name: Publish

# Manual, environment-gated publication of one dataset to Dataverse.
# The token is a protected-environment secret; never expose it to fork PRs.
on:
  workflow_dispatch:
    inputs:
      dataset_id:
        description: Dataset id (matches catalog/datasets/<id>.yaml)
        required: true
      collection:
        description: Dataverse collection alias
        required: true
      contact_email:
        description: Dataset contact email
        required: true

permissions:
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: dataverse-publish  # require manual approval on this protected environment
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.11"
      - run: |
          python -m pip install --upgrade pip
          pip install -e ".[nirs4all]"
      - name: Governance gate (public/embargo datasets must be publishable)
        run: python catalog/scripts/validate.py --check-publish
      - name: Publish
        env:
          NIRS4ALL_DATAVERSE_TOKEN: ${{ secrets.DATAVERSE_TOKEN }}
        run: |
          python -m nirs4all_datasets.cli publish "${{ inputs.dataset_id }}" \
            --collection "${{ inputs.collection }}" \
            --contact-email "${{ inputs.contact_email }}" \
            --root .
