name: Update Schema

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

concurrency:
  # Serialize all runs so concurrent triggers (a main push plus a
  # workflow_dispatch, possibly from different refs) don't race on the shared,
  # reused chore/schema-update branch. The group is intentionally ref-independent.
  group: schema-update
  cancel-in-progress: false

jobs:
  generate-schema:
    name: Update configuration json schema
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: main
          token: ${{ secrets.GITHUB_TOKEN }}
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: .tool-versions
          cache: npm
      - run: npm ci
      - run: node --run website-generate-schema

      # The schema is regenerated only on main (after a merge) and delivered as a
      # PR. Pull requests intentionally do NOT run this workflow: committing the
      # schema back to a PR branch (the previous behavior) left the PR head on a
      # GITHUB_TOKEN-authored commit, which does not trigger CI and blocked merge.
      # Direct pushes to main are blocked by the branch ruleset, so the
      # regenerated schema is delivered as this PR instead.
      #
      # GITHUB_TOKEN is used (no PAT). A PR opened by GITHUB_TOKEN does not start
      # further workflow runs, so CI does not run on the schema PR -- but the main
      # ruleset requires no status checks (only review + code owner approval), so
      # the PR is still mergeable after approval. This requires the repository
      # setting "Allow GitHub Actions to create and approve pull requests" to be
      # enabled (Settings > Actions > General > Workflow permissions).
      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          base: main
          commit-message: 'chore(schema): Auto-generate schema'
          branch: chore/schema-update
          delete-branch: true
          title: 'chore(schema): Update configuration JSON schema'
          body: |
            Automated schema update generated by the Update Schema workflow.

            Direct pushes to `main` are blocked by the branch ruleset, so the
            regenerated schema is delivered as this PR instead.
          author: 'github-actions[bot] <github-actions[bot]@users.noreply.github.com>'