notify-downstreams.yml

name: Downstream Notifier

on:
  workflow_dispatch:
    inputs:
      release_tag:
        description: 'Release tag to notify downstream about'
        required: true
      dispatch_repo:
        description: 'Override owner/repo target; defaults to secrets.DOWNSTREAM_REPO'
        required: false

jobs:
  notify:
    name: Notify Downstream
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Dispatch downstream repository
        env:
          DISPATCH_REPO: ${{ github.event.inputs.dispatch_repo }}
          DOWNSTREAM_TOKEN: ${{ secrets.DOWNSTREAM_TOKEN }}
          FALLBACK_DISPATCH_REPO: ${{ secrets.DOWNSTREAM_REPO }}
          RELEASE_TAG: ${{ github.event.inputs.release_tag }}
        run: |
          set -euo pipefail
          if [ -z "${DOWNSTREAM_TOKEN:-}" ]; then
            echo 'DOWNSTREAM_TOKEN secret is not configured' >&2
            exit 1
          fi

          if [ -z "${RELEASE_TAG:-}" ]; then
            echo 'release_tag input is required' >&2
            exit 1
          fi

          if [ -n "${DISPATCH_REPO:-}" ]; then
            target_repo="${DISPATCH_REPO}"
          else
            target_repo="${FALLBACK_DISPATCH_REPO:-}"
          fi

          if [ -z "${target_repo}" ]; then
            echo 'dispatch repo not provided and DISPATCH_REPO secret is not configured' >&2
            exit 1
          fi

          payload=$(jq -n --arg version "${RELEASE_TAG}" \
            '{event_type:"webssh2-release", client_payload:{version:$version}}')

          response_file=$(mktemp)
          error_file=$(mktemp)
          http_code=''
          curl_status=0

          set +e
          http_code=$(curl \
            --silent \
            --show-error \
            --write-out '%{http_code}' \
            -X POST \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: Bearer ${DOWNSTREAM_TOKEN}" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            https://api.github.com/repos/${target_repo}/dispatches \
            -d "${payload}" \
            -o "${response_file}" 2>"${error_file}")
          curl_status=$?
          set -e

          response_body=$(cat "${response_file}")
          rm -f "${response_file}"

          if [ -s "${error_file}" ]; then
            echo "Dispatch stderr:"
            cat "${error_file}" >&2
          fi
          rm -f "${error_file}"

          if [ "${curl_status}" -ne 0 ]; then
            echo "Dispatch request failed with exit code ${curl_status}" >&2
            exit "${curl_status}"
          fi

          if [ -z "${http_code}" ]; then
            echo 'Dispatch request did not return an HTTP status code' >&2
            exit 1
          fi

          if [ "${http_code}" -ge 300 ]; then
            echo "Dispatch request returned HTTP ${http_code}" >&2
            if [ -n "${response_body}" ]; then
              echo "Response body: ${response_body}" >&2
            fi
            exit 1
          fi

          if [ -n "${response_body}" ]; then
            echo "Dispatch response: ${response_body}"
          fi

          echo "Dispatched webssh2-release for tag ${RELEASE_TAG} to ${target_repo}"