name: 'Docs: Bump Version'

on:
  release:
    types:
      - 'published'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.release.tag_name }}
  cancel-in-progress: false

env:
  PROWLER_VERSION: ${{ github.event.release.tag_name }}
  BASE_BRANCH: master
  DOCS_FILE: docs/getting-started/installation/prowler-app.mdx

permissions: {}

jobs:
  bump-version:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: Validate release version
        run: |
          if [[ ! $PROWLER_VERSION =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
            echo "::error::Invalid version syntax: '$PROWLER_VERSION' (must be X.Y.Z)"
            exit 1
          fi
          if (( ${BASH_REMATCH[1]} != 5 )); then
            echo "::error::Releasing another Prowler major version, aborting..."
            exit 1
          fi

      - name: Checkout master branch
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ env.BASE_BRANCH }}
          persist-credentials: false

      - name: Read current docs version on master
        id: docs_version
        run: |
          CURRENT_DOCS_VERSION=$(grep -oP 'PROWLER_UI_VERSION="\K[^"]+' "${DOCS_FILE}")
          echo "CURRENT_DOCS_VERSION=${CURRENT_DOCS_VERSION}" >> "${GITHUB_ENV}"
          echo "Current docs version on master: $CURRENT_DOCS_VERSION"
          echo "Target release version: $PROWLER_VERSION"

          # Skip if master is already at or ahead of the release version
          # (re-run, or patch shipped against an older minor line)
          HIGHEST=$(printf '%s\n%s\n' "${CURRENT_DOCS_VERSION}" "${PROWLER_VERSION}" | sort -V | tail -n1)
          if [[ "${CURRENT_DOCS_VERSION}" == "${PROWLER_VERSION}" || "${HIGHEST}" != "${PROWLER_VERSION}" ]]; then
            echo "skip=true" >> "${GITHUB_OUTPUT}"
            echo "Skipping bump: current ($CURRENT_DOCS_VERSION) >= release ($PROWLER_VERSION)"
          else
            echo "skip=false" >> "${GITHUB_OUTPUT}"
          fi

      - name: Bump versions in documentation
        if: steps.docs_version.outputs.skip == 'false'
        run: |
          set -e
          sed -i "s|PROWLER_UI_VERSION=\"${CURRENT_DOCS_VERSION}\"|PROWLER_UI_VERSION=\"${PROWLER_VERSION}\"|" "${DOCS_FILE}"
          sed -i "s|PROWLER_API_VERSION=\"${CURRENT_DOCS_VERSION}\"|PROWLER_API_VERSION=\"${PROWLER_VERSION}\"|" "${DOCS_FILE}"
          echo "Files modified:"
          git --no-pager diff

      - name: Create PR for documentation update to master
        if: steps.docs_version.outputs.skip == 'false'
        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
        with:
          author: prowler-bot <179230569+prowler-bot@users.noreply.github.com>
          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
          base: ${{ env.BASE_BRANCH }}
          commit-message: 'chore(docs): Bump version to v${{ env.PROWLER_VERSION }}'
          branch: docs-version-bump-to-v${{ env.PROWLER_VERSION }}
          title: 'chore(docs): Bump version to v${{ env.PROWLER_VERSION }}'
          labels: no-changelog,skip-sync
          body: |
            ### Description

            Update Prowler documentation version references to v${{ env.PROWLER_VERSION }} after releasing Prowler v${{ env.PROWLER_VERSION }}.

            ### Files Updated
            - `docs/getting-started/installation/prowler-app.mdx`: `PROWLER_UI_VERSION` and `PROWLER_API_VERSION`

            ### License

            By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.