controller.yml

name: Workflow Controller

on:
  push:
    branches: [ '**' ]
  workflow_call:
  workflow_dispatch:

permissions:
  contents: write

jobs:
  # ----------------------------------------
  # Analyze repo / commit to decide what to run
  # ----------------------------------------
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    timeout-minutes: 5

    outputs:
      run_compile:         ${{ steps.check.outputs.run_compile }}
      run_publish_package: ${{ steps.check.outputs.run_publish_package }}
      has_compile:         ${{ steps.check.outputs.has_compile }}
      has_publish_package: ${{ steps.check.outputs.has_publish_package }}
      run_safety_tag:      ${{ steps.check.outputs.run_safety_tag }}
      safety_label:        ${{ steps.check.outputs.safety_label }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 2

      - name: Analyze commit message, branch, and file changes
        id: check
        shell: bash
        run: |
          branch="${GITHUB_REF##*/}"
          msg="$(git log -1 --pretty=%B)"

          echo "Branch: $branch"
          echo "Commit message:"
          printf '%s\n' "$msg"

          # defaults
          echo "run_compile=false"          >> $GITHUB_OUTPUT
          echo "run_publish_package=false"  >> $GITHUB_OUTPUT
          echo "run_safety_tag=false"       >> $GITHUB_OUTPUT
          echo "safety_label="              >> $GITHUB_OUTPUT

          if [[ "$msg" == *"[skip ci]"* ]]; then
            echo "Detected [skip ci]; exiting early."
            exit 0
          fi

          # ----------------------------------------
          # Safety tag trigger
          #   [safety]              -> label = branch name
          #   [safety:some-label]   -> label = "some-label"
          # ----------------------------------------
          safety_label=""

          if [[ "$msg" =~ \[safety:([a-zA-Z0-9 _.-]+)\] ]]; then
            safety_label="${BASH_REMATCH[1]}"
          elif [[ "$msg" == *"[safety]"* ]]; then
            safety_label="$branch"
          fi

          if [[ -n "$safety_label" ]]; then
            norm="$(echo "$safety_label" | tr '[:upper:]' '[:lower:]' | tr ' ' '-' | tr -cd 'a-z0-9._-')"
            echo "Detected safety tag request with label: $norm"
            echo "run_safety_tag=true" >> $GITHUB_OUTPUT
            echo "safety_label=$norm"  >> $GITHUB_OUTPUT
          fi

          # ----------------------------------------
          # Source file filters
          # ----------------------------------------
          CODE_FILTERS=(
            '^src/'
            '^package\.json$'
            '^package-lock\.json$'
            '^tsconfig'
            '^scripts/'
            '\.github/'
          )

          git diff --name-only HEAD~1 > changed.txt || true
          echo "Changed files:"
          cat changed.txt || echo "(none)"

          pattern="${CODE_FILTERS[*]}"
          if grep -E "${pattern// /|}" changed.txt >/dev/null 2>&1; then
            echo "Detected matching source file → compile enabled."
            echo "run_compile=true" >> $GITHUB_OUTPUT
          else
            echo "No matching source changes → skipping compile."
            echo "run_compile=false" >> $GITHUB_OUTPUT
          fi

          # ----------------------------------------
          # Publish trigger (only on main/master/release/*)
          # ----------------------------------------
          if [[ "$branch" == "main" || "$branch" == "master" || "$branch" == release/* ]]; then
            if [[ "$msg" == *"[publish-package]"* || "$msg" == *"[publishpackage]"* ]]; then
              echo "run_publish_package=true" >> $GITHUB_OUTPUT
            fi
          else
            echo "Branch '$branch' not eligible for publish."
          fi

          # detect workflow existence
          [[ -f ".github/workflows/compile.yml" ]]         && echo "has_compile=true"         >> $GITHUB_OUTPUT || echo "has_compile=false"         >> $GITHUB_OUTPUT
          [[ -f ".github/workflows/publish-package.yml" ]] && echo "has_publish_package=true" >> $GITHUB_OUTPUT || echo "has_publish_package=false" >> $GITHUB_OUTPUT

      - name: Summary
        run: |
          echo "------------------------------------------"
          echo "Workflow Controller Summary"
          echo "------------------------------------------"
          echo "Repository:    ${{ github.repository }}"
          echo "Branch:        ${GITHUB_REF##*/}"
          echo "Compile:       ${{ steps.check.outputs.run_compile }} (exists: ${{ steps.check.outputs.has_compile }})"
          echo "Publish-Pkg:   ${{ steps.check.outputs.run_publish_package }} (exists: ${{ steps.check.outputs.has_publish_package }})"
          echo "Safety Tag:    ${{ steps.check.outputs.run_safety_tag }} (label: ${{ steps.check.outputs.safety_label }})"
          echo "------------------------------------------"

  # ----------------------------------------
  # Optional safety checkpoint
  # ----------------------------------------
  safety-tag:
    name: Safety Tag
    needs: analyze
    uses: ./.github/workflows/create-safety-tag.yml
    with:
      run:   ${{ needs.analyze.outputs.run_safety_tag }}
      label: ${{ needs.analyze.outputs.safety_label }}
    secrets: inherit

  # ----------------------------------------
  # Compile
  # ----------------------------------------
  compile:
    name: Compile
    if: ${{ (needs.analyze.outputs.run_compile == 'true' || needs.analyze.outputs.run_publish_package == 'true') &&
            needs.analyze.outputs.has_compile == 'true' }}
    needs: [analyze, safety-tag]
    uses: ./.github/workflows/compile.yml
    secrets: inherit

  # ----------------------------------------
  # Publish Package
  # ----------------------------------------
  publish-package:
    name: Publish Package
    if: ${{ needs.analyze.outputs.run_publish_package == 'true' &&
            needs.analyze.outputs.has_publish_package == 'true' }}
    needs: [analyze, safety-tag, compile]
    uses: ./.github/workflows/publish-package.yml
    secrets: inherit