name: Release Doxygen

permissions:
  contents: read

on:
  workflow_dispatch:
    inputs:
      release-version:
        description: 'Release Version'
        required: true
        type: string
      upload:
        description: 'Upload documentation'
        required: false
        type: boolean

  workflow_call:
    inputs:
      release-version:
        description: 'Release Version'
        required: true
        type: string
      upload:
        description: 'Upload documentation'
        required: false
        type: boolean
    secrets:
      LLVM_TOKEN_GENERATOR_CLIENT_ID:
        description: "Client ID for our GitHub App we use for generating access tokens."
        required: true
      LLVM_TOKEN_GENERATOR_PRIVATE_KEY:
        description: "Private key for our GitHub App we use for generating access tokens."
        required: true

jobs:
  # This job checks permissions and validates inputs to prevent potential
  # malicious actions.  Since the release-doxygen job has contents: write
  # permissions we need to be extra careful about who can run the job and
  # what inputs can be provided.
  release-doxygen-validate-input:
    name: Release Doxygen Validate Input
    runs-on: ubuntu-24.04
    environment:
      name: release
      deployment: false
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: |
            .github/workflows/

      - name: Check Permissions
        uses: ./.github/workflows/require-team-membership
        with:
          team-slug: llvm-release-managers
          LLVM_TOKEN_GENERATOR_CLIENT_ID: ${{ secrets.LLVM_TOKEN_GENERATOR_CLIENT_ID }}
          LLVM_TOKEN_GENERATOR_PRIVATE_KEY: ${{ secrets.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }}

      - name: Validate Input
        uses: ./.github/workflows/validate-release-version
        with:
          release-version: ${{ inputs.release-version }}

  release-doxygen:
    name: Build and Upload Release Doxygen
    runs-on: ubuntu-24.04
    environment:
      name: release
      deployment: false
    permissions:
      contents: write
    needs:
      - release-doxygen-validate-input
    env:
      upload: ${{ inputs.upload && !contains(inputs.release-version, 'rc') }}
    steps:
      - name: Checkout LLVM
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Setup Python env
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          cache: 'pip'
          cache-dependency-path: './llvm/docs/requirements.txt'

      - name: Install Dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
              doxygen \
              graphviz \
              python3-github \
              ninja-build \
              texlive-font-utils
          pip3 install --require-hashes --user -r ./llvm/docs/requirements.txt

      - name: Build Doxygen
        env:
          RELEASE_VERSION: ${{ inputs.release-version }}
        run: |
          ./llvm/utils/release/build-docs.sh -release "$RELEASE_VERSION" -no-sphinx

      - id: app-token
        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3  # v3.1.1
        with:
          app-id: ${{ secrets.LLVM_TOKEN_GENERATOR_CLIENT_ID }}
          private-key: ${{ secrets.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          permission-members: read

      - name: Upload Doxygen
        if: env.upload
        env:
          GITHUB_TOKEN: ${{ github.token }}
          USER_TOKEN: ${{ steps.app-token.outputs.token }}
          RELEASE_VERSION: ${{ inputs.release-version }}
        run: |
          ./llvm/utils/release/github-upload-release.py --token "$GITHUB_TOKEN" --release "$RELEASE_VERSION" --user "$GITHUB_ACTOR" --user-token "$USER_TOKEN" upload --files ./*doxygen*.tar.xz