---
name: Publish collection to Ansible Galaxy

on:  # yamllint disable-line rule:truthy
  release:
    types:
      - released

jobs:
  deploy:
    if: github.repository == 'dev-sec/ansible-collection-hardening'
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6

      # deploy the collection first, because if it fails, we don't want
      # to update the galaxy.yml
      - name: Deploy the collection
        uses: artis3n/ansible_galaxy_collection@415a92b829b5898b6e8ca1dd7a69fe2a1e5fd4c0 # v2
        with:
          api_key: ${{ secrets.GALAXY_API_KEY }}
          galaxy_version: ${{ github.event.release.tag_name }}

      # checkout master instead of the release-tag so we can push the galaxy.yml
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
        with:
          ref: master

      - name: update galaxy.yml with new version
        uses: microsoft/variable-substitution@6287962da9e5b6e68778dc51e840caa03ca84495 # v1
        with:
          files: 'galaxy.yml'
        env:
          version: "${{ github.event.release.tag_name }}"

      - name: push galaxy.yml
        uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          push-branch: 'master'
          commit-message: 'update galaxy.yml with new version'
          force-add: 'true'
          files: galaxy.yml
          name: dev-sec CI
          email: hello@dev-sec.io