name: Lint and reload

# Lint runs on PRs too - it's the status check branch protection
# requires before the development-commit automation's PRs may merge
# (merge_when_checks_succeed). The reload only ever fires on a push
# that actually landed on main.
on:
  push:
    branches: [main]
  pull_request:

jobs:
  lint:
    runs-on: bare
    steps:
      - uses: actions/checkout@v4

      # iris (uhhm/iris) is the lint: it reads content with the portal
      # release it is pinned to, so IRIS_RELEASE should match the portal
      # this site runs (PORTAL_RELEASE in deploy.yml).
      - name: Lint questions
        env:
          IRIS_RELEASE: v0.5.2
        run: |
          # The checkout is on a noexec mount for this runner; the cargo
          # target dir is where it may run what it fetched.
          bin="/var/local/cargo-target/iris-$IRIS_RELEASE"
          [ -x "$bin" ] || { curl -sfL "${{ github.server_url }}/uhhm/iris/releases/download/$IRIS_RELEASE/iris" -o "$bin" && chmod +x "$bin"; }
          "$bin" check --path questions

  reload:
    runs-on: bare
    needs: lint
    if: github.event_name == 'push'
    steps:
      # Tells every running portal instance to re-fetch and atomically
      # swap in the new content - see content::watch_for_reload in the
      # portal repo. Fire and forget: no reply expected, no payload
      # needed (the subject alone is the whole message).
      - name: Tell portal to reload content
        run: nats pub portal.content.reload '' --server "nats://infra:${{ secrets.NATS_TOKEN }}@127.0.0.1:4222"