---
## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## AI-Assisted

## Manual-trigger live-API policy check. Runs `dm-github-policy
## --audit` followed by `dm-github-policy --dry-run` against the real
## GitHub REST API using the GHORG_AUDIT_TOKEN repo secret (a
## fine-grained PAT scoped read-only to org-ai-assisted). No writes;
## no fork CI; only fires when an authorized user clicks "Run
## workflow" from the Actions tab.
##
## --audit prints the current org state. --dry-run prints the
## PATCH/PUT/POST calls it WOULD make (prefixed "DRY-RUN:") but
## never actually mutates anything; both are GET-only on the live
## API and are safe with a read-only PAT. If --audit fails, --dry-run
## does not run (default GitHub Actions step ordering).
##
## To enable:
##   1. Mint a fine-grained PAT under the user that owns
##      org-ai-assisted access (read-only on Repository:
##      Administration/Contents/Metadata/Webhooks and Organization:
##      Administration/Members/Webhooks).
##   2. Settings -> Secrets and variables -> Actions -> New repository
##      secret named GHORG_AUDIT_TOKEN.
##   3. Actions tab -> "github-org tools (live policy check)"
##      workflow -> Run workflow.
##
## To revoke: delete the secret in the same UI, or revoke the PAT in
## the user's Developer settings.

name: github-org tools (live policy check)

on:
  workflow_dispatch:

## Upstream-only gate. The literal "Kicksecure/developer-meta-files"
## in the job-level `if:` below prevents forks (and the
## org-ai-assisted mirror) from running this workflow's upstream-only
## paths - the upstream-only secret(s) referenced below (vault
## password / Coverity token / GHORG_AUDIT_TOKEN) are only set on the
## canonical repo. A fork would either see those secrets as empty and
## fail mid-flight, or - worse - run the heavy ops with its own
## arbitrary-named secret.
##
## The canonical owner/repo is inlined in the `if:` rather than
## hoisted to a workflow-level `env:` constant because GitHub Actions
## does not expose the `env` context in job-level `if:` expressions
## (only `github`, `inputs`, `needs`, and `vars` are available there).

## Read-only on the checked-out source. Neither --audit nor --dry-run
## touches the repository content; both only call the GitHub REST API.
permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  live-policy-check:
    name: dm-github-policy --audit + --dry-run (live)
    runs-on: ubuntu-latest
    timeout-minutes: 20
    container:
      image: debian:trixie

    ## Skip on forks so a fork's workflow can never use the upstream
    ## secret (GitHub also blocks this by default for forked PRs, but
    ## the explicit guard documents intent).
    if: ${{ github.repository == 'Kicksecure/developer-meta-files' }}

    steps:
      - name: Checkout developer-meta-files
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
        with:
          persist-credentials: false

      - name: Install genmkfile + helper-scripts + self
        uses: ./.github/actions/install-deps
        with:
          apt-packages: ca-certificates curl jq git sudo build-essential dctrl-tools python3 safe-rm
          install-self: 'true'

      - name: Verify token secret is set
        env:
          TOKEN_PRESENT: ${{ secrets.GHORG_AUDIT_TOKEN != '' }}
        run: ./ci/policy-live-verify-token.sh

      - name: Run dm-github-policy --audit (live)
        env:
          GITHUB_TOKEN: ${{ secrets.GHORG_AUDIT_TOKEN }}
        run: dm-github-policy --audit

      - name: Run dm-github-policy --dry-run (live)
        env:
          GITHUB_TOKEN: ${{ secrets.GHORG_AUDIT_TOKEN }}
        run: dm-github-policy --dry-run

      - name: Emit step summary
        if: always()
        ## Minimal panel surfacing pass/fail. The audit / dry-run
        ## findings themselves stay in the step logs; this is a
        ## headline indicator for the Actions tab. Template values
        ## routed through env: per #87 to avoid CodeQL flagging.
        env:
          JOB_STATUS: ${{ job.status }}
        run: |
          ./ci/step-summary-emit.sh \
            --tool 'github-org tools (live policy check)' \
            --column-header field \
            --row "outcome=${JOB_STATUS}" \
            --row "modes=audit + dry-run"
