name: Publish Ownership Snapshot

on:
  workflow_dispatch:
    inputs:
      release_tag:
        description: Stable GitHub release tag to publish the snapshot assets to
        required: true
        default: ownership-snapshot-current
      history:
        description: Number of earlier monthly above-1% reports to include for `ownership changes`
        required: false
        default: "5"

permissions:
  contents: write

concurrency:
  group: ownership-snapshot-publish
  cancel-in-progress: false

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Install Nix
        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

      - name: Build ownership publisher
        run: nix build .#ownership-publisher

      - name: Publish ownership snapshot
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          RELEASE_TAG: ${{ inputs.release_tag }}
          HISTORY: ${{ inputs.history }}
        run: |
          set -euo pipefail

          # The packaged publisher owns the full protocol: discovery, import,
          # content-addressed SQLite upload + SHA-256 verification, and the
          # manifest as the final commit point. It is a no-op when current.
          ./result/bin/idx-ownership-publish \
            --output-dir dist/ownership-snapshot \
            --repo "$REPO" \
            --release-tag "$RELEASE_TAG" \
            --history "$HISTORY"

      - name: Upload workflow artifact copy
        # A legitimate up-to-date run produces no new local artifacts.
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ownership-snapshot-${{ github.run_id }}
          path: dist/ownership-snapshot/*
          if-no-files-found: ignore