name: Refresh verified plugin Registry

on:
  schedule:
    - cron: '17 */2 * * *'
  workflow_dispatch:

permissions:
  contents: write

concurrency:
  group: dsh-plugin-registry-refresh
  cancel-in-progress: false

jobs:
  scan:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
        with:
          version: 11.1.2
      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm registry:test
      - run: pnpm discovery:test
      - run: pnpm profile:test
      - run: pnpm self-update:test
      - name: Discover and validate candidates
        run: pnpm registry:scan
        env:
          GITHUB_TOKEN: ${{ secrets.REGISTRY_GITHUB_TOKEN || github.token }}
      - name: Audit every guided install classification
        run: pnpm registry:audit
        env:
          GITHUB_TOKEN: ${{ secrets.REGISTRY_GITHUB_TOKEN || github.token }}
      - name: Verify generated Registry
        run: pnpm registry:verify
      - name: Commit Registry changes
        shell: bash
        run: |
          git add registry/plugins.json registry/discovery.json registry/rejected.json registry/state.json registry/install-review.json registry/guided-audit.json
          if git diff --cached --quiet; then
            echo "Registry is already current."
            exit 0
          fi
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git commit -m "chore(registry): refresh verified plugins"
          git push