL"

          source_sha="$(git rev-parse HEAD)"
          source_short="$(git rev-parse --short HEAD)"

          # Build the bundle outside the repo so branch checkout cannot clobber it.
          build_dir="$(mktemp -d)"
          cleanup() {
            rm -rf "$build_dir"
          }
          trap cleanup EXIT

          bundle="$build_dir/tsl-playbook"
          python3 "$BUILD_SCRIPT" --output "$bundle"

          # These are the only paths this workflow owns on the target branch.
          generated_paths=(AGENTS.md docs skills)
          for path in "${generated_paths[@]}"; do
            if [ ! -e "$bundle/$path" ]; then
              echo "ERROR: bundle is missing expected path: $path" >&2
              exit 1
            fi
          done

          if git show-ref --verify --quiet "refs/remotes/origin/$TARGET_BRANCH"; then
            git fetch origin "$TARGET_BRANCH"
            git checkout -B "$TARGET_BRANCH" "origin/$TARGET_BRANCH"
          else
            # A new orphan branch inherits main's index; clear it without deleting files.
            git checkout --orphan "$TARGET_BRANCH"
            git rm -rf --cached --quiet . >/dev/null 2>&1 || true
          fi

          rm -rf "${generated_paths[@]}"
          cp -R "$bundle"/. "$REPO_DIR"/

          git add -A "${generated_paths[@]}"

          if git diff --cached --quiet; then
            echo "No tsl-playbook changes to publish."
            exit 0
          fi

          git commit -m ":package: deps(tsl): sync tsl-playbook from ${source_short}

          Source-Commit: ${source_sha}"

          git push origin "$TARGET_BRANCH"
          echo "✅ Published tsl-playbook @ ${source_short}"

      - name: 🧹 清理临时仓库
        if: always()
        run: |
          if [ -n "${GIT_ASKPASS:-}" ]; then
            rm -f "$GIT_ASKPASS"
          fi
          rm -rf "$REPO_DIR"