name: Repair Tracked Podcast Feed URLs

on:
  schedule:
    - cron: '17 4 * * 0'
  workflow_dispatch:

permissions:
  contents: write

concurrency:
  group: tracked-podcast-rtdb-maintenance
  cancel-in-progress: false

jobs:
  repair-feed-urls:
    runs-on: ubuntu-latest
    steps:
      - name: Generate boxlore pusher token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.BOXLORE_PUSHER_APP_ID }}
          private-key: ${{ secrets.BOXLORE_PUSHER_PRIVATE_KEY }}

      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          token: ${{ steps.app-token.outputs.token }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: scripts/package-lock.json

      - name: Install dependencies
        run: npm ci --prefix scripts

      - name: Test repair logic
        run: node --test scripts/backfill-tracked-podcast-feeds-lib.test.js

      - name: Authenticate GCP/Firebase
        env:
          FCM_SERVICE_ACCOUNT_KEY: ${{ secrets.FCM_SERVICE_ACCOUNT_KEY }}
        run: |
          printf '%s' "$FCM_SERVICE_ACCOUNT_KEY" > "$RUNNER_TEMP/gcp-key.json"
          echo "GOOGLE_APPLICATION_CREDENTIALS=$RUNNER_TEMP/gcp-key.json" >> "$GITHUB_ENV"

      - name: Back up tracked-podcast RTDB state
        run: node scripts/backfill-tracked-podcast-feeds.js --backup-only

      - name: Commit weekly RTDB backup
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add scripts/data/tracked-podcasts-backups
          if git diff --cached --quiet; then
            echo "Current ISO-week RTDB backup is unchanged."
            exit 0
          fi
          git commit -m "chore: backup tracked podcast state [skip ci]"
          git pull --rebase origin master
          git push origin master

      - name: Repair missing feed URLs
        run: node scripts/backfill-tracked-podcast-feeds.js --repair-only
        env:
          # Scoped read-only catalog key (`gh-backfill.<secret>`); APP_SECRET_KEY is the fallback until it's set.
          BOXLORE_SVC_KEY: ${{ secrets.BOXLORE_SVC_BACKFILL_KEY }}
          # Read-only registry view: confirmed working addresses for shows whose old one is dead.
          BOXLORE_SVC_NOTIFIER_KEY: ${{ secrets.BOXLORE_SVC_NOTIFIER_KEY }}
          APP_SECRET_KEY: ${{ secrets.APP_SECRET_KEY }}
          BOXLORE_API_BASE_URL: https://api.aswin.cx

      - name: Remove service-account file
        if: always()
        run: rm -f "$RUNNER_TEMP/gcp-key.json"