name: Notify HeyPuter (dev)

on:
  workflow_dispatch:
    inputs:
      puter_ref:
        description: "puter branch, tag or SHA"
        type: string
        default: "main"

permissions:
  contents: read

jobs:
  authorize:
    if: github.repository == 'HeyPuter/puter'
    runs-on: ubuntu-latest
    steps:
      - name: Require maintain or admin
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ACTOR: ${{ github.triggering_actor }}
        run: |
          ROLE=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$ACTOR/permission" --jq .role_name)
          if [ "$ROLE" != "maintain" ] && [ "$ROLE" != "admin" ]; then
            echo "::error::$ACTOR has role '$ROLE'; maintain or admin required"
            exit 1
          fi

  notify:
    needs: authorize
    runs-on: ubuntu-latest
    # Holds HEYPUTER_DISPATCH_TOKEN; limited to main so branch copies of this file can't read it.
    environment: heyputer-dispatch
    steps:
      - name: Trigger heyputer dev deploy
        env:
          PUTER_REF: ${{ inputs.puter_ref }}
          TOKEN: ${{ secrets.HEYPUTER_DISPATCH_TOKEN }}
        run: |
          jq -nc --arg ref "$PUTER_REF" \
            '{event_type: "puter-dev-requested", client_payload: {puter_ref: $ref}}' |
          curl -fsS -X POST \
            -H "Authorization: token $TOKEN" \
            -H "Accept: application/vnd.github.v3+json" \
            https://api.github.com/repos/HeyPuter/heyputer/dispatches \
            -d @-
          echo "Requested \`$PUTER_REF\`" >> "$GITHUB_STEP_SUMMARY"