validate-upload.yml

name: Validate and upload

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - "*"
  schedule:
    - cron: "0 0 * * *"
  workflow_dispatch:

jobs:
  changes:
    runs-on: ubuntu-latest
    name: Determine Changes
    outputs:
      servers: ${{ steps.filter.outputs.servers }}
      servers_files: ${{ steps.filter.outputs.servers_files }}
      dry: ${{ steps.filter.outputs.dry }}
    steps:
      - name: Checkout from Github
        uses: actions/checkout@v4

      - name: Determine Changes
        uses: dorny/paths-filter@v3
        id: filter
        with:
          list-files: json
          filters: |
            servers:
              - added|modified|deleted: 'servers/**'
            dry:
              - added|modified|deleted: '.scripts/**'
              - added|modified|deleted: '.github/**'

  validate-servers:
    name: Validate Servers
    runs-on: ubuntu-latest

    permissions:
      contents: read
      pull-requests: read

    steps:
      # Trusted checkout: scripts and schemas come from the base ref so a PR
      # cannot alter the validator (e.g. fabricating pr_results.json as
      # "ready") to bypass validation in the trusted feedback workflow.
      - name: Checkout trusted base
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.base.ref || github.ref }}

      - name: Checkout PR contents (untrusted)
        if: github.event_name == 'pull_request'
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          path: pr-contents

      - name: Setup Python 3.x
        uses: actions/setup-python@v5
        with:
          python-version: "3.x"

      - name: Install Python dependencies
        run: pip install -r .scripts/requirements.txt

      - name: Validate Servers
        working-directory: ${{ github.event_name == 'pull_request' && 'pr-contents' || '.' }}
        run: |
          python "${GITHUB_WORKSPACE}/.scripts/validate.py" \
          --servers_dir servers \
          --metadata_schema "${GITHUB_WORKSPACE}/metadata.schema.json" \
          --inactive_file inactive.json \
          --inactive_schema "${GITHUB_WORKSPACE}/inactive.schema.json" \
          --no-validate_inactive
        env:
          PR_ID: ${{ github.event.pull_request.number }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          USE_ARGS: "true"

      - name: Upload validation results
        if: always() && github.event_name == 'pull_request'
        uses: actions/upload-artifact@v4
        with:
          name: pr-results
          path: pr-contents/pr_results.json
          if-no-files-found: ignore

  upload-servers:
    name: Upload Servers
    needs: [validate-servers, changes]
    if: github.event_name == 'push' && github.ref == 'refs/heads/master' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest

    permissions:
      contents: read

    env:
      AWS_ENDPOINT_URL: ${{ secrets.CF_R2_ENDPOINT }}
      AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_SECRET_ACCESS_KEY }}
      AWS_DEFAULT_REGION: auto

    steps:
      - name: Checkout from GitHub
        uses: actions/checkout@v4

      - name: Refuse to publish an older index
        run: |
          SOURCE_COMMITTED_AT="$(date -u -d "$(git show -s --format=%cI HEAD)" +%Y-%m-%dT%H:%M:%SZ)"

          if ! LIVE_METADATA="$(aws s3api head-object --bucket servermappings-lunarclientcdn-com --key servers.json)"; then
            echo "::error::Unable to read metadata of the published servers.json."
            exit 1
          fi

          # S3 lowercases user metadata keys
          LIVE_COMMITTED_AT="$(printf '%s' "$LIVE_METADATA" | python3 -c 'import json, sys; print(json.load(sys.stdin).get("Metadata", {}).get("sourcecommittedat", ""))')"

          if [ -z "$LIVE_COMMITTED_AT" ]; then
            echo "::warning::Published servers.json has no sourceCommittedAt; skipping freshness check."
            exit 0
          fi

          if [ "$(date -u -d "$LIVE_COMMITTED_AT" +%s)" -gt "$(date -u -d "$SOURCE_COMMITTED_AT" +%s)" ]; then
            echo "::error::Refusing to publish: this build is from ${SOURCE_COMMITTED_AT}, older than the published index (${LIVE_COMMITTED_AT}). This usually means an old workflow run was re-run; re-run the latest master run instead."
            exit 1
          fi

          echo "Publishing ${SOURCE_COMMITTED_AT} over ${LIVE_COMMITTED_AT}."

