update-submodules.yml

name: Update Submodules

on:
  repository_dispatch:
    types: [update-submodules]

permissions:
  contents: write
  actions: read

concurrency:
  group: update-submodules-${{ github.event.client_payload.type }}-${{ github.event.client_payload.name }}
  cancel-in-progress: false

jobs:
  update:
    name: Update Package Submodule
    runs-on: ubuntu-latest
    outputs:
      type: ${{ steps.submodule.outputs.type }}
      type_plural: ${{ steps.submodule.outputs.type_plural }}
      repo: ${{ steps.submodule.outputs.repo }}
      name: ${{ steps.submodule.outputs.name }}

    steps:
      - name: 1️⃣ Create ianhub-agent token
        id: app-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.IANHUB_AGENT_APP_ID }}
          private-key: ${{ secrets.IANHUB_AGENT_PRIVATE_KEY }}
          owner: ianhubnet
      
      - name: 2️⃣ Checkout repo with submodules
        uses: actions/checkout@v5
        with:
          token: ${{ steps.app-token.outputs.token }}
          submodules: false
      
      - name: 3️⃣ Configure GitHub auth and identity
        shell: bash
        run: |
          git config --global url."https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/".insteadOf "https://github.com/"
          git config --global user.name "ianhub-agent[bot]"
          git config --global user.email "ianhub-agent[bot]@users.noreply.github.com"

      - name: 4️⃣ Add or Update Submodule
        id: submodule
        shell: bash
        env:
          CSK_TYPES: ${{ vars.CSK_TYPES }}
        run: |
          TYPE="${{ github.event.client_payload.type }}"
          TYPE_PLURAL=$(echo "$CSK_TYPES" | jq -r --arg key "$TYPE" '.[$key]')

          if [ "$TYPE_PLURAL" = "null" ]; then
            echo "❌ Invalid TYPE: '$TYPE'. Must be one of: $(echo "$CSK_TYPES" | jq -r 'keys | join(", ")')"
            exit 1
          fi

          REPO="${{ github.event.client_payload.repo }}"
          NAME="${{ github.event.client_payload.name }}"
          if [ -z "$REPO" ] || [ -z "$NAME" ]; then
            echo "❌ Missing required payload fields."
            exit 1
          fi

          SUB_PATH="packages/$TYPE_PLURAL/$NAME"
          echo "➡️ Type: $TYPE"
          echo "📦 Name: $NAME"
          echo "🔗 Repo: $REPO"
          echo "📂 Submodule path: $SUB_PATH"

          # Check if submodule exists
          if git config -f .gitmodules --get submodule."$SUB_PATH".url >/dev/null; then
            echo "🔍 Submodule exists. Verifying repository URL..."

            # Normalize existing and expected URLs
            EXISTING_URL=$(git config -f .gitmodules --get submodule."$SUB_PATH".url | sed -E 's|https://.*@github.com/|https://github.com/|' | sed 's|\.git$||')
            EXPECTED_URL=$(echo "https://github.com/$REPO" | sed 's|\.git$||')

            if [ "$EXISTING_URL" != "$EXPECTED_URL" ]; then
              echo "❌ Repository mismatch detected!"
              exit 1
            fi

            echo "✅ Repository verified. Updating..."
            git submodule update --init --remote "$SUB_PATH"
          else
            echo "➕ Submodule doesn't exist. Adding it..."
            mkdir -p "$(dirname "$SUB_PATH")"

            # Add using token for authentication, then normalize URL
            git submodule add "https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/$REPO" "$SUB_PATH"
            git config -f .gitmodules submodule."$SUB_PATH".url "https://github.com/$REPO"
            git submodule sync
          fi

          # Stage submodule changes
          git add .gitmodules "$SUB_PATH"

          # Pull latest main if nothing staged
          git fetch origin main --quiet
          if git diff --cached --quiet; then
            echo "🟢 No staged changes. Safe to pull..."
            git merge --ff-only origin/main --quiet || true
          else
            echo "⚠️ Skipping merge to avoid overwriting staged submodule updates."
          fi

