name: F6.1 fix runtime dependencies

on:
  push:
    branches:
      - 'release/f6-1-presentation-ready'
    paths:
      - '.github/workflows/f6-1-fix-runtime-deps.yml'

permissions:
  contents: write

jobs:
  fix:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: release/f6-1-presentation-ready
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with:
          node-version: '24'

      - name: Pin patched runtime dependency resolutions
        run: |
          set -Eeuo pipefail

          cd api-v3
          npm pkg set overrides.multer=2.3.0 overrides.qs=6.16.0
          npm install --package-lock-only --ignore-scripts
          npm audit --omit=dev --audit-level=high
          cd ..

          cd web-v2
          npm pkg set dependencies.maplibre-gl=6.4.1
          npm install --package-lock-only --ignore-scripts
          npm audit --omit=dev --audit-level=high
          cd ..

      - name: Verify resolved patched versions
        run: |
          set -Eeuo pipefail
          grep -Fq '"multer": "2.3.0"' api-v3/package-lock.json
          grep -Fq '"qs": "6.16.0"' api-v3/package-lock.json
          grep -Fq '"maplibre-gl": "6.4.1"' web-v2/package.json
          grep -Fq '"node_modules/maplibre-gl"' web-v2/package-lock.json
          grep -Fq '"version": "6.4.1"' web-v2/package-lock.json

      - name: Commit patched dependency locks
        run: |
          set -Eeuo pipefail
          rm .github/workflows/f6-1-fix-runtime-deps.yml
          git config user.name 'github-actions[bot]'
          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
          git add api-v3/package.json api-v3/package-lock.json web-v2/package.json web-v2/package-lock.json .github/workflows/f6-1-fix-runtime-deps.yml
          git diff --cached --check
          git commit -m 'fix(security): patch runtime dependency advisories'
          git push origin HEAD:release/f6-1-presentation-ready