shiaho777--web-to-app/.github/workflows/modules-publish.yml

name: Module Market Publish

# Regenerates `modules/submissions.json` after a PR is merged into main.
#
# This file is what tells the in-app market who submitted each module
# and when. Modules without a corresponding entry are deliberately
# hidden from the catalog — that's how the "only show merged PRs"
# guarantee is enforced. We regenerate from scratch on every relevant
# push so a missing entry can never silently outlive a revert.
#
# main is branch-protected (requires a PR + the "check" status), and the
# default GITHUB_TOKEN can't push to it directly. So instead of pushing,
# this workflow commits the regenerated file to a fixed working branch
# and opens (or updates) a PR, then queues an auto-merge so the catalog
# stays in sync without any manual step.

on:
  push:
    branches:
      - main
    paths:
      - 'modules/**'
      - '.github/scripts/ci/generate_submissions.py'
      - '.github/workflows/modules-publish.yml'
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

concurrency:
  group: modules-publish
  cancel-in-progress: false

jobs:
  publish:
    name: Generate submissions.json
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Check out repository
        uses: actions/checkout@v6
        with:
          # We need the full history so `git log --diff-filter=A` can find
          # the introducing commit for each module folder.
          fetch-depth: 0
          persist-credentials: true

      - name: Use system Python 3
        run: python3 --version

      - name: Generate submissions.json
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Comma-separated list of GitHub logins that may seed modules
          # via a direct push (no PR). Anything else without a merged PR
          # stays hidden from the catalog.
          MAINTAINERS: shiaho777
        run: |
          python3 .github/scripts/ci/generate_submissions.py \
            --owner "${GITHUB_REPOSITORY%%/*}" \
            --repo "${GITHUB_REPOSITORY##*/}" \
            --token "$GITHUB_TOKEN"

      - name: Open PR for regenerated submissions.json
        env:
          # Prefer a PAT (secret PAT_TOKEN) when available: a GITHUB_TOKEN-
          # pushed branch can't trigger other workflows (GitHub anti-loop), so
          # the required "check" never reports on the resulting PR and it can't
          # merge. A PAT-pushed branch triggers android-ci normally. Fall back to
          # GITHUB_TOKEN so the workflow still runs without a PAT configured.
          GH_TOKEN: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}
          GIT_AUTH_USER: x-access-token
          GIT_AUTH_PWD: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}
          BRANCH: ci/regenerate-submissions
        run: |
          if git diff --quiet -- modules/submissions.json; then
            echo "No changes to submissions.json"
            exit 0
          fi

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          # The main branch is protected (requires a PR + the "check" status),
          # and the default GITHUB_TOKEN can't push there directly. Push the
          # regenerated file to a long-lived working branch and let a PR land it.
          git checkout -B "$BRANCH"
          git add modules/submissions.json
          git commit -m "chore(modules): regenerate submissions.json"

          REPO="github.com/${GITHUB_REPOSITORY}"
          if [ -n "${{ secrets.PAT_TOKEN }}" ]; then
            git push --force-with-lease "https://${GIT_AUTH_USER}:${GIT_AUTH_PWD}@${REPO}" "$BRANCH"
          else
            git push --force-with-lease origin "$BRANCH"
          fi

          # Reuse an existing open PR if one is already tracking this branch.
          PR_NUMBER=$(gh pr list --head "$BRANCH" --base main --state open \
                        --json number --jq '.[0].number // empty')

          TITLE="chore(modules): regenerate submissions.json"
          BODY="Auto-generated by the \`Module Market Publish\` workflow on push to \`main\`. No manual changes — this only updates \`modules/submissions.json\` so the in-app market catalog stays in sync."

          if [ -z "$PR_NUMBER" ]; then
            PR_NUMBER=$(gh pr create --head "$BRANCH" --base main \
                          --title "$TITLE" --body "$BODY")
          else
            gh pr edit "$PR_NUMBER" --title "$TITLE" --body "$BODY"
          fi

          # When using a PAT, the branch push already triggered android-ci, so
          # wait for its "check" to report then enable auto-merge (GitHub merges
          # automatically once all required checks pass). With GITHUB_TOKEN there
          # is no check to wait on, so the PR is left for a manual merge.
          if [ -n "${{ secrets.PAT_TOKEN }}" ]; then
            gh pr merge "$PR_NUMBER" --squash --auto --delete-branch \
              || echo "::warning::Auto-merge setup failed; PR #$PR_NUMBER left open for manual merge."
          else
            echo "No PAT_TOKEN configured; PR #$PR_NUMBER left open for manual merge (GITHUB_TOKEN can't satisfy the required check)."
          fi