name: Build pinned Cloud PWA

on:
  workflow_dispatch:
    inputs:
      nekonest_commit:
        description: Immutable 40-character NekoNest commit SHA
        required: true
        type: string
      connect_origin:
        description: Stable HTTPS Connect origin
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: cloud-pwa-${{ inputs.nekonest_commit }}
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Validate immutable inputs
        shell: pwsh
        env:
          NEKONEST_COMMIT: ${{ inputs.nekonest_commit }}
          CONNECT_ORIGIN: ${{ inputs.connect_origin }}
        run: |
          if ($env:NEKONEST_COMMIT -notmatch '^[0-9a-f]{40}$') {
            throw 'nekonest_commit must be a full immutable SHA'
          }
          $origin = [Uri]$env:CONNECT_ORIGIN
          if ($origin.Scheme -ne 'https' -or $origin.AbsoluteUri.TrimEnd('/') -ne $env:CONNECT_ORIGIN.TrimEnd('/')) {
            throw 'connect_origin must be an exact HTTPS origin'
          }
          if ($origin.UserInfo -or $origin.PathAndQuery -ne '/' -or $origin.Fragment) {
            throw 'connect_origin must not contain credentials, path, query, or fragment'
          }

      - name: Check out exact NekoNest source
        uses: actions/checkout@v7
        with:
          repository: klarkxy/nekonest
          ref: ${{ inputs.nekonest_commit }}
          fetch-depth: 0
          path: nekonest

      - name: Verify checked-out source did not move
        shell: pwsh
        working-directory: nekonest
        env:
          EXPECTED_SHA: ${{ inputs.nekonest_commit }}
        run: |
          $actual = (git rev-parse HEAD).Trim()
          if ($actual -ne $env:EXPECTED_SHA) { throw "expected $env:EXPECTED_SHA, got $actual" }

      - name: Set up pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 10.29.2

      - name: Set up Node
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          cache: pnpm
          cache-dependency-path: nekonest/pwa/pnpm-lock.yaml

      - name: Install, test, and build managed PWA
        working-directory: nekonest/pwa
        env:
          VITE_NEKONEST_MANAGED: 'true'
        run: |
          pnpm install --frozen-lockfile
          pnpm test
          pnpm type-check
          pnpm build

      - name: Write deploy-time stable endpoint config
        shell: pwsh
        env:
          CONNECT_ORIGIN: ${{ inputs.connect_origin }}
        run: |
          $config = [ordered]@{
            api_base = $env:CONNECT_ORIGIN.TrimEnd('/')
            ws_base = $env:CONNECT_ORIGIN.TrimEnd('/').Replace('https://', 'wss://')
            attachment_base = $env:CONNECT_ORIGIN.TrimEnd('/')
            push_base = $env:CONNECT_ORIGIN.TrimEnd('/')
            managed = $true
            handoff_exchange_path = '/api/pwa/handoff/exchange'
          }
          $config | ConvertTo-Json -Compress | Set-Content -Encoding utf8NoBOM nekonest/pwa/dist/runtime-config.json

      - name: Record source provenance
        shell: pwsh
        env:
          SOURCE_SHA: ${{ inputs.nekonest_commit }}
        run: |
          [ordered]@{
            repository = 'https://github.com/klarkxy/nekonest'
            commit = $env:SOURCE_SHA
            built_at = (Get-Date).ToUniversalTime().ToString('o')
          } | ConvertTo-Json -Compress | Set-Content -Encoding utf8NoBOM nekonest/pwa/dist/source-provenance.json

      - name: Upload exact-build artifact
        uses: actions/upload-artifact@v7
        with:
          name: nekonest-cloud-pwa-${{ inputs.nekonest_commit }}
          path: nekonest/pwa/dist
          if-no-files-found: error
          retention-days: 7