name: Mirror to GitHub

on:
  push:
    branches:
      - main
  workflow_dispatch:  # Allow manual triggering

jobs:
  mirror:
    runs-on: ubuntu-latest
    # Note: For GitHub fine-grained tokens, ensure the token has:
    # - Repository access to the-luap/picpeak
    # - Repository permissions: Contents (Read and Write), Metadata (Read)
    # For classic tokens: repo scope is sufficient
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 0  # Full history for proper mirroring

      - name: Setup Git
        run: |
          git config --global user.name "the-luap"
          git config --global user.email "paul-nothaft@hotmail.de"

      - name: Remove sensitive files and directories
        run: |
          echo "Current files before cleanup:"
          ls -la | head -10 || true
          echo "..."
          
          # Remove sensitive files/directories if they exist
          echo "Removing sensitive files..."
          rm -rf .gitea/ || true
          rm -rf scripts/install-gitea-runner.sh || true
          rm -rf .drone* || true
          rm -rf photo-sharing-prd.md || true
          rm -rf CLAUDE.md || true
          rm -rf storage/ || true
          rm -rf events/ || true
          rm -rf .playwright-mcp/
          rm -rf .swarm || true
          rm -rf .claude-flow || true

          
          echo "Sensitive files removal completed"
          
          # Add and commit the cleanup if there are changes
          git add -A
          if ! git diff --cached --quiet; then
            git commit -m "chore: remove sensitive files for GitHub mirror"
            echo "✅ Committed cleanup of sensitive files"
          else
            echo "✅ No sensitive files to remove"
          fi
          
          echo "Final file structure (top level):"
          ls -la | head -10 || true

      - name: Check GitHub token
        env:
          GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
        run: |
          if [ -z "$GITHUBTOKEN" ]; then
            echo "ERROR: GITHUBTOKEN secret is not set!"
            echo "Please add a GitHub Personal Access Token as a secret named GITHUBTOKEN"
            echo ""
            echo "For fine-grained tokens:"
            echo "  - Go to GitHub Settings > Developer settings > Personal access tokens > Fine-grained tokens"
            echo "  - Create token with repository access to the-luap/picpeak"
            echo "  - Grant permissions: Contents (Read and Write), Metadata (Read)"
            echo ""
            echo "For classic tokens:"
            echo "  - Go to GitHub Settings > Developer settings > Personal access tokens > Tokens (classic)"
            echo "  - Create token with 'repo' scope"
            exit 1
          else
            echo "✅ GitHub token is available (length: ${#GITHUBTOKEN})"
            # Try to detect token type (fine-grained tokens are typically longer)
            if [ ${#GITHUBTOKEN} -gt 80 ]; then
              echo "📌 Token appears to be a fine-grained personal access token"
            else
              echo "📌 Token appears to be a classic personal access token"
            fi
          fi

      - name: Push to GitHub
        env:
          GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
          GIT_TRACE: 1  # Enable Git trace for debugging if needed
        run: |
          # Remove existing github remote if it exists
          git remote remove github || true
          
          # Configure Git to use the token for authentication
          # This method works for both classic and fine-grained tokens
          git config --global url."https://the-luap:${GITHUBTOKEN}@github.com/".insteadOf "https://github.com/"
          
          # Add GitHub remote (clean URL without credentials)
          git remote add github https://github.com/the-luap/picpeak.git
          
          # Verify remote was added
          echo "GitHub remote configuration:"
          git remote -v
          
          # Push to GitHub main branch with error handling
          echo "Pushing to GitHub..."
          if git push github main --force 2>&1; then
            echo "✅ Push to GitHub completed successfully!"
          else
            echo "❌ Push to GitHub failed!"
            echo ""
            echo "Common issues and solutions:"
            echo "1. Token permissions: Ensure your token has 'Contents: write' permission"
            echo "2. Token expiration: Check if your token has expired"
            echo "3. Repository access: Verify the token has access to the-luap/picpeak repository"
            echo ""
            echo "For fine-grained tokens, required permissions:"
            echo "  - Repository access: the-luap/picpeak"
            echo "  - Repository permissions: Contents (Read and Write), Metadata (Read)"
            echo ""
            echo "For classic tokens, required scope: 'repo'"
            exit 1
          fi
          
          # Clean up the git config after push
          git config --global --unset url."https://the-luap:${GITHUBTOKEN}@github.com/".insteadOf

      - name: Workflow completed
        run: |
          echo "✅ Mirror to GitHub workflow completed successfully!"
          echo "📊 Repository mirrored to: https://github.com/the-luap/picpeak"
          echo "🔒 Sensitive files have been removed from the mirror"