name: "Miniflare - Generate changesets for dependabot PRs"

on:
  pull_request_target: # zizmor: ignore[dangerous-triggers] dependabot-only job requires write access to push generated changesets; checkout v6 persists credentials under RUNNER_TEMP
    paths:
      - "packages/miniflare/package.json"
      - "pnpm-workspace.yaml"

permissions:
  # content:write permission needed to update add changesets to dependabot PRs
  # (see tools/dependabot/generate-dependabot-pr-changesets.ts)
  contents: write

jobs:
  generate-changeset:
    runs-on: ubuntu-slim
    if: |
      github.actor == 'dependabot[bot]' &&
      github.event.pull_request.user.login == 'dependabot[bot]' &&
      github.event.pull_request.head.repo.full_name == github.repository
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 2
          persist-credentials: true
          ref: ${{ github.head_ref }}
          token: ${{ secrets.GH_ACCESS_TOKEN }}

      - name: Install Dependencies
        uses: ./.github/actions/install-dependencies

      - name: Configure Git
        run: |
          git config --global user.email wrangler@cloudflare.com
          git config --global user.name 'Wrangler automated PR updater'

      - name: Generate Miniflare changesets
        # The paremeters to the script are:
        # - PR: The number of the current Dependabot PR
        # - Packages: Coma-separated names of the workers-sdk packages whose dependencies are being updated
        # - PackageJSON: The path to the package JSON being updated by Dependabot
        # - Changeset prefix: The prefix to go on the front of the filename of the generated changeset
        run: >-
          node -r esbuild-register tools/dependabot/generate-dependabot-pr-changesets.ts
          "$PR_NUMBER"
          miniflare,wrangler
          packages/miniflare/package.json
          dependabot-update
        env:
          PR_NUMBER: ${{ github.event.number }}