name: Docs Sync Publish Repo

on:
  push:
    branches:
      - main
    paths:
      - docs/**
      - scripts/docs-sync-publish.mjs
      - .github/workflows/docs-sync-publish.yml
  workflow_dispatch:

permissions:
  contents: read

jobs:
  sync-publish-repo:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout source repo
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version: "22.18.0"

      - name: Clone publish repo
        env:
          OPENCLAW_DOCS_SYNC_TOKEN: ${{ secrets.OPENCLAW_DOCS_SYNC_TOKEN }}
        run: |
          set -euo pipefail
          for attempt in 1 2 3 4 5; do
            rm -rf publish
            if git clone \
              "https://x-access-token:${OPENCLAW_DOCS_SYNC_TOKEN}@github.com/openclaw/docs.git" \
              publish; then
              exit 0
            fi
            echo "Clone attempt ${attempt} failed; retrying."
            sleep $((attempt * 2))
          done

          echo "Failed to clone publish repo after retries." >&2
          exit 1

      - name: Sync docs into publish repo
        run: |
          node scripts/docs-sync-publish.mjs \
            --target "$GITHUB_WORKSPACE/publish" \
            --source-repo "$GITHUB_REPOSITORY" \
            --source-sha "$GITHUB_SHA"

      - name: Install docs MDX checker dependency
        run: npm install --no-save --package-lock=false @mdx-js/mdx@3.1.1

      - name: Check publish docs MDX
        run: node "$GITHUB_WORKSPACE/publish/.openclaw-sync/check-docs-mdx.mjs" "$GITHUB_WORKSPACE/publish/docs"

      - name: Commit publish repo sync
        working-directory: publish
        run: |
          set -euo pipefail
          remote_source_sha() {
            git show refs/remotes/origin/main:.openclaw-sync/source.json 2>/dev/null \
              | node -e 'const fs = require("node:fs"); try { const data = JSON.parse(fs.readFileSync(0, "utf8")); if (data.sha) process.stdout.write(data.sha); } catch {}' \
              || true
          }

          skip_stale_source() {
            current_source_sha="$(remote_source_sha)"
            if [ -z "$current_source_sha" ] || [ "$current_source_sha" = "$GITHUB_SHA" ]; then
              return
            fi

            if git -C "$GITHUB_WORKSPACE" merge-base --is-ancestor "$GITHUB_SHA" "$current_source_sha"; then
              echo "Skipping stale publish sync for $GITHUB_SHA; origin/main already mirrors $current_source_sha."
              exit 0
            fi
          }

          if git diff --quiet -- docs .openclaw-sync; then
            echo "No publish-repo changes."
            exit 0
          fi

          if git fetch origin main:refs/remotes/origin/main; then
            skip_stale_source
          fi

          git config user.name "openclaw-docs-sync[bot]"
          git config user.email "openclaw-docs-sync[bot]@users.noreply.github.com"
          git add docs .openclaw-sync
          git commit -m "chore(sync): mirror docs from $GITHUB_REPOSITORY@$GITHUB_SHA"
          for attempt in 1 2 3 4 5; do
            if git fetch origin main:refs/remotes/origin/main; then
              skip_stale_source
              if git rebase -X theirs origin/main && git push origin HEAD:main; then
                exit 0
              fi
            fi
            git rebase --abort >/dev/null 2>&1 || true
            echo "Publish sync attempt ${attempt} failed; retrying."
            sleep $((attempt * 2))
          done

          echo "Failed to push publish-repo sync after retries."
          exit 1