name: Update PostgreSQL versions

on:
  schedule:
    - cron: 0 0 * * 1
  workflow_dispatch:

defaults:
  run:
    shell: 'bash -Eeuo pipefail -x {0}'

permissions: read-all

jobs:
  build:
    name: Run update script
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
        with:
          token: ${{ secrets.REPO_GHA_PAT }}

      - name: Run update script
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
        with:
          timeout_minutes: 15
          max_attempts: 3
          command: |
            VERSIONS="$(
            curl -Ss -q https://www.postgresql.org/versions.json \
            | jq -r '[.[] | select(.supported == true) | .major + "." + .latestMinor]
            | sort
            | map("  \"" + . + "\"")
            | join(",\n")' \
            | sed '1i postgreSQLVersions = [' \
            | sed '$a ]'
            )"
            printf '%s\n' "$VERSIONS" \
            | sed -i '/^postgreSQLVersions = \[/,/^]/d;/^\/\/ PostgreSQL versions/r /dev/stdin' docker-bake.hcl

      - name: Diff
        run: |
          git status
          git diff

      - name: Temporarily disable "include administrators" branch protection
        if: ${{ always() && github.ref == 'refs/heads/main' }}
        id: disable_include_admins
        uses: benjefferies/branch-protection-bot@af281f37de86139d1c7a27b91176b5dc1c2c827c # v1.1.2
        with:
          access_token: ${{ secrets.REPO_GHA_PAT }}
          branch: main
          enforce_admins: false

      - uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
        with:
          author_name: CloudNativePG Automated Updates
          author_email: noreply@cnpg.com
          message: 'chore: update PostgreSQL versions'

      - name: Enable "include administrators" branch protection
        uses: benjefferies/branch-protection-bot@af281f37de86139d1c7a27b91176b5dc1c2c827c # v1.1.2
        if: ${{ always() && github.ref == 'refs/heads/main' }}
        with:
          access_token: ${{ secrets.REPO_GHA_PAT }}
          branch: main
          enforce_admins: ${{ steps.disable_include_admins.outputs.initial_status }}