name: Update main branch from main-source

on:
  workflow_dispatch: {}
  push:
    branches:
      - main-source

jobs:
  update:
    permissions:
      id-token: write
    runs-on: ubuntu-latest
    steps:
    - name: Configure git
      run: |
        git config --global user.name "github-actions[bot]"
        git config --global user.email "github-actions[bot]@users.noreply.github.com"

    - name: Get rancher/partner-charts secrets out of vault
      uses: rancher-eio/read-vault-secrets@main
      with:
        secrets: |
          secret/data/github/repo/rancher/partner-charts/github/app-credentials appId | APP_ID ;
          secret/data/github/repo/rancher/partner-charts/github/app-credentials privateKey | PRIVATE_KEY

    - name: Generate short-lived github app token
      uses: actions/create-github-app-token@v1
      id: app-token
      with:
        app-id: ${{ env.APP_ID }}
        private-key: ${{ env.PRIVATE_KEY }}

    - uses: actions/checkout@v4
      with:
        token: ${{ steps.app-token.outputs.token }}

    - name: Update main branch with latest from main-source
      run: |
        # checkout action only fetches main-source, so we need to fetch main
        git fetch origin main --depth 1
        git checkout main

        git rm -r assets index.yaml
        git checkout main-source -- assets index.yaml

        # exit if there are no changes
        git diff-index --quiet HEAD assets index.yaml && exit 0

        git commit -m "Release partner charts"
        git push origin main