name: CI Command

on:
  repository_dispatch:
    types: [ci-command]

permissions:
  actions: write
  contents: read
  issues: write
  pull-requests: read

jobs:
  admit:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout trusted admission script
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false
      - name: Admit CI command
        id: admit
        env:
          GITHUB_TOKEN: ${{ github.token }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_API_URL: ${{ github.api_url }}
          COMMENT_ID: ${{ github.event.client_payload.github.payload.comment.id }}
          DISPATCH_SENDER: ${{ github.event.sender.login }}
          DISPATCH_HEAD_SHA: ${{ github.event.client_payload.pull_request.head.sha }}
        run: python3 .github/scripts/ci-slash.py
      - name: Reply with command result
        if: ${{ steps.admit.outputs.reply != '' }}
        env:
          GH_TOKEN: ${{ github.token }}
          REPLY: ${{ steps.admit.outputs.reply }}
          PR_NUMBER: ${{ steps.admit.outputs.pr_number }}
        run: printf '%s\n' "${REPLY}" | gh pr comment "${PR_NUMBER}" --body-file -
      - name: Dispatch selected CI workflow
        if: ${{ steps.admit.outputs.skip == 'false' }}
        env:
          GH_TOKEN: ${{ github.token }}
          WORKFLOWS: ${{ steps.admit.outputs.workflow }}
          HEAD_SHA: ${{ steps.admit.outputs.head_sha }}
          FUZZ_PROFILE: ${{ steps.admit.outputs.fuzz_profile }}
        run: |
          IFS=, read -ra workflows <<<"${WORKFLOWS}"
          for workflow in "${workflows[@]}"; do
            gh api --method POST "/repos/${GITHUB_REPOSITORY}/actions/workflows/${workflow}/dispatches" \
              -f ref="${HEAD_SHA}" -F 'inputs[ci_command]=true' -f "inputs[fuzz_profile]=${FUZZ_PROFILE}"
          done