      - name: Setup Python 3.x
        uses: actions/setup-python@v5
        with:
          python-version: "3.x"

      - name: Install Python dependencies
        run: pip install -r .scripts/requirements.txt

      - name: Create server output folder
        run: mkdir .out/

      - name: Create Crowdin upload target
        run: mkdir -p ServerMappings/locales/ && touch ServerMappings/locales/en_US.json

      - name: Download translations from Crowdin
        uses: crowdin/github-action@v2
        with:
          command: "download"
          command_args: "--source ServerMappings/locales/en_US.json --translation ServerMappings/locales/%locale%.json --export-only-approved"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CROWDIN_PROJECT_ID: "424304"
          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_TOKEN }}

      - name: Output Server Media
        run: |
          # A dry run converts every server regardless, and its changed file
          # list is too large to pass as a single argument.
          if [ '${{ needs.changes.outputs.dry }}' = 'true' ]; then
            set --
          else
            set -- --changed_files '${{ needs.changes.outputs.servers_files }}'
          fi

          python .scripts/convert_media.py \
          --servers_dir servers \
          --inactive_file inactive.json \
          --servers_logos_output .out/logos \
          --servers_logos_sizes 256 128 64 32 \
          --servers_backgrounds_output .out/backgrounds \
          --servers_backgrounds_sizes 1280x720 852x480 \
          --servers_banners_output .out/banners \
          --servers_wordmarks_output .out/wordmarks \
          --servers_assets_output .out/assets \
          --dry_upload '${{ needs.changes.outputs.dry }}' \
          "$@"
        env:
          USE_ARGS: "true"

      - name: Create Index File
        run: |
          python .scripts/create_index.py \
          --servers_dir servers \
          --inactive_file inactive.json \
          --translations_folder ServerMappings/locales/ \
          --translations_output ServerMappings/locales/en_US.json \
          --json_output .out/servers.json \
          --no-include_inactive

      - name: Sync to Crowdin
        uses: crowdin/github-action@v2
        with:
          upload_sources: true
          upload_translations: false
          download_translations: false
          upload_sources_args: "--preserve-hierarchy"
          source: ServerMappings/locales/en_US.json
          translation: ServerMappings/locales/%locale%.json
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CROWDIN_PROJECT_ID: "424304"
          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_TOKEN }}

      - name: Upload to R2
        run: |
          SOURCE_COMMITTED_AT="$(date -u -d "$(git show -s --format=%cI HEAD)" +%Y-%m-%dT%H:%M:%SZ)"
          cd .out/
          aws s3 cp --recursive --cache-control 'public, max-age=3600, s-maxage=3600' backgrounds/ s3://servermappings-lunarclientcdn-com/backgrounds/ || true
          aws s3 cp --recursive --cache-control 'public, max-age=3600, s-maxage=3600' banners/ s3://servermappings-lunarclientcdn-com/banners/ || true
          aws s3 cp --recursive --cache-control 'public, max-age=3600, s-maxage=3600' logos/ s3://servermappings-lunarclientcdn-com/logos/ || true
          aws s3 cp --recursive --cache-control 'public, max-age=3600, s-maxage=3600' wordmarks/ s3://servermappings-lunarclientcdn-com/wordmarks/ || true
          aws s3 cp \
            --cache-control 'public, max-age=300, s-maxage=300' \
            --metadata "sourceCommittedAt=${SOURCE_COMMITTED_AT}" \
            servers.json s3://servermappings-lunarclientcdn-com/servers.json
          aws s3 cp --recursive --cache-control 'public, max-age=31536000, s-maxage=31536000' assets/ s3://servermappings-lunarclientcdn-com/assets/ || true

      - name: Purge Cloudflare cache
        env:
          CLOUDFLARE_PURGE_TOKEN: ${{ secrets.CLOUDFLARE_PURGE_TOKEN }}
        run: |
          curl -X POST "https://api.cloudflare.com/client/v4/zones/6ec53997a971431c0d92ac795f35502b/purge_cache" \
            -H "Content-Type: application/json" \
            -H "Authorization: Bearer $CLOUDFLARE_PURGE_TOKEN" \
            --data '{"files":["https://servermappings.lunarclientcdn.com/servers.json"]}'