name: Build legal manifest

# HT-14: renders every project's legal markdown to HTML+PDF and produces
# dist/legal-manifest.json — the single canonical source HT-15's consumer backends import,
# so no one hashes/versions independently. See scripts/build-manifest.py for the actual
# logic; this workflow just provides the environment it needs.

on:
  push:
    branches: [main]
    paths-ignore: [manifest/**]  # avoid the commit-back step (below) re-triggering itself
  workflow_dispatch: {}

jobs:
  build-manifest:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout (full history)
        uses: actions/checkout@v4
        with:
          # NOT the default shallow clone: scripts/build-manifest.py's per-file
          # `git log -1 -- path` needs real history, or every file silently resolves to
          # whatever the one shallow commit happens to be (see HT-15 belépő ellenőrzés).
          fetch-depth: 0

      # The CI environment: a plain ubuntu-latest job container (act_runner default image),
      # with pandoc (markdown -> HTML, per HT-14) and WeasyPrint (HTML -> PDF, same
      # approach already proven deterministic for ResidentFirst's HRF-34 offer contracts)
      # installed as an explicit step — not baked into a custom runner image, so the
      # environment stays visible and reproducible directly from this file.
      - name: Install pandoc + WeasyPrint
        run: |
          apt-get update -qq
          apt-get install -y --no-install-recommends \
            pandoc python3 python3-pip python3-venv \
            libpango-1.0-0 libpangoft2-1.0-0 fonts-dejavu-core
          python3 -m venv /tmp/venv
          /tmp/venv/bin/pip install --quiet weasyprint==69.0
          echo "/tmp/venv/bin" >> "$GITHUB_PATH"

      - name: Build manifest
        run: python3 scripts/build-manifest.py

      # v4 uses a newer artifact-storage protocol this Gitea version doesn't implement yet
      # ("GHESNotSupportedError", confirmed empirically) — v3 uses the older, supported one.
      # Convenience only (manual inspection via the Actions UI) — HT-15 consumers should NOT
      # depend on this: the repo-level list-artifacts API returned empty even after a
      # successful v3 upload (a Gitea REST API gap, not a real absence — the run's own job
      # log confirms the upload step succeeded). The commit-back step below is the real,
      # dependable distribution path.
      - name: Upload manifest + rendered artifacts (convenience only, see note above)
        uses: actions/upload-artifact@v3
        with:
          name: legal-manifest
          path: dist/

      # The dependable distribution path for HT-15: just the small JSON manifest (not the
      # bulkier rendered HTML/PDF, to avoid repo bloat over time) committed back to the repo
      # consumers already git-clone for the markdown sources — no Gitea Actions artifact API
      # involved at all.
      - name: Commit manifest back to repo
        run: |
          mkdir -p manifest
          cp dist/legal-manifest.json manifest/legal-manifest.json
          git config user.name "H2W Legal CI"
          git config user.email "ci@h2w.hu"
          git add manifest/legal-manifest.json
          if git diff --cached --quiet; then
            echo "Manifest változatlan — nincs mit commitolni."
          else
            git commit -m "CI: legal-manifest.json frissítve [skip ci]"
            git push origin HEAD:main
          fi