# Mirrors main and each version tag to atproto://pdsjs.dev/pds.js, the
# dev.pdsjs.git.repo record that packages/git describes. Stock git reads it
# at https://pds.pdsjs.dev/git/pdsjs.dev/pds.js. One run pushes one ref, the
# one it runs on, so a tag push mirrors that tag alone. Nothing pushes the
# other way, and the mirror only fast-forwards to the commit run here.
#
# The push uses this repository's own helper, so the code being mirrored
# writes the mirror. PDSJS_SITE_TOKEN is an app password for pdsjs.dev,
# sealed to ci.knotless.dev for main and v* tags.
on:
  push: {refs: [refs/heads/main, refs/tags/v*]}
image: node:22-trixie
cache: [/root/.local/share/pnpm/store, /root/.cache/node/corepack]
runners: [ci.knotless.dev]
secrets: [PDSJS_SITE_TOKEN]
env:
  COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
  PDS_IDENTIFIER: pdsjs.dev
  MIRROR_REMOTE: atproto://pdsjs.dev/pds.js
steps:
  - name: check credentials
    run: |
      if [ -z "${PDSJS_SITE_TOKEN:-}" ]; then
        echo "PDSJS_SITE_TOKEN is not granted, so this push would mirror nothing."
        echo "Seal it to ci.knotless.dev with knotless secret. It is an app password for $PDS_IDENTIFIER."
        exit 1
      fi
  - name: install the helper
    run: |
      corepack enable
      pnpm --filter @pdsjs/git install --frozen-lockfile
      ln -sf "$PWD/packages/git/src/cli.js" /usr/local/bin/git-remote-atproto
  # A push that loses the record's compare-and-swap to another is told to
  # fetch and retry. Each attempt reads the record again.
  - name: push
    run: |
      git config --global --add safe.directory "$PWD"
      refspec="$KNOTLESS_RUN_SHA:$KNOTLESS_RUN_REF"
      for attempt in 1 2 3; do
        echo "push $refspec to $MIRROR_REMOTE (attempt $attempt)"
        if ATPROTO_GIT_PASSWORD="$PDSJS_SITE_TOKEN" git push "$MIRROR_REMOTE" "$refspec"; then
          exit 0
        fi
        sleep 5
      done
      exit 1