NetMesh/.github/workflows/star-history.yml

name: Star History

on:
  schedule:
    # Weekly Monday 00:00 UTC
    - cron: '0 0 * * 1'
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  update:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          # Same PAT used for releases — needs stargazers read (admin/collaborator)
          # plus contents/PR write so we can open an update PR against protected main.
          token: ${{ secrets.RELEASE_TOKEN }}

      - name: Generate star history SVGs
        env:
          GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
        run: |
          set -euo pipefail
          tmpdir=$(mktemp -d)
          git clone --depth 1 https://github.com/carsteneu/mystarhistory.git "$tmpdir/mystarhistory"
          out_dir="docs/assets/star-history"
          mkdir -p "$out_dir"
          python3 "$tmpdir/mystarhistory/mystarhistory.py" \
            --repo "${{ github.repository }}" \
            --output "$out_dir/star-history-light.svg"
          python3 "$tmpdir/mystarhistory/mystarhistory.py" \
            --repo "${{ github.repository }}" \
            --dark \
            --output "$out_dir/star-history-dark.svg"

      # main is protected (require PR + enforce_admins), so direct pushes fail with GH006.
      # Push the chart branch with RELEASE_TOKEN (checkout credentials), then open/merge
      # the PR with GITHUB_TOKEN — RELEASE_TOKEN is not granted createPullRequest.
      - name: Commit via pull request
        env:
          # Prefer GITHUB_TOKEN for PR API; fall back is not used for git push auth.
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          git add docs/assets/star-history/star-history-light.svg \
                  docs/assets/star-history/star-history-dark.svg
          if git diff --cached --quiet; then
            echo "No chart changes"
            exit 0
          fi

          default_branch="${{ github.event.repository.default_branch }}"
          branch="chore/star-history"

          git checkout -B "$branch"
          git commit -m "chore: update star history charts [skip ci]"
          # Auth comes from actions/checkout (RELEASE_TOKEN), not GH_TOKEN above.
          git push -u origin "HEAD:${branch}" --force

          existing="$(
            gh pr list \
              --head "$branch" \
              --base "$default_branch" \
              --state open \
              --json number \
              --jq '.[0].number // empty'
          )"
          if [[ -n "$existing" ]]; then
            echo "Reusing open PR #${existing}"
            pr_number="$existing"
          else
            pr_url="$(
              gh pr create \
                --base "$default_branch" \
                --head "$branch" \
                --title "chore: update star history charts" \
                --body "Automated weekly refresh of the static star history SVG charts embedded in the README. Generated by the Star History workflow via mystarhistory."
            )"
            echo "Created ${pr_url}"
            pr_number="${pr_url##*/}"
          fi

          # required_approving_review_count is 0; merge immediately when possible.
          if gh pr merge "$pr_number" --squash --delete-branch; then
            echo "Merged PR #${pr_number}"
          else
            echo "Could not auto-merge PR #${pr_number}; left open for manual merge."
            exit 1
          fi