name: Yank a public release
on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag to retract from the public repo (e.g. v0.10.0)'
        required: true

permissions:
  contents: read

jobs:
  yank:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - name: Validate the tag format
        env:
          TAG: ${{ inputs.tag }}
        run: |
          echo "$TAG" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$' \
            || { echo "refusing to yank an unrecognised tag: $TAG" >&2; exit 1; }
      - name: Checkout public repo
        uses: actions/checkout@v5
        with:
          repository: ${{ vars.PUBLIC_REPO_SLUG }}
          token: ${{ secrets.PUBLIC_REPO_TOKEN }}
          fetch-depth: 0
          path: pub
      - name: Delete the tag on the public repo
        env:
          TAG: ${{ inputs.tag }}
        run: |
          git -C pub push origin --delete "refs/tags/${TAG}"