name: Authorize Vercel Deploys

# This workflow is triggered by the validate-pr workflow. When it's triggered, it will run the
# authorize-vercel-deploys.yml in master branch. If you want to change it, you'll have to merge it into master.
on:
  # only run this workflow when the validate-pr workflow completes (successfully or not)
  workflow_run:
    workflows: ['Validate pull request']
    types: [completed]

# Cancel old builds on new commit for same workflow + branch/PR.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  authorize-vercel-deploys:
    runs-on: blacksmith-4vcpu-ubuntu-2404

    steps:
      # Checkout the master branch from the supabase repo and run that script to authorize Vercel deploys
      - name: Check out repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          ref: master
          # fetch only the root files and scripts folder
          sparse-checkout: |
            scripts
            patches
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        name: Install pnpm
        with:
          run_install: false
      - name: Setup node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'
      - name: Download dependencies
        run: |
          pnpm install --frozen-lockfile
      - name: Authorize Vercel Deploys
        run: |-
          pnpm run authorize-vercel-deploys
        env:
          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
          # The SHA of the commit that triggered the validate-pr workflow
          HEAD_COMMIT_SHA: ${{ github.event.workflow_run.head_sha }}