name: Migration Order

on:
  pull_request:
  push:
    branches: [main, 'release/*']

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  migration-order:
    name: Verify migration ORDER
    if: ${{ !github.event.created }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
      BASELINE: ${{ github.workspace }}/base/server/src/schema/migrations/ORDER
      MAIN_MIGRATIONS: ${{ github.workspace }}/main/server/src/schema/migrations
      ORDER: ${{ github.workspace }}/server/src/schema/migrations/ORDER
    steps:
      - id: token
        uses: immich-app/devtools/actions/create-workflow-token@df46d635b905e618b88fc4c95baa920aeb30b309 # create-workflow-token-action-v3.0.1
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
          permission-contents: read

      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          token: ${{ steps.token.outputs.token }}

      - name: Checkout base
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ env.BASE_SHA }}
          path: base
          persist-credentials: false
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
        uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
        with:
          github_token: ${{ steps.token.outputs.token }}

      - name: Install dependencies
        run: mise //server:install

      - name: Verify migration ORDER
        run: mise //server:migrations verify-order --append-only-from "${BASELINE}"

      - name: Checkout main
        if: ${{ startsWith(github.base_ref, 'release/') || startsWith(github.ref_name, 'release/') }}
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: main
          path: main
          persist-credentials: false
          token: ${{ steps.token.outputs.token }}

      - name: Verify the release line does not diverge from main
        if: ${{ startsWith(github.base_ref, 'release/') || startsWith(github.ref_name, 'release/') }}
        run: mise //server:migrations verify-order --source-folder "${MAIN_MIGRATIONS}" --append-only-from "${ORDER}"