## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## AI-Assisted

## Composite action: bootstrap a CI runner with genmkfile + (optional)
## helper-scripts in one step. Inserts into any job's steps list:
##
##   - uses: actions/checkout@<sha>
##   - uses: org-ai-assisted/developer-meta-files/.github/actions/install-deps@master
##     with:
##       apt-packages: 'safe-rm moreutils'
##       install-self: 'true'
##
## Reusable workflows (workflow_call) become their own job and cannot
## be inserted as a step inside another job; composite actions can.
## That is the right shape for this bootstrap.

name: 'Install genmkfile + helper-scripts'
description: 'Install Kicksecure/genmkfile (or mirror) and optionally helper-scripts via genmkfile, then optionally genmkfile install the caller repo.'

inputs:
  apt-packages:
    description: 'Space-separated apt packages to install before genmkfile. Empty string = no apt step.'
    required: false
    default: ''
  install-helper-scripts:
    description: 'After genmkfile, install helper-scripts via genmkfile install.'
    required: false
    default: 'true'
  install-self:
    description: 'Run sudo genmkfile in the caller repo checkout (i.e. install the caller package). Mode controlled by install-self-mode.'
    required: false
    default: 'false'
  install-self-mode:
    description: 'genmkfile target to run when install-self=true. "install" = file-copy install (fast, no postinst). "deb-icup" = build .deb + apt-install (production-fidelity, runs postinst).'
    required: false
    default: 'install'
  helper-scripts-owner:
    description: 'GitHub org to clone helper-scripts from. Default: github.repository_owner (org-aware mirror clone). Set to Kicksecure to pin to canonical upstream.'
    required: false
    default: ''
  genmkfile-owner:
    description: 'GitHub org to clone genmkfile from. Default: github.repository_owner. Set to Kicksecure to pin to canonical upstream.'
    required: false
    default: ''

runs:
  using: composite
  steps:
    - name: Install apt pre-reqs
      if: ${{ inputs.apt-packages != '' }}
      shell: bash
      env:
        ## Route the caller input through env rather than inlining
        ## ${{ inputs.apt-packages }} into the script. Template
        ## substitution happens before bash parses the script, so an
        ## inlined value would be reinterpreted as shell syntax
        ## (';', '|', '$()' all parse-time-special). Routing through
        ## env defers expansion to runtime where those characters are
        ## just data.
        APT_PACKAGES: ${{ inputs.apt-packages }}
      run: |
        ## Context-aware sudo: works both in a root container
        ## (debian:trixie etc., no sudo wrapper) and on a non-root
        ## host runner (ubuntu-latest, sudo NOPASSWD). The trailing
        ## '--' inside the array terminates sudo's option parsing,
        ## so a future edit that prepends an attacker-influenced
        ## value before the command cannot smuggle a sudo flag.
        sudo_prefix=()
        if [ "$(id -u)" -ne 0 ]; then
          sudo_prefix=(sudo --non-interactive --)
        fi
        export DEBIAN_FRONTEND=noninteractive
        "${sudo_prefix[@]}" apt-get update
        ## Split the space-separated env-string into an array using
        ## the default $IFS (space/tab/newline), then expand with
        ## "${apt_packages[@]}" so each element is a separately
        ## quoted argument. Avoids the unquoted-expansion footguns
        ## (glob expansion against the cwd; one extra space becomes
        ## one extra empty arg under some shells). Empty-input case
        ## is guarded by the step-level 'if:' above, so the array is
        ## always non-empty here.
        apt_packages=()
        read -r -a apt_packages <<< "$APT_PACKAGES"
        "${sudo_prefix[@]}" apt-get install --yes --no-install-recommends -- "${apt_packages[@]}"

    - name: Install genmkfile
      shell: bash
      env:
        GENMKFILE_OWNER: ${{ inputs.genmkfile-owner != '' && inputs.genmkfile-owner || github.repository_owner }}
      ## $GITHUB_ACTION_PATH (shell env, runtime-resolved) instead of
      ## ${{ github.action_path }} (template, expanded before the
      ## shell runs). When the caller job uses 'container:', the
      ## template expands to the host path which the container
      ## cannot see; the env var resolves to the container-mapped
      ## path correctly.
      run: "$GITHUB_ACTION_PATH/install-genmkfile.sh"

    - name: Install helper-scripts
      if: ${{ inputs.install-helper-scripts == 'true' }}
      shell: bash
      env:
        HELPER_SCRIPTS_OWNER: ${{ inputs.helper-scripts-owner != '' && inputs.helper-scripts-owner || github.repository_owner }}
      run: "$GITHUB_ACTION_PATH/install-helper-scripts.sh"

    - name: Install caller repo via genmkfile
      if: ${{ inputs.install-self == 'true' }}
      shell: bash
      env:
        INSTALL_SELF_MODE: ${{ inputs.install-self-mode }}
      run: "$GITHUB_ACTION_PATH/install-self.sh"