          # Commit if needed
          if git diff --cached --quiet; then
            echo "🟡 No changes to commit."
          else
            echo "📝 Committing changes..."
            git commit -m "Auto-update/add submodule: $TYPE_PLURAL/${NAME:-unknown}"
          fi

          # Push with retry
          echo "🚀 Pushing to origin (with retry)..."
          for i in 1 2 3; do
            git push && break || {
              echo "❌ Push failed. Retry #$i in 3s..."
              sleep 3
            }
          done

          git status -sb

          echo "✅ Done."
          echo "type=$TYPE" >> $GITHUB_OUTPUT
          echo "type_plural=$TYPE_PLURAL" >> $GITHUB_OUTPUT
          echo "repo=$REPO" >> $GITHUB_OUTPUT
          echo "name=$NAME" >> $GITHUB_OUTPUT

  post-update:
    name: Upload Package Release to FTP
    needs: update
    runs-on: ubuntu-latest

    steps:
      - name: 1️⃣ Create ianhub-agent token
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          app-id: ${{ secrets.IANHUB_AGENT_APP_ID }}
          private-key: ${{ secrets.IANHUB_AGENT_PRIVATE_KEY }}
          owner: ianhubnet

      - name: 2️⃣ Download latest release ZIP
        run: |
          REPO="${{ needs.update.outputs.repo }}"
          NAME="${{ needs.update.outputs.name }}"
          API_URL="https://api.github.com/repos/$REPO/releases/latest"

          echo "🔍 Fetching latest release metadata..."
          curl -L -H "Authorization: Bearer ${{ steps.app-token.outputs.token }}" "$API_URL" > latest.json

          ZIP_URL=$(jq -r '.assets[] | select(.name | endswith(".zip")) | .browser_download_url' latest.json | head -n 1)
          VERSION=$(jq -r '.tag_name' latest.json)

          echo "📦 Version: $VERSION"
          echo "📥 ZIP URL: $ZIP_URL"

          if [ -z "$ZIP_URL" ] || [ "$ZIP_URL" == "null" ]; then
            echo "❌ No release asset found. Aborting."
            exit 1
          fi

          curl -L -o "${NAME}.zip" "$ZIP_URL"

          echo "ZIP=${NAME}.zip" >> $GITHUB_ENV
          echo "VERSION=$VERSION" >> $GITHUB_ENV

      - name: 3️⃣ Upload to FTP
        uses: SamKirkland/FTP-Deploy-Action@v4.4.0
        with:
          server: ${{ secrets.FTP_HOST }}
          port: ${{ secrets.FTP_PORT }}
          username: ${{ secrets.FTP_USER }}
          password: ${{ secrets.FTP_PASS }}
          local-dir: ./
          server-dir: ${{ secrets.FTP_PATH }}${{ needs.update.outputs.type_plural }}/
          state-name: ".sync-${{ needs.update.outputs.name }}-state.json"
          exclude: |
            **/*
            !${{ env.ZIP }}

      - name: 4️⃣ Send JSON-RPC
        shell: bash
        env:
          RPC_URL: ${{ secrets.RPC_URL }}
          RPC_KEY: ${{ secrets.RPC_KEY }}
          RPC_VER: ${{ secrets.RPC_VER }}
        run: |
          REPO="${{ needs.update.outputs.repo }}"
          REPO_URL="https://github.com/$REPO"
          TYPE="${{ needs.update.outputs.type }}"
          PACKAGE="${{ needs.update.outputs.name }}"
          OWNER="${REPO%%/*}"
          NAME="${REPO##*/}"
          ID=$(openssl rand -hex 8)

          curl -s -X POST "$RPC_URL" \
            -H "Content-Type: application/json" \
            -H "Authorization: Bearer $RPC_KEY" \
            -d "{
              \"jsonrpc\": \"$RPC_VER\",
              \"method\": \"update\",
              \"params\": {
                \"type\": \"$TYPE\",
                \"package\": \"$PACKAGE\",
                \"repo\": \"$REPO_URL\",
                \"owner\": \"$OWNER\",
                \"name\": \"$NAME\",
                \"version\": \"${{ env.VERSION }}\"
              },
              \"id\": \"$ID\"
            }"