name: Provenance Guard

on:
  pull_request_target:
    types: [opened, synchronize, reopened, ready_for_review]

permissions:
  contents: read
  pull-requests: write
  issues: write

jobs:
  check:
    if: github.event.pull_request.base.repo.full_name == 'valkey-io/valkey'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Run Provenance Check
        uses: valkey-io/verify-provenance@76588a161686a5bcab40ef11e8d1dff3a18aa8ef
        with:
          source_repo: "redis/redis"
          target_repo: "${{ github.repository }}"
          normalization_pairs: "Redis:Valkey,master:primary,slave:replica,RM_:VM_,REDISMODULE_:VALKEYMODULE_"
          exclude_dirs: "deps/"
          github_token: "${{ secrets.GITHUB_TOKEN }}"
          db_branch: "verify-provenance-db"

      - name: Show Provenance Check Log
        if: always()
        run: |
          if [ -f .provenance-output.log ]; then
            cat .provenance-output.log
          else
            echo "No provenance output log found."
          fi
