---
## Sidebar UI ordering: GitHub sorts the Actions tab alphabetically
## by 'name:'. The '00 ' prefix forces this workflow to the top of
## the list because it is the canonical release pipeline; operators
## should see its status first.
name: 00 Run automated builder

on:
  pull_request:
    branches: [master]
  ## Branch-push triggers intentionally omitted: a tag-bearing commit
  ## landing on master would otherwise fire this workflow twice. Tag
  ## pushes are the canonical release trigger.
  push:
    tags:
      - '*'
  workflow_dispatch:

## Upstream-only gate: build:if uses a literal repo string (not env)
## because GitHub Actions does not expose env in job-level if:.
## Required secrets (vault password, etc.) only exist on the canonical
## repo, so forks must skip the heavy paths.
##
## See agents/github-actions-security.md.

permissions:
  contents: read

## Per-ref cancellation (see agents/github-actions.md G-A-006).
## github.ref is unique per PR and per tag, so each PR-N and each
## tag has its own concurrency group:
##   PR  -> refs/pull/N/merge   (one group per PR)
##   tag -> refs/tags/<tag>     (one group per tag)
## A new push on a PR cancels only that PR's in-flight run; a tag
## push cannot cancel any PR (different ref => different group);
## different PRs never cross-cancel.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  ## Dry-run smoke must pass before the heavy automated builder
  ## kicks off. Calls dry-run.yml as a reusable workflow
  ## (on: workflow_call) so dry-run + build run as ONE Actions UI
  ## record - one workflow_run with two job nodes - rather than two
  ## independent workflows whose success states could diverge.
  ## See agents/github-actions-security.md (workflow_call section)
  ## for why we prefer 'uses: ./...' over an event-driven
  ## workflow_run trigger here.
  dry-run:
    uses: ./.github/workflows/local-build-dry-run.yml
    ## The reusable workflow only needs contents: read. Pass it
    ## explicitly so a future tightening of the parent's
    ## workflow-level permissions block does not silently strip the
    ## permission the called workflow expects.
    permissions:
      contents: read

  build:
    needs: dry-run
    if: github.repository == 'Whonix/derivative-maker'
    runs-on: ubuntu-latest
    timeout-minutes: 240
    ## ANSIBLE_VAULT_PASSWORD lives in step-level env on the
    ## three steps that consume it (Run automated builder, Handle
    ## artifacts, Teardown build) - not here at job level. Keeping
    ## it off the job env removes it from the environment of the
    ## Checkout / Install ansible / Upload artifacts steps that
    ## don't need it. Matches the step-level pattern coverity's
    ## reusable adopted for COVERITY_TOKEN / COVERITY_EMAIL after
    ## its canonical-repos refactor (see
    ## developer-meta-files/agents/github-actions-consumer-templates.md
    ## "Coverity canonical-repos gate placement").
    env:
      GIT_REPO: ${{ github.repository }}
      REF_NAME: ${{ github.ref_name }}
      REF_TYPE: ${{ github.ref_type }}
      GITHUB_EVENT_NAME: ${{ github.event_name }}
    steps:
      - name: Checkout repository (with submodules)
        ## submodules: recursive so help-steps/pre's xtrace.bsh and
        ## the rest of packages/kicksecure/helper-scripts/ are on
        ## disk; fetch-depth: 0 so the helper-scripts submodule's
        ## pinned SHA is reachable.
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
        with:
          submodules: recursive
          fetch-depth: 0
          persist-credentials: false

      - name: Install ansible
        run: |
          sudo --non-interactive apt-get update --error-on=any
          sudo --non-interactive apt-get install --yes --no-install-recommends \
            ansible

      - name: Run automated builder
        env:
          ANSIBLE_VAULT_PASSWORD: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
        run: |
          ./automated_builder/scripts/run_automated_builder.sh "$ANSIBLE_VAULT_PASSWORD"

      - name: Handle artifacts
        if: always()
        env:
          ANSIBLE_VAULT_PASSWORD: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
        run: |
          ./automated_builder/scripts/handle_artifacts.sh "$ANSIBLE_VAULT_PASSWORD"

      - name: Upload artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
        if: always()
        with:
          name: logs
          path: ./automated_builder/logs/

      - name: Teardown build
        if: always()
        env:
          ANSIBLE_VAULT_PASSWORD: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
        run: |
          ./automated_builder/scripts/teardown_build.sh "$ANSIBLE_VAULT_PASSWORD"

      - name: Reclaim workspace ownership
        if: always()
        ## The automated builder runs ansible playbooks that invoke
        ## sudo / mmdebstrap / chroot, leaving root-owned files in
        ## $GITHUB_WORKSPACE. The host runner can no longer mkdir
        ## into the workspace (e.g. for actions/checkout below)
        ## until ownership is restored. Same fix as the 'dry-run'
        ## job in local-build-dry-run.yml. Passwordless sudo is
        ## available on ubuntu-latest hosted runners.
        run: sudo chown -R "$(id -u):$(id -g)" "${GITHUB_WORKSPACE}"

      - name: Checkout developer-meta-files (summary script)
        if: always()
        ## Needed for ci/step-summary-emit.sh. derivative-maker
        ## does not vendor a copy; checkout @master keeps the org's
        ## single source of truth. Pinned SHA matches the existing
        ## actions/checkout in this file. Checked out into .dmf
        ## (sibling of the recursive workspace, not inside any
        ## submodule path).
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
        with:
          repository: org-ai-assisted/developer-meta-files
          ref: master
          path: .dmf
          persist-credentials: false

      - name: Emit step summary
        if: always()
        ## Headline panel for the Actions tab. The dry-run job has
        ## its own panel (local-build-dry-run.yml); this one covers
        ## the heavy build job. Template values through env: per
        ## developer-meta-files#87.
        env:
          JOB_STATUS: ${{ job.status }}
        run: |
          ./.dmf/ci/step-summary-emit.sh \
            --tool 'Automated builder' \
            --column-header field \
            --row "outcome=${JOB_STATUS}" \
            --row "ref-type=${REF_TYPE}" \
            --row "ref-name=${REF_NAME}"
