filament/.github/workflows/sync-docs.yml

name: sync-docs

on:
  release:
    types: [published]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  sync-docs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout docs repository
        # persist-credentials: true is required so the final `git push` to
        # filamentphp/mintlify-docs uses the GH_ACCESS_TOKEN written into
        # docs/.git/config. Subsequent steps in this job are maintainer-controlled.
        # zizmor: ignore[artipacked]
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          repository: filamentphp/mintlify-docs
          token: ${{ secrets.GH_ACCESS_TOKEN }}
          path: docs

      - name: Set up Node
        # setup-node's default npm cache is harmless here: the job only runs `node sync.js`
        # (read-only against the docs repo's working tree) and then pushes to a separate
        # repo via PAT. No cache contents reach a release-distributed artifact, so the
        # cache-poisoning vector zizmor flags doesn't apply.
        # zizmor: ignore[cache-poisoning]
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: '20'

      - name: Run sync script
        working-directory: docs
        run: node sync.js

      - name: Commit and push changes
        working-directory: docs
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add -A
          if git diff --staged --quiet; then
            echo "No changes to commit"
          else
            git commit -m "Sync documentation from release ${RELEASE_TAG}"
            git push
          fi