name: Refresh Cloudflare IP ranges
on:
  schedule:
    - cron: "0 3 * * *"   # daily 03:00 UTC
  workflow_dispatch:
jobs:
  update:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - name: Fetch official ranges
        run: |
          curl -s --max-time 30 https://www.cloudflare.com/ips-v4 -o data/cf-ips.txt
          python3 - <<'EOF'
          import json, datetime
          ranges = [l.strip() for l in open('data/cf-ips.txt') if l.strip()]
          assert ranges, "empty ranges!"
          json.dump({"updated": datetime.date.today().isoformat(), "ranges": ranges,
                     "note": "Official Cloudflare IPv4 ranges — https://www.cloudflare.com/ips-v4"},
                    open('data/cf-ips.json', 'w'), indent=1)
          print(len(ranges), "ranges")
          EOF
      - name: Commit if changed
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add data/cf-ips.txt data/cf-ips.json
          git diff --cached --quiet || git commit -m "chore: refresh Cloudflare IP ranges"
          git push