name: Validate Plugin PR
on:
  pull_request:
    branches: [ main ]

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout base branch (main) for validation scripts
        uses: actions/checkout@v3
        with:
          ref: main
          path: base
          
      - name: Checkout PR branch for plugin files
        uses: actions/checkout@v3
        with:
          path: pr
          fetch-depth: 0
          
      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '18'
          
      - name: Get changed files
        id: changed-files
        run: |
          cd pr
          echo "files=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | grep '^plugins/' || echo '')" >> $GITHUB_OUTPUT
          
      - name: Block attempts to modify infrastructure
        run: |
          cd pr
          INFRA_CHANGES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | grep -E '^\.gitea/' || echo '')
          if [ -n "$INFRA_CHANGES" ]; then
            echo "❌ ERROR: PRs cannot modify .gitea/ directory files"
            echo "Changed infrastructure files:"
            echo "$INFRA_CHANGES"
            echo ""
            echo "Only plugins/ directory changes are allowed."
            exit 1
          fi
          
      - name: Verify commit authors match PR creator
        run: |
          cd pr
          echo "🔍 Verifying commit authors..."
          PR_USER="${{ github.event.pull_request.user.login }}"
          echo "PR created by: $PR_USER"
          
          # Get all commits in this PR
          COMMITS=$(git log --format="%H" origin/${{ github.base_ref }}..HEAD)
          
          for commit in $COMMITS; do
            AUTHOR=$(git show -s --format='%an' $commit)
            EMAIL=$(git show -s --format='%ae' $commit)
            echo "  Commit $commit by $AUTHOR <$EMAIL>"
            
            # This is a warning, not a hard block, since git authors can be configured differently
            # The real security comes from PR creator authentication
          done
          
          echo "✓ PR created by authenticated user: $PR_USER"
          echo "Note: Validation will check plugin ownership against this authenticated user, not git commit authors"
          
      - name: Validate PR (using trusted validation script from main)
        run: |
          cd base
          node .gitea/scripts/validate-pr.js "${{ github.event.pull_request.user.login }}" "${{ steps.changed-files.outputs.files }}"
        env:
          PR_FILES_DIR: ../pr/plugins
          
      - name: Auto-merge PR
        if: success()
        run: |
          cd pr
          echo "✅ Validation passed - Auto-merging PR"
          git config user.name "GitHub Actions"
          git config user.email "actions@github.com"
          git fetch origin ${{ github.event.pull_request.head.ref }}
          git checkout main
          git merge --squash origin/${{ github.event.pull_request.head.ref }}
          git commit -m "${{ github.event.pull_request.title }}"
          git push origin main
          git push origin --delete ${{ github.event.pull_request.head.ref }}