name: Update AAGUIDs

on:
  schedule:
    - cron: "0 0 * * 1" # Runs every Monday at midnight
  workflow_dispatch: # Allows manual triggering of the workflow

permissions:
  contents: read

jobs:
  update-aaguids:
    runs-on: depot-ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: stable

      - name: Update AAGUIDs and authenticator icons
        run: go run scripts/update-aaguids.go

      - name: Create bot app token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ vars.BOT_APP_CLIENT_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write

      - name: Get bot commit identity
        id: bot
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
        run: |
          bot_name="$APP_SLUG[bot]"
          bot_id=$(gh api "users/$bot_name" --jq .id)
          echo "identity=Pocket ID Bot <$bot_id+$bot_name@users.noreply.github.com>" >> "$GITHUB_OUTPUT"

      - name: Create Pull Request
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          token: ${{ steps.app-token.outputs.token }}
          author: ${{ steps.bot.outputs.identity }}
          committer: ${{ steps.bot.outputs.identity }}
          commit-message: "chore: update AAGUIDs"
          title: "chore: update AAGUIDs"
          body: |
            This PR updates the AAGUID metadata and authenticator icons with the latest data from the [passkey-aaguids](https://github.com/pocket-id/passkey-aaguids) repository.
          branch: update-aaguids
          base: main
          delete-branch: true