idx-cli/.github/workflows/publish-ownership-snapshot.yml

name: Publish Ownership Snapshot

on:
  workflow_dispatch:
    inputs:
      release_tag:
        description: Stable GitHub release tag to publish the snapshot assets to
        required: true
        default: ownership-snapshot-current
      history:
        description: Number of earlier monthly above-1% reports to include for `ownership changes`
        required: false
        default: "5"

permissions:
  contents: write

concurrency:
  group: ownership-snapshot-publish
  cancel-in-progress: false

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Nix
        uses: cachix/install-nix-action@v30

      - name: Build ownership publisher
        run: nix build .#ownership-publisher

      - name: Publish ownership snapshot
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          RELEASE_TAG: ${{ inputs.release_tag }}
          HISTORY: ${{ inputs.history }}
        run: |
          set -euo pipefail

          # The packaged publisher owns the full protocol: discovery, import,
          # content-addressed SQLite upload + SHA-256 verification, and the
          # manifest as the final commit point. It is a no-op when current.
          ./result/bin/idx-ownership-publish \
            --output-dir dist/ownership-snapshot \
            --repo "$REPO" \
            --release-tag "$RELEASE_TAG" \
            --history "$HISTORY"

      - name: Upload workflow artifact copy
        # A legitimate up-to-date run produces no new local artifacts.
        uses: actions/upload-artifact@v4
        with:
          name: ownership-snapshot-${{ github.run_id }}
          path: dist/ownership-snapshot/*
          if-no-files-found: ignore