name: Newdrop Publish
description: Publish CHANGELOG.md to Newdrop What’s New via write API
author: Newdrop
inputs:
  api_key:
    description: Newdrop write API key (ndw_…)
    required: true
  file:
    description: Markdown file to publish
    required: false
    default: CHANGELOG.md
  draft:
    description: If true, create drafts only
    required: false
    default: "false"
  api_url:
    description: Newdrop HTTPS origin (cleartext fails closed to https://getnewdrop.com)
    required: false
    default: https://getnewdrop.com
runs:
  using: composite
  steps:
    - name: Publish to Newdrop
      shell: bash
      env:
        NEWDROP_WRITE_KEY: ${{ inputs.api_key }}
        NEWDROP_API_URL_RAW: ${{ inputs.api_url }}
      run: |
        set -euo pipefail
        # HTTPS-only origin — cleartext api_url must not fetch CLI over http:// (parity CLI #259).
        MARKETING_HTTPS_FALLBACK="https://getnewdrop.com"
        raw="${NEWDROP_API_URL_RAW:-}"
        raw="$(printf '%s' "$raw" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//;s|/*$||')"
        if [ -z "$raw" ]; then
          NEWDROP_API_URL="$MARKETING_HTTPS_FALLBACK"
        else
          case "$raw" in
            https://*|HTTPS://*)
              # origin only (scheme + host[:port])
              NEWDROP_API_URL="$(printf '%s' "$raw" | sed -E 's#^(https://[^/]+).*#\1#I')"
              ;;
            *)
              NEWDROP_API_URL="$MARKETING_HTTPS_FALLBACK"
              ;;
          esac
        fi
        export NEWDROP_API_URL
        curl -fsSL "${NEWDROP_API_URL}/cli/newdrop.mjs" -o /tmp/newdrop.mjs
        if [ "${{ inputs.draft }}" = "true" ]; then
          node /tmp/newdrop.mjs publish "${{ inputs.file }}" --draft
        else
          node /tmp/newdrop.mjs publish "${{ inputs.file }}"
        fi