name: Upload previews

on: # zizmor: ignore[dangerous-triggers] -- workflow_run is used safely here; no code checkout occurs
  workflow_run:
    workflows: [CI]
    types: [completed]

permissions:
  statuses: write

jobs:
  upload-previews:
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest

    steps:
      # DO NOT run actions/checkout here, for security reasons
      # For details, refer to https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.10'

      - run: pip install smokeshow

      - uses: dawidd6/action-download-artifact@8a338493df3d275e4a7a63bcff3b8fe97e51a927 # v19
        with:
          workflow: ci.yml
          commit: ${{ github.event.workflow_run.head_sha }}

      - run: smokeshow upload coverage-html
        env:
          SMOKESHOW_GITHUB_STATUS_DESCRIPTION: Coverage {coverage-percentage}
          # 5 is set here while V2 is in development and coverage is far from complete
          SMOKESHOW_GITHUB_COVERAGE_THRESHOLD: 91
          SMOKESHOW_GITHUB_CONTEXT: coverage
          SMOKESHOW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SMOKESHOW_GITHUB_PR_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
          SMOKESHOW_AUTH_KEY: ${{ secrets.SMOKESHOW_AUTH_KEY }}
