name: Notify website of public desktop release

on:
  release:
    types: [published]

# Use only the separately scoped website token; no app token or checkout is needed.
permissions: {}

jobs:
  notify-website:
    if: >-
      github.repository == 'amosblomqvist/learnharness' &&
      !github.event.release.draft && !github.event.release.prerelease
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Queue the website update for the published tag
        env:
          WEBSITE_DISPATCH_TOKEN: ${{ secrets.WEBSITE_DISPATCH_TOKEN }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "$WEBSITE_DISPATCH_TOKEN" ]]; then
            echo '::error::Missing WEBSITE_DISPATCH_TOKEN.'
            exit 1
          fi
          if [[ -z "$RELEASE_TAG" ]]; then
            echo '::error::The published release has no tag.'
            exit 1
          fi
          payload=$(jq -cn --arg tag "$RELEASE_TAG" \
            '{event_type:"desktop-release-published",client_payload:{tag:$tag}}')
          status=$(curl --fail-with-body --silent --show-error \
            --connect-timeout 15 --max-time 60 \
            --request POST \
            --header 'Accept: application/vnd.github+json' \
            --header "Authorization: Bearer $WEBSITE_DISPATCH_TOKEN" \
            --header 'X-GitHub-Api-Version: 2022-11-28' \
            --header 'Content-Type: application/json' \
            --data "$payload" \
            --output /dev/null --write-out '%{http_code}' \
            https://api.github.com/repos/amosblomqvist/learnharness-web/dispatches)
          if [[ "$status" != '204' ]]; then
            printf '::error::Expected dispatch HTTP 204, received %s.\n' "$status"
            exit 1
          fi
          echo 'Website update queued. This does not confirm website deployment.'