attach_build_products.yml

name: Attach Build Products

# Posts IPA artifact links to the PR that triggered the build.
# Only fires for pull_request triggered builds — develop pushes are handled by the
# alpha-release job in build.yml (GitHub Releases).
# workflow_dispatch builds are handled by the post-to-pr job in build.yml.

concurrency:
  group: attach-${{ github.event.workflow_run.pull_requests[0].number || github.event.workflow_run.head_sha }}
  cancel-in-progress: true

on:
  workflow_run:
    workflows: ["Build and Upload Provenance"]
    types:
      - completed

permissions:
  contents: read
  pull-requests: write
  actions: read

jobs:
  attach:
    name: Post IPA links to PR
    runs-on: ubuntu-latest
    # Only run for pull_request triggered builds that succeeded.
    # Develop pushes use the alpha-release job; workflow_dispatch builds use post-to-pr.
    if: |
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event == 'pull_request'
    steps:
      - name: Get PR info and check eligibility
        id: pr
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          # Get the PR number from the workflow run's associated pull requests
          PR_NUMBER=$(echo '${{ toJSON(github.event.workflow_run.pull_requests) }}' \
            | jq -r '.[0].number // empty')

          if [ -z "$PR_NUMBER" ]; then
            echo "No associated PR found — skipping"
            echo "skip=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          # Skip agent PRs
          PR_TITLE=$(gh pr view "$PR_NUMBER" \
            --repo "${{ github.repository }}" \
            --json title --jq '.title' 2>/dev/null || echo "")

          if echo "$PR_TITLE" | grep -q "^\[Agent\]"; then
            echo "Agent PR — IPA comment not needed (uses smoke build instead)"
            echo "skip=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          echo "skip=false" >> "$GITHUB_OUTPUT"
          echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"

      - name: Post artifact links to PR
        if: steps.pr.outputs.skip == 'false'
        env:
          GH_TOKEN: ${{ github.token }}
          PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
        run: |
          RUN_ID="${{ github.event.workflow_run.id }}"
          RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${RUN_ID}"

          # Fetch artifact names for the completed build run
          ARTIFACT_NAMES=$(gh api \
            "repos/${{ github.repository }}/actions/runs/${RUN_ID}/artifacts" \
            --jq '.artifacts[].name' 2>/dev/null || echo "")

          ARTIFACT_LIST=""
          while IFS= read -r name; do
            [ -n "$name" ] && ARTIFACT_LIST="${ARTIFACT_LIST}- \`${name}\`"$'\n'
          done <<< "$ARTIFACT_NAMES"

          SHA="${{ github.event.workflow_run.head_sha }}"
          SHORT_SHA="${SHA:0:7}"

          cat > /tmp/ipa_links.md << COMMENTEOF
          ## 📦 IPA Builds Ready — \`${SHORT_SHA}\`

          Download from the [Actions run page](${RUN_URL}).

          ### Available IPAs
          ${ARTIFACT_LIST}
          > **Install:** Download the \`.ipa\`, then sideload via AltStore, SideStore, or TrollStore.
          > Artifacts expire after 90 days.
          COMMENTEOF

          gh pr comment "$PR_NUMBER" \
            --repo "${{ github.repository }}" \
            --body-file /tmp/ipa_links.md 2>/dev/null || \
          echo "::warning::Could not post comment to PR #${PR_NUMBER}"

      - name: Notify Discord
        if: steps.pr.outputs.skip == 'false'
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
          PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
        run: |
          [ -z "$DISCORD_WEBHOOK" ] && exit 0

          RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}"

          curl -s -H "Content-Type: application/json" -X POST "$DISCORD_WEBHOOK" \
            -d "{
              \"embeds\": [{
                \"title\": \"📦 New Provenance Builds — PR #${PR_NUMBER}\",
                \"description\": \"IPA builds ready for sideloading.\",
                \"url\": \"${RUN_URL}\",
                \"color\": 5814783
              }]
            }" 2>/dev/null || true