# Publishes grain's lexicons as atproto resolves them, once main's test
# and check pass at a commit that changes them, with the publish-lexicons
# shared step: a com.atproto.lexicon.schema record in grain.social's repo
# for each lexicon whose authority is in the grain.social zone, and the
# `_lexicon.<authority>` TXT records naming that account. The rest of
# lexicons/ (app.bsky, dev.hatk, ...) are copies of other publishers' and
# are left to them. What is new or changed is written, and what main no
# longer has is deleted. Each run makes the whole set match main, so a run
# cut off by a newer one leaves nothing the next does not finish.
#
# A PDS that validates records reads these schemas, not lexicons/, so a
# stale one here rejects writes the appview accepts.
#
# It runs on ci.knotless.dev alone, like deploy. LEX_PASSWORD is an app
# password of grain.social, sealed to pushes to main (`knotless secret
# knotless://grain.social/grain set LEX_PASSWORD --runner ci.knotless.dev
# --ref refs/heads/main`). CLOUDFLARE_API_TOKEN, with Zone:DNS:Edit on
# grain.social, is needed only when an authority is added or dropped;
# without it the schemas are still written and the run fails, naming the
# records to make.
#
# Asked for on any other branch, `knotless rerun
# knotless://grain.social/grain --ref refs/heads/<branch> --workflow
# publish-lexicons`, it says what it would change and changes nothing:
# the wait and the publish run only at main.
on:
  push:
    refs: [refs/heads/main]
    paths: [lexicons/social/**, .knotless/workflows/publish-lexicons.yml, .knotless/uses.lock]
  asked: { refs: [refs/heads/*] }
image: node:24.22.1
runners: [ci.knotless.dev]
secrets: [LEX_PASSWORD, CLOUDFLARE_API_TOKEN]
env:
  # Cloudflare refuses a token limited to an address over IPv6.
  NODE_OPTIONS: --dns-result-order=ipv4first
steps:
  - name: plan
    uses: chadtmiller.com/steps/publish-lexicons@1
    with: { did: "did:plc:e7rftrdyz5e2rw4y6ocszew2", zone: grain.social }
  - name: checks
    uses: chadtmiller.com/steps/wait-for-checks@2
    on: { refs: [refs/heads/main] }
    with: { workflows: test check }
  - name: publish
    uses: chadtmiller.com/steps/publish-lexicons@1
    on: { refs: [refs/heads/main] }
    with: { did: "did:plc:e7rftrdyz5e2rw4y6ocszew2", zone: grain.social, write: "true" }
    secrets: [LEX_PASSWORD, CLOUDFLARE_API_TOKEN]