name: Trigger dotcom hotfix

# pull_request_target rather than push/pull_request, for the same reason as
# trigger-sdk-hotfix.yml: release-notes PRs squash-merge with `[skip ci]` in the title, which
# suppresses the push-to-main run entirely, and the `labeled` event fires before the merge so the
# `merged == true` gate rejects it. Neither path ever reached the script. GitHub's skip-ci markers
# do not apply to pull_request_target. `closed` replaces the old push trigger (which ran on every
# merge to main just to check labels), and `labeled` allows re-triggering by re-adding the label to
# an already-merged PR. Secrets exposure is safe here: the job only runs for merged PRs carrying a
# maintainer-applied hotfix label, checkout uses the trusted base branch, and the only PR-derived
# code the script builds is the PR's already-merged commit from main.
on:
  pull_request_target:
    types: [closed, labeled]
    branches:
      - main

defaults:
  run:
    shell: bash

permissions:
  contents: write
  pull-requests: write

jobs:
  trigger:
    name: Trigger a dotcom hotfix
    runs-on: ubuntu-latest
    timeout-minutes: 20
    concurrency: dotcom-hotfix
    environment: npm deploy
    if: |
      github.event.pull_request.merged == true &&
      ((github.event.action == 'closed' &&
        contains(github.event.pull_request.labels.*.name, 'dotcom-hotfix-please')) ||
       (github.event.action == 'labeled' &&
        github.event.label.name == 'dotcom-hotfix-please'))

    steps:
      - name: Generate a token
        id: generate_token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.HUPPY_APP_ID }}
          private-key: ${{ secrets.HUPPY_APP_PRIVATE_KEY }}

      - uses: actions/checkout@v6
        with:
          persist-credentials: false
          token: ${{ steps.generate_token.outputs.token }}
          fetch-depth: 0

      - name: Configure git credentials
        run: git config --global url."https://x-access-token:${{ steps.generate_token.outputs.token }}@github.com/".insteadOf "https://github.com/"

      - uses: ./.github/actions/setup

      - name: Maybe trigger dotcom hotfix
        run: |
          set -e
          git config --global user.name 'huppy-bot[bot]'
          git config --global user.email '128400622+huppy-bot[bot]@users.noreply.github.com'
          git log --oneline -10
          yarn tsx internal/scripts/trigger-dotcom-hotfix.ts
        env:
          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
          DISCORD_DEPLOY_WEBHOOK_URL: ${{ secrets.DISCORD_DEPLOY_WEBHOOK_URL }}
          PR_NUMBER: ${{ github.event.pull_request.number }}