# Publishes the lexicons as atproto resolves them, once main's checks
# pass at a commit that changes them, with the shared publish-lexicons
# step (chadtmiller.com/steps): the `_lexicon.<authority>` TXT records in
# the knotless.dev zone, naming lexicons.knotless.dev, and a
# com.atproto.lexicon.schema record there for each lexicon. What is new or
# changed is written, and what main no longer has is deleted, schemas and
# the records of authorities none uses now. Each run makes the whole set
# match main, so a run cut off by a newer one leaves nothing the next does
# not finish.
#
# lexicons.knotless.dev is an account of its own, on a pds.js worker
# (knotless-lexicons-pds), so that what CI holds writes lexicons and
# nothing else. LEX_PASSWORD is an app password of it, granted to pushes
# to main alone in the runner's secrets file. The DNS it reads as
# resolvers see it, and changes only with CLOUDFLARE_API_TOKEN, a token
# with Zone:DNS:Edit on knotless.dev that the host's address may use: it
# is needed only when an authority is added or dropped, and is not
# granted now, so such a run writes the schemas, then fails, saying which
# record to make.
#
# Asked for on any other branch, `knotless rerun <repo> --ref
# refs/heads/<branch> --workflow publish-lexicons`, it plans, and the wait
# for checks and the publish, which run at main alone, are skipped.
on:
  push: {refs: [refs/heads/main], paths: [lexicons/**, .knotless/workflows/publish-lexicons.yml]}
  asked: {refs: [refs/heads/*]}
image: node:24.22.1
secrets: [LEX_PASSWORD, CLOUDFLARE_API_TOKEN]
env:
  KNOTLESS_APPVIEW: https://knotless.dev
  # Cloudflare refuses a token limited to an address over IPv6.
  NODE_OPTIONS: --dns-result-order=ipv4first
steps:
  # What a write would change, with no secrets.
  - uses: chadtmiller.com/steps/publish-lexicons@1
    name: plan
    with: {did: "did:plc:yqsg7znbbhfmj3a2nrpnaerk", zone: knotless.dev}
  - uses: chadtmiller.com/steps/wait-for-checks@2
    name: checks pass
    on: {refs: [refs/heads/main]}
    with: {workflows: check test web lexicons shots docs e2e}
  - uses: chadtmiller.com/steps/publish-lexicons@1
    name: publish
    on: {refs: [refs/heads/main]}
    with: {did: "did:plc:yqsg7znbbhfmj3a2nrpnaerk", zone: knotless.dev, write: "true"}
    secrets: [LEX_PASSWORD, CLOUDFLARE_API_TOKEN]