name: Dagger module

# Keeps dagger/go.mod + go.sum consistent with the module's bindings.
#
# Why this exists: Renovate bumps the Dagger version strings (dagger.json
# engineVersion + the dagger.io/dagger SDK, grouped into one PR) but
# cannot regenerate the module's bindings. The generated code drives
# dagger/go.mod's transitive deps — a newer SDK relocates packages like
# `querybuilder` — so after a bump the committed go.mod is stale. Nothing
# in CI notices, because `dagger call` regenerates inside its own sandbox;
# only host `go` tooling (`task go:tidy`, `go build ./dagger`) breaks, on
# maintainers' machines, days later.
#
# So this job runs `dagger develop` for them: on a same-repo PR (which
# includes every renovate/** branch) it commits the result, so the PR
# lands complete with no human step. On a fork PR it can't push, so it
# reports the drift and fails.
#
# The push uses the repo's GitHub App token (same App as renovate.yaml),
# NOT the workflow's GITHUB_TOKEN — for the same reason renovate.yaml
# does: events caused by GITHUB_TOKEN don't trigger workflows, so a
# GITHUB_TOKEN push would leave the PR's new head SHA with no
# `pull_request` runs at all, and branch protection would hold the PR on
# "expected — waiting for status" until someone re-runs checks by hand.
# The App push retriggers CI like any human push. The companion setting
# is `gitIgnoredAuthors` in renovate.json5: without it, Renovate treats
# a branch carrying our bot commit as "modified by another author" and
# stops rebasing/updating it.

on:
  pull_request:
    paths:
      - "dagger.json"
      - "dagger/**"
  push:
    branches: [main]
    paths:
      - "dagger.json"
      - "dagger/**"
  # Lets a maintainer exercise this job on any branch without waiting for
  # a Dagger bump to touch the trigger paths.
  workflow_dispatch:

permissions:
  contents: read

env:
  DAGGER_NO_NAG: "1"
  DAGGER_CLOUD_TOKEN: ""
  DO_NOT_TRACK: "1"

jobs:
  sync:
    name: Sync generated deps
    runs-on: ubuntu-latest
    # No write permission on GITHUB_TOKEN: the push (when it happens)
    # rides on the App token minted below, precisely so it does NOT come
    # from GITHUB_TOKEN (see header). Inherits contents: read.
    steps:
      # Mint an App token for the push. Skipped on fork PRs twice over:
      # GitHub withholds the App secrets from fork-triggered runs anyway,
      # and the fork path below never pushes — it only reports drift.
      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        id: app-token
        if: ${{ !github.event.pull_request.head.repo.fork }}
        with:
          client-id: ${{ secrets.RENOVATE_APP_CLIENT_ID }}
          private-key: ${{ secrets.RENOVATE_APP_PRIVATE_KEY }}

      # Checkout the PR's head branch (not the merge commit) so a commit
      # can be pushed back onto it. Credentials are deliberately
      # persisted here — unlike every other job in this repo, this one
      # needs git write access. On forks the app-token step is skipped
      # and this falls back to the (read-only) GITHUB_TOKEN.
      #
      # `repository` must follow `ref`: on a fork PR, head.ref names a
      # branch that only exists in the fork, so checking it out against
      # the base repo would fail (or resolve a same-named base branch).
      # Safe under `pull_request` — the token is read-only and no secrets
      # are exposed, and the default checkout already contains the fork's
      # code via the merge commit. The fork path only ever reads: pushing
      # is gated on IS_FORK below.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          token: ${{ steps.app-token.outputs.token || github.token }}
          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
          ref: ${{ github.event.pull_request.head.ref || github.ref }}
          fetch-depth: 1

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod

      # Regenerates dagger.gen.go + internal/ (both gitignored) and
      # realigns dagger/go.mod with what they import.
      - uses: ./.github/actions/dagger
        with:
          verb: develop

      - run: go -C dagger mod tidy

      - name: Commit regenerated module deps if changed
        env:
          IS_FORK: ${{ github.event.pull_request.head.repo.fork || false }}
        run: |
          if git diff --quiet -- dagger/go.mod dagger/go.sum; then
            echo "dagger/go.mod already in sync."
            exit 0
          fi
          git --no-pager diff --stat -- dagger/go.mod dagger/go.sum
          if [ "$IS_FORK" = "true" ]; then
            echo "::error::dagger/go.mod is out of sync with the module bindings." \
                 "Run 'task dagger:develop' and commit the result." >&2
            exit 1
          fi
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add dagger/go.mod dagger/go.sum
          git commit -m "build(dagger): regenerate module deps"
          git push