update-submodule.yml

name: Update Submodule

on:
  workflow_run:
    workflows: ["Detect Labels"]
    types: [completed]

env:
  GH_TOKEN: ${{ github.token }}

permissions:
  pull-requests: write
  contents: write

jobs:
  read-label-data:
    if: github.event.workflow_run.conclusion == 'success'
    runs-on: ubuntu-latest
    steps:
      - name: "Download artifact"
        uses: actions/github-script@v8
        with:
          script: |
            let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
              owner: context.repo.owner,
              repo: context.repo.repo,
              run_id: context.payload.workflow_run.id,
            });
            let matchArtifact = allArtifacts.data.artifacts.filter((artifact) => {
              return artifact.name == "pr-data"
            })[0];
            let download = await github.rest.actions.downloadArtifact({
              owner: context.repo.owner,
              repo: context.repo.repo,
              artifact_id: matchArtifact.id,
              archive_format: 'zip',
            });
            const fs = require('fs');
            const path = require('path');
            const temp = '${{ runner.temp }}/artifacts';
            if (!fs.existsSync(temp)){
              fs.mkdirSync(temp);
            }
            fs.writeFileSync(path.join(temp, 'pr-data.zip'), Buffer.from(download.data));

      - name: "Unzip artifact"
        run: unzip "${{ runner.temp }}/artifacts/pr-data.zip" -d "${{ runner.temp }}/artifacts"

      - name: "Read label data"
        id: read-label-data
        uses: actions/github-script@v8
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const fs = require('fs');
            const path = require('path');
            const temp = '${{ runner.temp }}/artifacts';
            const prNumber = Number(fs.readFileSync(path.join(temp, 'NR')));
            const label = fs.readFileSync(path.join(temp, 'LABEL')).toString().trim();
            const ref = fs.readFileSync(path.join(temp, 'REF')).toString().trim();
            const repo = fs.readFileSync(path.join(temp, 'REPO')).toString().trim();
            core.setOutput('label', label);
            core.setOutput('prNumber', prNumber);
            core.setOutput('ref', ref);
            core.setOutput('repo', repo);

    outputs:
      label: ${{ steps.read-label-data.outputs.label }}
      prNumber: ${{ steps.read-label-data.outputs.prNumber }}
      ref: ${{ steps.read-label-data.outputs.ref }}
      repo: ${{ steps.read-label-data.outputs.repo }}

  block-locales-pr:
    needs: read-label-data
    if: needs.read-label-data.outputs.label == 'Awaiting Locales'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          sparse-checkout: |
            .nvmrc
          sparse-checkout-cone-mode: false

      - name: "Block PR"
        run: |
          gh pr review ${{ needs.read-label-data.outputs.prNumber }} -R ${{ github.repository }} --request-changes --body "This pull request is blocked until the associated locales PR is merged.
          To unblock and update the locales submodule, add the \`Update Locales\` label."

  block-assets-pr:
    needs: read-label-data
    if: needs.read-label-data.outputs.label == 'Awaiting Assets'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          sparse-checkout: |
            .nvmrc
          sparse-checkout-cone-mode: false

      - name: "Block PR"
        run: |
          gh pr review ${{ needs.read-label-data.outputs.prNumber }} -R ${{ github.repository }} --request-changes --body "This pull request is blocked until the associated assets PR is merged.
          To unblock and update the assets submodule, add the \`Update Assets\` label."

  update-locales:
    needs: read-label-data
    if: needs.read-label-data.outputs.label == 'Update Locales'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/create-github-app-token@v2
        id: app-token
        with:
          app-id: ${{ secrets.PAGEFAULT_APP_ID }}
          private-key: ${{ secrets.PAGEFAULT_APP_PRIVATE_KEY }}

      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          repository: ${{ needs.read-label-data.outputs.repo }}
          ref: ${{ needs.read-label-data.outputs.ref }}
          sparse-checkout: |
            locales
            .gitmodules
          sparse-checkout-cone-mode: false
          token: ${{ steps.app-token.outputs.token }}

      - name: Update locales submodule
        run: |
          git config --local user.name "github-actions[bot]"
          git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git submodule update --progress --init --recursive --force --depth 1 --remote locales

      - name: Commit and push changes
        run: |
          git add locales
          if ! git commit -m "Update locales submodule"; then
              echo "No changes to commit"
          else
              git push
          fi

      - name: Remove label
        run: |
          gh pr edit ${{ needs.read-label-data.outputs.prNumber }} -R ${{ github.repository }} --remove-label "Update Locales"
          gh pr edit ${{ needs.read-label-data.outputs.prNumber }} -R ${{ github.repository }} --remove-label "Awaiting Locales"

      - name: Unblock PR
        run: |
          REVIEW_ID=$(gh api repos/${{ github.repository }}/pulls/${{ needs.read-label-data.outputs.prNumber }}/reviews \
              --jq '.[] | select(.user.login == "github-actions[bot]" and .state == "CHANGES_REQUESTED" and (.body // "" | contains("Update Locales"))) | .id' | head -n 1)
          if [ -n "$REVIEW_ID" ]; then
              gh api --method PUT repos/${{ github.repository }}/pulls/${{ needs.read-label-data.outputs.prNumber }}/reviews/$REVIEW_ID/dismissals \
              -f message="Locales updated, unblocking PR."
          fi

  update-assets:
    needs: read-label-data
    if: needs.read-label-data.outputs.label == 'Update Assets'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/create-github-app-token@v2
        id: app-token
        with:
          app-id: ${{ secrets.PAGEFAULT_APP_ID }}
          private-key: ${{ secrets.PAGEFAULT_APP_PRIVATE_KEY }}

      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          repository: ${{ needs.read-label-data.outputs.repo }}
          ref: ${{ needs.read-label-data.outputs.ref }}
          sparse-checkout: |
            assets
            .gitmodules
          sparse-checkout-cone-mode: false
          token: ${{ steps.app-token.outputs.token }}

      - name: Update assets submodule
        run: |
          git config --local user.name "github-actions[bot]"
          git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git submodule update --progress --init --recursive --force --depth 1 --remote assets

      - name: Commit and push changes
        run: |
          git add assets
          if ! git commit -m "Update assets submodule"; then
              echo "No changes to commit"
          else
              git push
          fi

      - name: Remove label
        run: |
          gh pr edit ${{ needs.read-label-data.outputs.prNumber }} -R ${{ github.repository }} --remove-label "Update Assets"
          gh pr edit ${{ needs.read-label-data.outputs.prNumber }} -R ${{ github.repository }} --remove-label "Awaiting Assets"

      - name: Unblock PR
        run: |
          REVIEW_ID=$(gh api repos/${{ github.repository }}/pulls/${{ needs.read-label-data.outputs.prNumber }}/reviews \
              --jq '.[] | select(.user.login == "github-actions[bot]" and .state == "CHANGES_REQUESTED" and (.body // "" | contains("Update Assets"))) | .id' | head -n 1)
          if [ -n "$REVIEW_ID" ]; then
              gh api --method PUT repos/${{ github.repository }}/pulls/${{ needs.read-label-data.outputs.prNumber }}/reviews/$REVIEW_ID/dismissals \
              -f message="Assets updated, unblocking PR."
          fi