name: Publish Rules To External Repo

on:
  workflow_dispatch:
  schedule:
    - cron: "15 3 * * *"

permissions:
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest

    steps:
      - name: Validate required secrets
        shell: bash
        run: |
          missing=0
          for key in GITEA_BASE_URL GITEA_TOKEN SOURCE_OWNER SOURCE_REPO TARGET_OWNER TARGET_REPO; do
            if [ -z "${!key}" ]; then
              echo "Missing required secret: $key" >&2
              missing=1
            fi
          done
          if [ "$missing" -ne 0 ]; then
            exit 1
          fi
        env:
          GITEA_BASE_URL: ${{ secrets.GITEA_BASE_URL }}
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          SOURCE_OWNER: ${{ secrets.SOURCE_OWNER }}
          SOURCE_REPO: ${{ secrets.SOURCE_REPO }}
          TARGET_OWNER: ${{ secrets.TARGET_OWNER }}
          TARGET_REPO: ${{ secrets.TARGET_REPO }}

      - name: Checkout generator repo
        uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Build runtime config
        shell: bash
        run: |
          SOURCE_REF="${SOURCE_REF:-main}"
          SOURCE_ROOT="${SOURCE_ROOT:-rule/Surge}"
          CLASH_NO_RESOLVE="${CLASH_NO_RESOLVE:-false}"

          cat > config.runtime.json <<JSON
          {
            "gitea": {
              "base_url": "${GITEA_BASE_URL}",
              "owner": "${SOURCE_OWNER}",
              "repo": "${SOURCE_REPO}",
              "ref": "${SOURCE_REF}",
              "token_env": "GITEA_TOKEN"
            },
            "source": {
              "root": "${SOURCE_ROOT}",
              "filename_pattern": "{name}.list",
              "include_categories": [],
              "exclude_categories": []
            },
            "output": {
              "dir": "dist",
              "clash_no_resolve": ${CLASH_NO_RESOLVE}
            }
          }
          JSON
        env:
          GITEA_BASE_URL: ${{ secrets.GITEA_BASE_URL }}
          SOURCE_OWNER: ${{ secrets.SOURCE_OWNER }}
          SOURCE_REPO: ${{ secrets.SOURCE_REPO }}
          SOURCE_REF: ${{ vars.SOURCE_REF }}
          SOURCE_ROOT: ${{ vars.SOURCE_ROOT }}
          CLASH_NO_RESOLVE: ${{ vars.CLASH_NO_RESOLVE }}

      - name: Generate rules
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
        run: python3 main.py --config config.runtime.json

      - name: Publish dist to target repo branch
        shell: bash
        run: |
          set -euo pipefail

          target_branch="${TARGET_BRANCH:-main}"
          base="${GITEA_BASE_URL%/}"
          if [[ "$base" == https://* ]]; then
            auth_url="https://${GITEA_TOKEN}@${base#https://}"
          elif [[ "$base" == http://* ]]; then
            auth_url="http://${GITEA_TOKEN}@${base#http://}"
          else
            echo "GITEA_BASE_URL must start with http:// or https://" >&2
            exit 1
          fi
          remote_url="${auth_url}/${TARGET_OWNER}/${TARGET_REPO}.git"

          rm -rf /tmp/rules-publish
          git clone --depth=1 --branch "$target_branch" "$remote_url" /tmp/rules-publish || {
            git clone --depth=1 "$remote_url" /tmp/rules-publish
            cd /tmp/rules-publish
            git checkout -b "$target_branch"
            cd -
          }

          rsync -a --delete dist/ /tmp/rules-publish/

          cd /tmp/rules-publish
          if [ -n "$(git status --porcelain)" ]; then
            git config user.name "gitea-actions[bot]"
            git config user.email "gitea-actions@localhost"
            git add .
            git commit -m "chore: publish generated rules"
            git push origin "$target_branch"
            echo "Published to ${TARGET_OWNER}/${TARGET_REPO}@${target_branch}"
          else
            echo "No publish changes"
          fi
        env:
          GITEA_BASE_URL: ${{ secrets.GITEA_BASE_URL }}
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          TARGET_OWNER: ${{ secrets.TARGET_OWNER }}
          TARGET_REPO: ${{ secrets.TARGET_REPO }}
          TARGET_BRANCH: ${{ vars.TARGET_BRANCH }}