#!/usr/bin/env -S deno run --check --allow-write=. --allow-read=. --lock=./tools/deno.lock.json
// Copyright 2018-2026 the Deno authors. MIT license.
import { conditions, createWorkflow, step } from "jsr:@david/gagen@0.3.1";

const workflow = createWorkflow({
  name: "post_publish",
  on: {
    release: {
      types: ["published"],
    },
  },
  jobs: [{
    id: "update-dl-version",
    name: "update dl.deno.land version",
    runsOn: "ubuntu-latest",
    if: conditions.isRepository("denoland/deno"),
    steps: [
      step({
        name: "Clone repository",
        uses: "actions/checkout@v6",
      }),
      step({
        uses: "denoland/setup-deno@v2",
        with: { "deno-version": "v2.x" },
      }),
      step({
        name: "Authenticate with Google Cloud",
        uses: "google-github-actions/auth@v3",
        with: {
          project_id: "denoland",
          credentials_json: "${{ secrets.GCP_SA_KEY }}",
          export_environment_variables: true,
          create_credentials_file: true,
        },
      }),
      step({
        name: "Setup gcloud",
        uses: "google-github-actions/setup-gcloud@v3",
        with: { project_id: "denoland" },
      }),
      step({
        name: "Upload version file to dl.deno.land",
        env: {
          AWS_ACCESS_KEY_ID: "${{ vars.S3_ACCESS_KEY_ID }}",
          AWS_SECRET_ACCESS_KEY: "${{ secrets.S3_SECRET_ACCESS_KEY }}",
          AWS_ENDPOINT_URL_S3: "${{ vars.S3_ENDPOINT }}",
          AWS_DEFAULT_REGION: "${{vars.S3_REGION }}",
        },
        run: [
          "VERSION=${GITHUB_REF#refs/*/}",
          'deno run --allow-net --allow-write tools/release/update_versions_json.ts "$VERSION"',
          "aws s3 cp versions.json s3://dl-deno-land/versions.json --content-type application/json",
          'LATEST_FILE=$(deno run --allow-net --allow-write tools/release/upload_version_file.ts "$VERSION" || exit 0)',
          '[ -z "$LATEST_FILE" ] && exit 0',
          'aws s3 cp "$LATEST_FILE" "s3://dl-deno-land/$LATEST_FILE"',
          'echo "LATEST_FILE=$LATEST_FILE" >> "$GITHUB_ENV"',
        ],
      }),
      step({
        name: "Purge CDN cache",
        env: {
          CLOUDFLARE_ZONE_ID: "${{ vars.CLOUDFLARE_ZONE_ID }}",
          CLOUDFLARE_API_TOKEN: "${{ secrets.CLOUDFLARE_API_TOKEN }}",
        },
        run: [
          "# These live at a stable URL but change every release, so the edge",
          "# has to be told to drop them. Otherwise `deno upgrade` keeps",
          "# serving the previous version until the 4 hour TTL expires.",
          'deno run -A --lock=tools/deno.lock.json tools/release/purge_cdn_cache.ts versions.json ${LATEST_FILE:+"$LATEST_FILE"}',
        ],
      }),
    ],
  }],
});

const header = "# GENERATED BY ./post_publish.ts -- DO NOT DIRECTLY EDIT";

export function generate() {
  return workflow.toYamlString({ header });
}

export const POST_PUBLISH_YML_URL = new URL(
  "./post_publish.generated.yml",
  import.meta.url,
);

if (import.meta.main) {
  workflow.writeOrLint({ filePath: POST_PUBLISH_YML_URL, header });
}
