name: Update packages

on:
  schedule:
    # Mondays 06:17 UTC — off-peak, slightly jittered
    - cron: "17 6 * * 1"
  workflow_dispatch:
    inputs:
      packages:
        description: "Space-separated package names (empty = all)"
        required: false
        default: ""

permissions:
  contents: write
  pull-requests: write

concurrency:
  group: update-packages
  cancel-in-progress: false

jobs:
  update:
    name: Bump package versions
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@v16

      - name: Magic Nix Cache
        uses: DeterminateSystems/magic-nix-cache-action@v9

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Update packages from upstream
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          chmod +x scripts/update-packages.sh
          if [ -n "${{ inputs.packages }}" ]; then
            # workflow_dispatch with explicit package list
            # shellcheck disable=SC2086
            ./scripts/update-packages.sh ${{ inputs.packages }}
          else
            ./scripts/update-packages.sh
          fi

      - name: Create pull request
        uses: peter-evans/create-pull-request@v7
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          commit-message: |
            chore(packages): weekly upstream version bumps

            Automated update from scripts/update-packages.sh
          title: "chore(packages): weekly upstream version bumps"
          body: |
            ## Weekly package update

            This PR was opened by the [Update packages](../actions/workflows/update-packages.yml) workflow.

            It re-checks each `packages/*/upstream.json` source (GitHub tags, etc.),
            refreshes source hashes / lockfiles / `npmDepsHash`, and verifies
            `nix build` for each bumped package.

            ### Review checklist
            - [ ] Diff looks intentional (version + hashes + lockfile only)
            - [ ] `nix build .#<pkg>` works locally if you want a second check
            - [ ] Merge when ready — no human edits required unless a package needs a packaging fix
          base: main
          branch: chore/update-packages
          delete-branch: true
          add-paths: |
            packages/**