name: Upstream compatibility

# freshharvest.com is a moving target with no API and no stability contract. This
# integration reads HTML and posts to form endpoints, so a redesign can change
# what a value MEANS without changing its shape — a sensor quietly reporting last
# week's total is worse than one that goes unavailable.
#
# tools/compat.py records what the integration assumes and asserts it against the
# live site daily, refreshing the matrix in README.md and opening an issue when
# something breaks.
#
# SCOPE: unauthenticated surface only. The authenticated contract (dashboard
# markup, cart hashes, skip popups, subscribe forms) needs a real session, and
# the only way to give public CI one is to park a personal grocery account's
# password in repo secrets. Not worth it for a drift check — that half belongs in
# a fleet job on a host that already holds credentials.

on:
  schedule:
    - cron: "23 7 * * *"      # daily, off the hour
  workflow_dispatch:
  push:
    paths:
      # The manifest of assumptions changed — re-check now, not tomorrow.
      - "tools/compat.py"
      - ".github/workflows/compat.yml"

permissions:
  # Read-only on contents: this workflow reports, it does not write to the repo.
  contents: read
  issues: write

jobs:
  compat:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"

      - name: Check assumptions against the live site
        id: check
        run: |
          set +e
          python tools/compat.py --markdown > matrix.md
          echo "failures=$?" >> "$GITHUB_OUTPUT"
          cat matrix.md

      - name: Publish the matrix to the run summary
        run: |
          # Deliberately does NOT commit. GitHub is a read-only mirror of Gitea,
          # so anything a bot pushes here is clobbered by the next sync, and
          # opening a PR needs a repo setting that a mirror should not depend
          # on. The badge should mean "is upstream still compatible", not "did
          # the bot manage its own bookkeeping".
          {
            echo "## Upstream compatibility"
            echo
            cat matrix.md
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Open an issue when the site has drifted
        if: steps.check.outputs.failures != '0'
        run: |
          TITLE="Upstream drift: freshharvest.com no longer matches our assumptions"
          EXISTING=$(gh issue list --state open --search "$TITLE" --json number -q '.[0].number')
          BODY=$'The daily compatibility check failed. The integration is likely reporting stale or wrong values.\n\n'"$(cat matrix.md)"
          if [ -n "$EXISTING" ]; then
            gh issue comment "$EXISTING" --body "$BODY"
          else
            gh issue create --title "$TITLE" --body "$BODY" --label upstream
          fi
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Fail the run on drift
        if: steps.check.outputs.failures != '0'
        run: |
          echo "${{ steps.check.outputs.failures }} assumption(s) no longer hold"
          exit 1