name: DealSage custom app pipeline
description: >-
  Runs the checks declared in .dealsage/app.json, builds the app with the
  DealSage connection baked in, uploads the bundle, and asks DealSage to
  release it under the app's publish policy. Platform-owned: app repos call
  this action from a one-step workflow, so pipeline changes ship here, not in
  every repo.
author: DealSage

inputs:
  publish-token:
    description: The app's PUBLISH_TOKEN repo secret (appId-scoped, minted by DealSage).
    required: true
  node-version:
    description: Node.js version for install, checks and build.
    required: false
    default: "20"
  install-command:
    description: Dependency install command run in the repo root.
    required: false
    default: npm install --no-audit --no-fund
  skip-publish:
    description: Run checks and build only; do not allocate or upload a version.
    required: false
    default: "false"

outputs:
  version:
    description: The version number allocated for this build (empty when skip-publish).
    value: ${{ steps.publish.outputs.version }}
  promoted:
    description: "true when DealSage promoted this version to live under the app's policy."
    value: ${{ steps.publish.outputs.promoted }}
  channel:
    description: The channel the version landed on (live, or branch/<name>).
    value: ${{ steps.publish.outputs.channel }}

# Environment the caller provides (from org variables/secrets, see the template
# workflow): DEALSAGE_FUNCTIONS_URL, SUPABASE_URL, SUPABASE_ANON_KEY, and either
# CUSTOM_APPS_WORKER_URL (upload through the Worker) or R2_ACCOUNT_ID,
# R2_BUCKET, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY (S3 upload).
runs:
  using: composite
  steps:
    - name: Tooling
      shell: bash
      run: bash "${{ github.action_path }}/scripts/ensure-tools.sh"

    - name: Read the app manifest
      shell: bash
      run: bash "${{ github.action_path }}/scripts/manifest.sh"

    - name: Set up Node.js
      uses: actions/setup-node@v4
      with:
        node-version: ${{ inputs.node-version }}

    - name: Install dependencies
      shell: bash
      run: ${{ inputs.install-command }}

    - name: Checks
      shell: bash
      env:
        PUBLISH_TOKEN: ${{ inputs.publish-token }}
      run: bash "${{ github.action_path }}/scripts/run-checks.sh"

    - name: Build
      shell: bash
      env:
        PUBLISH_TOKEN: ${{ inputs.publish-token }}
      run: bash "${{ github.action_path }}/scripts/build.sh"

    - name: Publish
      id: publish
      if: inputs.skip-publish != 'true'
      shell: bash
      env:
        PUBLISH_TOKEN: ${{ inputs.publish-token }}
      run: bash "${{ github.action_path }}/scripts/publish.sh"