name: Upload OpenAPI Spec to R2

on:
  push:
    branches: [main]
    paths:
      - 'apps/api/**'
      - 'packages/utils/src/openapi/**'
  workflow_dispatch:

env:
  NODE_VERSION: '20'

jobs:
  generate-and-upload-openapi:
    runs-on: ubuntu-latest
    environment: production
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Get pnpm store directory
        shell: bash
        run: |
          ls -la && echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

      - name: Setup pnpm cache
        uses: actions/cache@v4
        with:
          path: ${{ env.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Setup turbo cache
        # Turbo cache keyed by commit SHA, with a prefix restore-key so a previous run of
        # this workflow warms the @cio/api build instead of a cold rebuild.
        uses: actions/cache@v4
        with:
          path: .turbo
          key: ${{ runner.os }}-turbo-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-turbo-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build @cio/api workspace dependencies
        run: pnpm turbo run build --filter=@cio/api^... --cache-dir=.turbo

      - name: Upload to Cloudflare R2
        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
        run: |
          cd apps/api
          pnpm run upload:openapi
        env:
          CLOUDFLARE_ACCESS_KEY: ${{ secrets.CLOUDFLARE_ACCESS_KEY }}
          CLOUDFLARE_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_SECRET_ACCESS_KEY }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ZONE_ID: ${{ secrets.CLOUDFLARE_ZONE_ID }}
          PUBLIC_SUPABASE_URL: ${{ secrets.PUBLIC_SUPABASE_URL }}
          PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.PUBLIC_SUPABASE_ANON_KEY }}

  # The docs render the API reference statically from this spec, so a fresh
  # upload only reaches classroomio.com/docs/api once they rebuild.
  redeploy-docs:
    needs: generate-and-upload-openapi
    uses: ./.github/workflows/deploy-docs.yml
    secrets: inherit