name: refresh

# Refreshes every six hours from keyless sources. A failed source keeps its last good snapshot and the page says so.
# Three jobs, so the one that parses downloaded data can neither push nor deploy.
on:
  schedule:
    - cron: "17 */6 * * *"
  workflow_dispatch:
    inputs:
      bigquery:
        description: "BigQuery for this run: auto runs the rolling queries on the midnight refresh only"
        type: choice
        options: [auto, light, full]
        default: auto

permissions: {}

concurrency:
  group: refresh
  cancel-in-progress: false

jobs:
  build:
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    environment: bigquery
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: "3.12"
      - name: Pull, rebuild, verify
        env:
          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
          GITHUB_TOKEN: ${{ github.token }} # read-only in this job
          WANT_BQ: ${{ inputs.bigquery }}
        run: |
          FLAGS=""
          if [ "$WANT_BQ" = "full" ]; then FLAGS="--bq"
          elif [ "$WANT_BQ" = "light" ] || [ "$(date -u +%H)" = "00" ]; then FLAGS="--bq-light"; fi
          if [ -n "$FLAGS" ] && [ -n "$GCP_SA_KEY" ]; then
            pip install --require-hashes --only-binary :all: -r requirements-bq.txt
            umask 077
            KEY="$(mktemp -p "$RUNNER_TEMP")"
            trap 'rm -f "$KEY"' EXIT
            printf '%s' "$GCP_SA_KEY" | base64 -d > "$KEY"
            export GOOGLE_APPLICATION_CREDENTIALS="$KEY"
          fi
          unset GCP_SA_KEY
          python3 run.py $FLAGS
      - name: The ledger may only grow
        run: |
          if git cat-file -e HEAD:ledger/grades.jsonl 2>/dev/null; then
            git show HEAD:ledger/grades.jsonl > "$RUNNER_TEMP/old-ledger"
            cmp -n "$(wc -c < "$RUNNER_TEMP/old-ledger")" "$RUNNER_TEMP/old-ledger" ledger/grades.jsonl
          fi
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: refreshed-data
          path: |
            raw/
            ledger/
            docs/
          retention-days: 1
          if-no-files-found: error

  publish:
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: refreshed-data
          path: .
      - name: Commit the new snapshot
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add raw ledger docs
          git diff --cached --quiet || git commit -m "data refresh $(date -u +%FT%H:%MZ)"
          git push

  deploy:
    needs: publish
    # Pages needs a public repo. Set the repo variable PAGES_ENABLED to true when the repo goes public.
    if: vars.PAGES_ENABLED == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deploy.outputs.page_url }}
    steps:
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: refreshed-data
          path: refreshed
      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: refreshed/docs
      - id: deploy
        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1