name: update-flakehub

on:
  push:
    tags:
      - "v[0-9]+.*[02468].[0-9]+"
  workflow_dispatch:
    inputs:
      tag:
        description: "The existing tag to publish to FlakeHub"
        type: "string"
        required: true
jobs:
  flakehub-publish:
    runs-on: "ubuntu-latest"
    permissions:
      id-token: "write"
      contents: "read"
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: "${{ (inputs.tag != null) && format('refs/tags/{0}', inputs.tag) || '' }}"
      - uses: DeterminateSystems/nix-installer-action@c5a866b6ab867e88becbed4467b93592bce69f8a # v21
      - uses: DeterminateSystems/flakehub-push@71f57208810a5d299fc6545350981de98fdbc860 # v6
        with:
          visibility: "public"
          tag: "${{ inputs.tag }}"
