name: F6.1 fix runtime dependencies

on:
  push:
    branches:
      - 'release/f6-1-presentation-ready'
    paths:
      - '.github/workflows/f6-1-fix-runtime-deps.yml'

permissions:
  contents: write

jobs:
  fix:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: release/f6-1-presentation-ready
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with:
          node-version: '24'

      - name: Pin patched runtime dependency resolutions
        run: |
          set -Eeuo pipefail

          cd api-v3
          npm pkg set overrides.multer=2.3.0 overrides.qs=6.16.0
          npm install --package-lock-only --ignore-scripts
          npm audit --omit=dev --audit-level=high
          cd ..

          cd web-v2
          npm pkg set dependencies.maplibre-gl=6.4.1
          npm install --package-lock-only --ignore-scripts
          npm audit --omit=dev --audit-level=high
          cd ..

      - name: Verify resolved patched versions
        run: |
          set -Eeuo pipefail
          node <<'NODE'
          const api = require('./api-v3/package-lock.json');
          const web = require('./web-v2/package-lock.json');
          const apiPackages = api.packages ?? {};
          const webPackages = web.packages ?? {};

          const versions = (packages, dependency) => Object.entries(packages)
            .filter(([path]) => path.endsWith(`node_modules/${dependency}`))
            .map(([, metadata]) => metadata.version);

          const assertOnly = (dependency, actual, expected) => {
            if (actual.length === 0 || actual.some((version) => version !== expected)) {
              throw new Error(`${dependency}: expected only ${expected}, got ${JSON.stringify(actual)}`);
            }
            console.log(`${dependency}: ${actual.join(', ')}`);
          };

          assertOnly('multer', versions(apiPackages, 'multer'), '2.3.0');
          assertOnly('qs', versions(apiPackages, 'qs'), '6.16.0');
          assertOnly('maplibre-gl', versions(webPackages, 'maplibre-gl'), '6.4.1');

          const webManifest = require('./web-v2/package.json');
          if (webManifest.dependencies?.['maplibre-gl'] !== '6.4.1') {
            throw new Error(`maplibre-gl manifest is ${webManifest.dependencies?.['maplibre-gl']}`);
          }
          NODE

      - name: Commit patched dependency locks
        run: |
          set -Eeuo pipefail
          rm .github/workflows/f6-1-fix-runtime-deps.yml
          git config user.name 'github-actions[bot]'
          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
          git add api-v3/package.json api-v3/package-lock.json web-v2/package.json web-v2/package-lock.json .github/workflows/f6-1-fix-runtime-deps.yml
          git diff --cached --check
          git commit -m 'fix(security): patch runtime dependency advisories'
          git push origin HEAD:release/f6-1-presentation-ready