name: Cache retention

on:
  workflow_run:
    workflows: ["CI"]
    types: [completed]

# Qualification calls ci.yml with actions: read. A nested workflow cannot raise
# that token, so cache deletion stays in this workflow.
permissions:
  contents: read
  actions: write

concurrency:
  group: cache-retention-${{ github.event.workflow_run.head_sha }}
  cancel-in-progress: false

jobs:
  retain:
    name: Retain Turbo snapshots and npm download caches
    # Restrict the triggering-source checkout to same-repository default-branch
    # CI events. The helper runs from this trusted workflow revision; triggering
    # source is used only for cache identity and is never executed. Static and
    # build save snapshots before later lanes finish, so failed, timed-out, or
    # cancelled runs still retain those snapshots.
    if: >-
      (github.event.workflow_run.conclusion == 'success' ||
      github.event.workflow_run.conclusion == 'failure' ||
      github.event.workflow_run.conclusion == 'timed_out' ||
      github.event.workflow_run.conclusion == 'cancelled') &&
      github.event.workflow_run.head_repository.full_name == github.repository &&
      github.event.workflow_run.head_branch == github.event.repository.default_branch &&
      (github.event.workflow_run.event == 'push' ||
      github.event.workflow_run.event == 'schedule' ||
      github.event.workflow_run.event == 'workflow_dispatch')
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          ref: ${{ github.workflow_sha }}
          path: trusted-retention
          persist-credentials: false
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          ref: ${{ github.event.workflow_run.head_sha }}
          path: triggering-source
          persist-credentials: false
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: trusted-retention/.nvmrc
      - name: Retain current Turbo snapshots and npm download caches
        env:
          GH_TOKEN: ${{ github.token }}
          CI_REPOSITORY: ${{ github.repository }}
          CACHE_PREFIX: rea-static-v1-${{ runner.os }}-${{ runner.arch }}-
          CACHE_KEEP_KEY: rea-static-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('triggering-source/.nvmrc', 'triggering-source/.npmrc', 'triggering-source/package-lock.json') }}-${{ github.event.workflow_run.head_sha }}
          CACHE_DEEP_PREFIX: rea-static-deep-v1-${{ runner.os }}-${{ runner.arch }}-
          CACHE_DEEP_KEEP_KEY: rea-static-deep-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('triggering-source/.nvmrc', 'triggering-source/.npmrc', 'triggering-source/package-lock.json') }}-${{ github.event.workflow_run.head_sha }}
          CACHE_KNIP_PREFIX: knip-meta-v1-${{ runner.os }}-
          CACHE_KNIP_KEEP_KEY: knip-meta-v1-${{ runner.os }}-${{ hashFiles('triggering-source/knip.json', 'triggering-source/tsconfig.json', 'triggering-source/package.json', 'triggering-source/package-lock.json') }}-${{ github.event.workflow_run.head_sha }}
          CACHE_PORTABLE_PREFIX: rea-portable-build-v2-${{ runner.os }}-${{ runner.arch }}-
          DEDUPE_NPM_DOWNLOADS: "true"
        run: node trusted-retention/scripts/ci/cache-retention.mjs