# When the "unfreeze" label is added to a PR, add that PR to Merge Freeze's unblocked list
# so it can be merged during a freeze. Uses pull_request_target so the workflow runs in
# the base repo and has access to MERGEFREEZE_ACCESS_TOKEN for fork PRs; it does not
# checkout or run any PR code. Requires MERGEFREEZE_ACCESS_TOKEN repo secret
# (project-specific token from Merge Freeze Web API panel for actualbudget/actual / master).
# See: https://docs.mergefreeze.com/web-api#post-freeze-status

name: Merge Freeze – add PR to unblocked list

on:
  pull_request_target:
    types: [labeled]

jobs:
  unfreeze:
    if: ${{ github.event.label.name == 'unfreeze' }}
    runs-on: ubuntu-latest
    permissions: {}
    concurrency:
      group: merge-freeze-unfreeze-${{ github.ref }}-labels
      cancel-in-progress: false
    steps:
      - name: POST to Merge Freeze – add PR to unblocked list
        env:
          MERGEFREEZE_ACCESS_TOKEN: ${{ secrets.MERGEFREEZE_ACCESS_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          USER_NAME: ${{ github.actor }}
        run: |
          set -e
          if [ -z "$MERGEFREEZE_ACCESS_TOKEN" ]; then
            echo "::error::MERGEFREEZE_ACCESS_TOKEN secret is not set"
            exit 1
          fi
          url="https://www.mergefreeze.com/api/branches/actualbudget/actual/master/?access_token=${MERGEFREEZE_ACCESS_TOKEN}"
          payload=$(jq -n --arg user_name "$USER_NAME" --argjson pr "$PR_NUMBER" '{frozen: true, user_name: $user_name, unblocked_prs: [$pr]}')
          curl -sf -X POST "$url" -H "Content-Type: application/json" -d "$payload"
          echo "Merge Freeze updated: PR #$PR_NUMBER added to unblocked list."