name: Deploy to Netlify
on:
  workflow_call:
    inputs:
      pr_number:
        required: true
        type: string
      pr_head_full_name:
        required: true
        type: string
      pr_head_ref:
        required: true
        type: string
      deployment_ref:
        required: true
        type: string
      package:
        required: true
        type: string
        description: Which package to deploy - 'full', 'embedded', or 'sdk'
      artifact_run_id:
        required: false
        type: string
        default: ${{ github.run_id }}
    secrets:
      ELEMENT_BOT_TOKEN:
        required: true
      NETLIFY_AUTH_TOKEN:
        required: true
      NETLIFY_SITE_ID:
        required: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      deployments: write
    environment: Netlify
    steps:
      - name: 📝 Create Deployment
        uses: bobheadxi/deployments@648679e8e4915b27893bd7dbc35cb504dc915bc8 # v1
        id: deployment
        with:
          step: start
          token: ${{ secrets.GITHUB_TOKEN }}
          env: Netlify
          ref: ${{ inputs.deployment_ref }}
          desc: |
            Do you trust the author of this PR? Maybe this build will steal your keys or give you malware.
            Exercise caution. Use test accounts.

      - name: 📥 Download artifact
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}
          run-id: ${{ inputs.artifact_run_id }}
          name: build-output-${{ inputs.package }}
          path: webapp

      - name: Add redirects file
        # We fetch from github directly as we don't bother checking out the repo
        run: curl -s https://raw.githubusercontent.com/element-hq/element-call/main/config/netlify_redirects > webapp/_redirects

      - name: Add config file
        run: |
          if [ "${INPUTS_PACKAGE}" = "full" ]; then
            curl -s "https://raw.githubusercontent.com/${INPUTS_PR_HEAD_FULL_NAME}/${INPUTS_PR_HEAD_REF}/config/config_netlify_preview.json" > webapp/config.json
          else
            curl -s "https://raw.githubusercontent.com/${INPUTS_PR_HEAD_FULL_NAME}/${INPUTS_PR_HEAD_REF}/config/config_netlify_preview_sdk.json" > webapp/config.json
          fi
        env:
          INPUTS_PACKAGE: ${{ inputs.package }}
          INPUTS_PR_HEAD_FULL_NAME: ${{ inputs.pr_head_full_name }}
          INPUTS_PR_HEAD_REF: ${{ inputs.pr_head_ref }}
      - name: ☁️ Deploy to Netlify
        id: netlify
        uses: nwtgck/actions-netlify@4cbaf4c08f1a7bfa537d6113472ef4424e4eb654 # v3.0
        with:
          publish-dir: webapp
          deploy-message: "Deploy from GitHub Actions"
          alias: ${{ inputs.package == 'sdk' && format('pr{0}-sdk', inputs.pr_number) || format('pr{0}', inputs.pr_number) }}
        env:
          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
          NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID }}
        timeout-minutes: 1

      - name: 🚦 Update deployment status
        uses: bobheadxi/deployments@648679e8e4915b27893bd7dbc35cb504dc915bc8 # v1
        if: always()
        with:
          step: finish
          override: false
          token: ${{ secrets.GITHUB_TOKEN }}
          status: ${{ job.status }}
          env: ${{ steps.deployment.outputs.env }}
          deployment_id: ${{ steps.deployment.outputs.deployment_id }}
          env_url: ${{ steps.netlify.outputs.deploy-url }}
          desc: |
            Do you trust the author of this PR? Maybe this build will steal your keys or give you malware.
            Exercise caution. Use test accounts.
