name: Trigger sdk hotfix

# pull_request_target rather than push/pull_request: hotfix PRs (e.g. the automated
# release-notes updates) carry `[skip ci]` in their commit messages, which suppresses
# push- and pull_request-triggered workflows entirely — the label had no effect.
# GitHub's skip-ci markers do not apply to pull_request_target. The `closed` event
# replaces the old push-to-main trigger (which ran on every merge just to check
# labels), and `labeled` allows re-triggering a hotfix by re-adding the label to an
# already-merged PR. Secrets exposure is safe here: the job only runs for merged PRs
# carrying a maintainer-applied hotfix label, checkout uses the trusted base branch,
# and the only PR-derived code the script builds is the PR's already-merged commit
# from main.
on:
  pull_request_target:
    types: [closed, labeled]
    branches:
      - main

defaults:
  run:
    shell: bash

permissions:
  contents: read

jobs:
  trigger:
    name: Trigger an SDK hotfix
    runs-on: ubuntu-latest
    concurrency: npm-publish
    environment: npm deploy
    if: |
      github.event.pull_request.merged == true &&
      ((github.event.action == 'closed' &&
        (contains(github.event.pull_request.labels.*.name, 'sdk-hotfix-please') ||
         contains(github.event.pull_request.labels.*.name, 'docs-hotfix-please'))) ||
       (github.event.action == 'labeled' &&
        (github.event.label.name == 'sdk-hotfix-please' || github.event.label.name == 'docs-hotfix-please')))

    steps:
      - name: Generate a token
        id: generate_token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.HUPPY_APP_ID }}
          private-key: ${{ secrets.HUPPY_APP_PRIVATE_KEY }}

      - uses: actions/checkout@v6
        with:
          persist-credentials: false
          token: ${{ steps.generate_token.outputs.token }}
          fetch-depth: 0

      - name: Configure git credentials
        run: git config --global url."https://x-access-token:${{ steps.generate_token.outputs.token }}@github.com/".insteadOf "https://github.com/"

      - uses: ./.github/actions/setup

      - name: Maybe trigger sdk hotfix
        run: |
          set -e
          git config --global user.name 'huppy-bot[bot]'
          git config --global user.email '128400622+huppy-bot[bot]@users.noreply.github.com'
          git log --oneline -10
          yarn tsx internal/scripts/trigger-sdk-hotfix.ts
        env:
          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
          TLDRAW_BEMO_URL: https://demo.tldraw.xyz
          DISCORD_DEPLOY_WEBHOOK_URL: ${{ secrets.DISCORD_DEPLOY_WEBHOOK_URL }}
          PR_NUMBER: ${{ github.event.pull_request.number }}