name: Context7 refresh

# Refreshes the Context7 variant for the pushed branch. Context7 indexes
# three variants of this library, all tracking a branch HEAD directly:
#   - rolling  → default variant       (omit both `branch` and `tag`)
#   - circinus → branch variant        `branch: "circinus"` (VyOS 1.5)
#   - sagitta  → branch variant        `branch: "sagitta"`  (VyOS 1.4)
#
# The circinus/sagitta variants are declared as branch entries in
# context7.json `previousVersions`. There is no longer any git-tag
# indirection — Context7 re-crawls the branch HEAD on refresh, so the
# variant always reflects current branch content.
#
# Docs-only gating: the `paths:` filter scopes to `docs/**` and
# `context7.json`, so infra-only pushes (workflows, scripts, Docker,
# README, etc.) never trigger a refresh — Context7 only ingests `docs/**`
# (per context7.json `folders`) plus the config file itself.
#
# NOTE: circinus/sagitta must be registered as BRANCH variants in the
# Context7 dashboard (driven by the context7.json `previousVersions`
# branch entries on the default branch). A refresh with `branch: "<name>"`
# returns 404 until Context7 has crawled the config and registered the
# branch variant.

on:
  push:
    branches:
      - rolling
      - circinus
      - sagitta
    paths:
      - 'docs/**'
      - 'context7.json'
  workflow_dispatch:
    inputs:
      variant:
        description: "Context7 variant to refresh (rolling = default; circinus = 1.5; sagitta = 1.4)"
        type: choice
        options: [rolling, circinus, sagitta]
        default: rolling

permissions: {}

concurrency:
  group: >-
    context7-refresh-${{
      (github.event_name == 'workflow_dispatch' && inputs.variant)
      || github.ref_name
    }}
  cancel-in-progress: true

jobs:
  refresh:
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - name: Refresh Context7 library
        env:
          CONTEXT7_API_KEY: ${{ secrets.CONTEXT7_API_KEY }}
          EVENT_NAME: ${{ github.event_name }}
          REF_NAME: ${{ github.ref_name }}
          DISPATCH_VARIANT: ${{ inputs.variant }}
          REPO: ${{ github.repository }}
        run: |
          set -euo pipefail
          if [[ -z "${CONTEXT7_API_KEY:-}" ]]; then
            echo "ERROR: CONTEXT7_API_KEY is unset or empty" >&2
            exit 1
          fi
          if [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then
            VARIANT="$DISPATCH_VARIANT"
          else
            VARIANT="$REF_NAME"
          fi
          # Defense-in-depth: the type:choice UI constraint is bypassable when
          # workflow_dispatch is invoked via API (`gh workflow run -f variant=…`).
          case "$VARIANT" in
            rolling|circinus|sagitta) ;;
            *) echo "Invalid variant: '${VARIANT}'. Expected one of: rolling, circinus, sagitta." >&2; exit 1 ;;
          esac
          echo "Refreshing Context7 variant: $VARIANT"
          # rolling = default variant (no field). circinus/sagitta = branch-backed.
          if [[ "$VARIANT" == "rolling" ]]; then
            PAYLOAD="$(jq -nc --arg lib "/$REPO" \
              '{libraryName: $lib}')"
          else
            PAYLOAD="$(jq -nc --arg lib "/$REPO" --arg br "$VARIANT" \
              '{libraryName: $lib, branch: $br}')"
          fi
          curl -fsSL \
            --connect-timeout 10 \
            --max-time 60 \
            --retry 2 --retry-delay 10 \
            -X POST \
            "https://context7.com/api/v1/refresh" \
            -H "Authorization: Bearer $CONTEXT7_API_KEY" \
            -H "Content-Type: application/json" \
            -d "$PAYLOAD"