name: Publish OpenClaw Skills

on:
  push:
    branches: [main]
    paths:
      - "skills/**"
      - ".github/workflows/publish-skills.yml"
  pull_request:
    branches: [main]
    paths:
      - "skills/**"
      - ".github/workflows/publish-skills.yml"
  schedule:
    - cron: "0 * * * *" # Hourly, to drip-publish past rate limits
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

jobs:
  publish:
    # Skip fork PRs — secrets (CLAWHUB_TOKEN) are not available
    if: github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: "20"

      - name: Install ClawHub CLI
        run: npm i -g clawhub@0.7.0

      - name: Authenticate ClawHub
        env:
          CLAWHUB_TOKEN: ${{ secrets.CLAWHUB_TOKEN }}
        run: |
          if [ -z "$CLAWHUB_TOKEN" ]; then
            echo "::error::CLAWHUB_TOKEN secret is not set"
            exit 1
          fi
          clawhub login --token "$CLAWHUB_TOKEN"

      - name: Publish skills
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            clawhub sync --root skills --all --dry-run
          else
            clawhub sync --root skills --all
          fi