ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]
  # dispatched by auto-merge after a robot merge: GITHUB_TOKEN pushes do
  # not fire `push` events (recursion guard), but workflow_dispatch does.
  workflow_dispatch:

permissions:
  contents: read

env:
  # logins that skip the strict per-PR profile rules (maintainers with
  # maintain/admin permission are skipped automatically, too)
  PROFILE_BYPASS: hnrobert

jobs:
  check-profiles:
    name: Check profiles/
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Collect the PR's changed files
        if: github.event_name == 'pull_request'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh api "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" \
            --paginate --jq '.[] | [.status, .filename] | @tsv' > pr-files.tsv
          cat pr-files.tsv

      # Strict rules (exactly one file, named after the PR author) apply
      # only to PRs from docs/* (first-time add) or fix/* (update your
      # own profile) branches, never to bypassed logins or maintain/admin
      # collaborators.
      - name: Decide whether the strict profile rules apply
        id: scope
        if: github.event_name == 'pull_request'
        env:
          GH_TOKEN: ${{ github.token }}
          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
        run: |
          branch="${{ github.event.pull_request.head.ref }}"
          bypass=no
          for user in $PROFILE_BYPASS; do
            [ "$user" = "$PR_AUTHOR" ] && bypass=yes
          done
          if [ "$bypass" = no ]; then
            perm=$(gh api "repos/${{ github.repository }}/collaborators/$PR_AUTHOR/permission" \
              --jq .permission 2>/dev/null || echo none)
            case "$perm" in maintain|admin) bypass=yes ;; esac
          fi
          strict=no; mode=""
          if [ "$bypass" = no ]; then
            case "$branch" in
              docs/*) strict=yes; mode=added ;;
              fix/*)  strict=yes; mode=modified ;;
            esac
          fi
          echo "strict=$strict" >> "$GITHUB_OUTPUT"
          echo "mode=$mode" >> "$GITHUB_OUTPUT"
          echo "branch=$branch author=$PR_AUTHOR bypass=$bypass strict=$strict mode=$mode"

      - name: Run the profiles check
        env:
          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
        run: |
          if [ "${{ steps.scope.outputs.strict }}" = yes ] && [ -f pr-files.tsv ]; then
            python scripts/check_profiles.py \
              --author "${PR_AUTHOR}" \
              --pr-files pr-files.tsv \
              --expect "${{ steps.scope.outputs.mode }}"
          else
            python scripts/check_profiles.py
          fi

  publish-site:
    name: Build and deploy the roster site
    needs: check-profiles
    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    permissions:
      pages: write
      id-token: write
      actions: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Generate the roster page
        run: python scripts/build_site.py

      # Re-runs keep artifacts from earlier attempts, and deploy-pages
      # refuses when it finds more than one "github-pages" artifact in a
      # run — so drop any leftovers before uploading a fresh one.
      - name: Drop stale github-pages artifacts from this run
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \
            --jq '.artifacts[] | select(.name == "github-pages") | .id' \
          | while read -r id; do
              echo "deleting stale artifact $id"
              gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$id"
            done || true

      # Deploy https://comppsyunion.github.io/github-playground/ straight
      # from the workflow (Pages source: GitHub Actions). The freshly
      # built docs/ directory is uploaded as the artifact — nothing is
      # ever committed back to the repository.
      - uses: actions/configure-pages@v6
      - uses: actions/upload-pages-artifact@v5
        with:
          path: docs
      - id: deployment
        uses: actions/deploy-pages@v5