name: Sync to internal repo

on:
  push:
    branches: [main]

# The push to the internal repo uses the app token below, not the GITHUB_TOKEN
permissions:
  contents: read

jobs:
  sync:
    runs-on: ubuntu-latest
    if: github.repository == 'bluesky-social/social-app'
    steps:
      - name: ⬇️ Checkout public repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          # Don't persist the checkout auth header; the push below authenticates
          # with the app token embedded in the remote URL instead
          persist-credentials: false
      - name: 🔑 Generate GitHub App Token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ vars.SYNC_INTERNAL_APP_ID }}
          private-key: ${{ secrets.SYNC_INTERNAL_PK }}
          repositories: social-app-internal
          # Scope the token down from the app's full installation permissions;
          # pushing is the only thing this token is used for. The workflows
          # permission is required because the sync includes files under
          # .github/workflows/, which GitHub refuses to push without it.
          permission-contents: write
          permission-workflows: write
      - name: 🚀 Push to internal repo
        env:
          TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          git config user.name "github-actions"
          git config user.email "test@users.noreply.github.com"
          git remote add internal https://x-access-token:${TOKEN}@github.com/bluesky-social/social-app-internal.git
          git push internal main --force