name: Sync Flathub

# Keeps flatpak/flathub (a submodule tracking flathub/io.github.bendik.Zodia)
# in step with every tagged release. cargo-release has no post-release-hook
# mechanism (only pre-release-hook — confirmed against its own docs), so
# scripts/flatpak-sync.sh was never actually invoked anywhere before this
# workflow existed; Flathub silently sat 5 releases stale as a result.
#
# Auth: FLATHUB_PAT, a classic PAT (repo scope) on the maintainer's own
# account — NOT a deploy key. Flathub's app repos require updates via PR
# (branch protection on master), and adding a deploy key requires *admin*
# on the repo; a maintainer who's only a push-access collaborator (the
# normal case — confirmed via `gh api repos/flathub/... --jq .permissions`
# returning admin:false, push:true) can't create one. A fine-grained PAT
# hits the same wall (repos outside your own account need the resource-
# owning org to pre-approve fine-grained token access, which Flathub
# hasn't opted into). A classic `repo`-scoped PAT has neither restriction:
# it simply inherits whatever access the account already has.

on:
  push:
    tags:
      - 'v[0-9]*'

permissions:
  contents: write

jobs:
  flathub-sync:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: false
          fetch-depth: 0

      - name: Configure git identity
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      # .gitmodules points at the SSH URL (git@github.com:...) so local/
      # manual syncs "just work" off the maintainer's own SSH key. CI has
      # no SSH key at all, so `git submodule update --init` itself fails
      # ("Permission denied (publickey)") if run against that URL — this
      # has to happen *before* init, not after: the initial clone needs
      # an unauthenticated-but-working transport (HTTPS works anonymously
      # for a public repo's read access), then the PAT gets layered on
      # top afterward for the push step.
      # NOTE: the rewrite must target .gitmodules itself (config -f), not
      # .git/config — `git submodule sync` copies URLs FROM .gitmodules
      # INTO .git/config, so writing .git/config first and then syncing
      # (what this step did on the v0.13.0 run) just restores the SSH URL
      # and fails identically.
      - name: Use HTTPS for submodule clone (CI has no SSH key)
        run: |
          git config -f .gitmodules submodule.flatpak/flathub.url \
            https://github.com/flathub/io.github.bendik.Zodia.git
          git submodule sync flatpak/flathub

      - name: Init flathub submodule
        run: git submodule update --init flatpak/flathub

      - name: Point flathub submodule remote at HTTPS + PAT
        run: |
          git -C flatpak/flathub remote set-url origin \
            "https://x-access-token:${FLATHUB_PAT}@github.com/flathub/io.github.bendik.Zodia.git"
        env:
          FLATHUB_PAT: ${{ secrets.FLATHUB_PAT }}

      - uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Install cargo-sources generator deps
        run: pip install aiohttp tomlkit

      - name: Sync Flathub submodule
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          bash scripts/flatpak-sync.sh "$VERSION"

      # flatpak-sync.sh only pushes the branch — Flathub requires an actual
      # PR (protected master, auto test-build on open). `|| true`: a re-run
      # of the same tag would otherwise fail here with "already exists",
      # which isn't a real failure.
      - name: Open Flathub PR
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          gh pr create --repo flathub/io.github.bendik.Zodia \
            --base master --head "update/v${VERSION}" \
            --title "bump to v${VERSION}" \
            --body "Updates Zodia to v${VERSION}. See release notes: https://github.com/bendik/zodia/releases/tag/v${VERSION}" \
            || true
        env:
          GH_TOKEN: ${{ secrets.FLATHUB_PAT }}
