# Publishes the repository browser to git.pdsjs.dev on every push to main,
# and repins the manifest that an install tracks. The deploy writes a
# record only when the build changes it, so a push that leaves the browser
# alone moves no CID.
on:
  push: {refs: [refs/heads/main]}
image: node:22-trixie
cache: [/root/.local/share/pnpm/store, /root/.cache/node/corepack]
runners: [ci.knotless.dev]
secrets: [PDSJS_SITE_TOKEN]
env:
  COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
  PDS_URL: https://pds.pdsjs.dev
  PDS_DID: did:plc:ye5hhvya5o2fwvouv3wttkkn
steps:
  - name: check credentials
    run: |
      if [ -z "${PDSJS_SITE_TOKEN:-}" ]; then
        echo "PDSJS_SITE_TOKEN is not granted, so this push would publish nothing."
        echo "Seal it to ci.knotless.dev with knotless secret. It is an app password for pdsjs.dev."
        exit 1
      fi
      echo "publishing to $PDS_URL as $PDS_DID"
  - name: build
    run: |
      corepack enable
      pnpm install --frozen-lockfile
      pnpm --filter @pdsjs/git-ui run build
  - name: publish
    run: PDS_APP_PASSWORD="$PDSJS_SITE_TOKEN" node packages/git-ui/scripts/deploy.mjs