# The activity lease on personal test-records keys. Daily, with the broker
# identity pinned to this file on main (infra: tofu/test-records), this
# disables the service accounts of key holders with no pull-request
# activity in the past month and re-enables the accounts of people who are
# active again, so a lapsed contributor's key file revives on their return
# with nothing to re-download. An outage here fails in the right
# direction: nothing gets disabled, nobody active is locked out.

name: Test Records Janitor

on:
  schedule:
    - cron: "23 9 * * *"
  workflow_dispatch: {}

permissions:
  contents: read
  id-token: write

jobs:
  janitor:
    name: "Lease Key Holders"
    # Where test records are not provisioned there is no broker identity to
    # assume and no key holders to lease, so the job skips. An outage here
    # already fails in the right direction: nothing gets disabled.
    if: vars.TEST_RECORDS_BROKER_WIF_PROVIDER != ''
    runs-on: ubuntu-latest
    steps:
      - name: 📥 Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 🦕 Setup Deno
        uses: ./.github/actions/deno-setup
        with:
          cache: false

      - name: 🔑 Authenticate to Google Cloud
        id: auth
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          project_id: commontools-core
          workload_identity_provider: ${{ vars.TEST_RECORDS_BROKER_WIF_PROVIDER }}
          service_account: ${{ vars.TEST_RECORDS_BROKER_SERVICE_ACCOUNT }}
          token_format: access_token
          create_credentials_file: false

      - name: 📊 Apply the activity lease
        env:
          TEST_RECORDS_GCP_TOKEN: ${{ steps.auth.outputs.access_token }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          deno run --allow-read --allow-env --allow-net \
            tasks/test-records-janitor.ts