name: Build Skills Index

on:
  schedule:
    # Run twice daily: 6 AM and 6 PM UTC
    - cron: "0 6,18 * * *"
  workflow_dispatch: # Manual trigger
  push:
    branches: [main]
    paths:
      - "scripts/build_skills_index.py"
      - ".github/workflows/skills-index.yml"

permissions:
  contents: read
  actions: write # to trigger deploy-site.yml on schedule

jobs:
  build-index:
    # Only run on the upstream repository, not on forks
    if: github.repository == 'NousResearch/hermes-agent'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    environment: trusted-automation
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Get GitHub App token
        id: app-token
        uses: ./.github/actions/get-app-token
        with:
          client-id: ${{ vars.APP_CLIENT_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"

      - name: Install dependencies
        uses: ./.github/actions/retry
        with:
          command: pip install httpx==0.28.1 pyyaml==6.0.2

      - name: Build skills index
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
        run: python scripts/build_skills_index.py

      - name: Upload index artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: skills-index
          path: website/static/api/skills-index.json
          retention-days: 7

  # Re-trigger the docs deploy so the refreshed index lands on the live site.
  # The deploy itself is owned by deploy-site.yml (which crawls and deploys
  # everything in one pipeline); we just kick it on a schedule.
  trigger-deploy:
    needs: build-index
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    environment: trusted-automation
    steps:
      # Required: `Get GitHub App token` is a LOCAL composite action
      # (./.github/actions/get-app-token) and cannot resolve without the repo
      # checked out. `build-index` above already does this; this job did not,
      # so the scheduled deploy re-trigger never fired.
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Get GitHub App token
        id: app-token
        uses: ./.github/actions/get-app-token
        with:
          client-id: ${{ vars.APP_CLIENT_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}

      - name: Trigger Deploy Site workflow
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: gh workflow run deploy-site.yml --repo ${{ github.repository }} -f skills_index_run_id=${{ github.run_id }}