plex-playlist/.gitea/workflows/cicd-start.yaml

name: CICD Start

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]
  workflow_dispatch:

env:
  GITEA_SSH_HOST: kankali.darkhelm.lan
  GITEA_SSH_PORT: "2222"
  GITEA_REPO_SSH_URL: ssh://git@kankali.darkhelm.lan:2222/DarkHelm.org/plex-playlist.git
  GITEA_REGISTRY: kankali.darkhelm.lan:3001
  GITEA_REGISTRY_IP: 10.18.75.2
  GITEA_REGISTRY_HOST: kankali.darkhelm.lan

concurrency:
  group: start-${{ github.ref }}
  cancel-in-progress: true

jobs:
  sanity-and-routing:
    name: Sanity and Base Decision
    # Keep startup lightweight to avoid runner image setup stalls.
    runs-on: ubuntu-latest
    outputs:
      base_needed: ${{ steps.base-decision.outputs.base_needed }}
      head_sha: ${{ steps.base-decision.outputs.head_sha }}
      base_hash: ${{ steps.base-decision.outputs.base_hash }}

    steps:
      - name: Audit trigger context
        env:
          EVENT_NAME: ${{ github.event_name }}
          REPOSITORY: ${{ github.repository }}
          ACTOR: ${{ github.actor }}
          REF: ${{ github.ref }}
          REF_NAME: ${{ github.ref_name }}
          HEAD_REF: ${{ github.head_ref }}
          SHA: ${{ github.sha }}
        run: |
          echo "=== Dispatch Audit: CICD Start ==="
          echo "event_name=${EVENT_NAME}"
          echo "repository=${REPOSITORY}"
          echo "actor=${ACTOR}"
          echo "ref=${REF}"
          echo "ref_name=${REF_NAME}"
          echo "head_ref=${HEAD_REF}"
          echo "sha=${SHA}"

      - name: Configure registry host resolution
        run: |
          if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
            echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
          fi

      - name: Compute routing signal
        id: base-decision
        run: |
          set -e

          # Keep this workflow container-agnostic: do not rely on checkout/actions/node.
          # docker-build-base handles canonical base hash/existence checks.
          echo "head_sha=${GITHUB_SHA}" >> "${GITHUB_OUTPUT}"
          echo "base_hash=deferred" >> "${GITHUB_OUTPUT}"
          echo "base_needed=true" >> "${GITHUB_OUTPUT}"

          echo "Routing via docker-build-base.yaml"
          echo "Base hash delegated to Docker Build Base workflow"

      - name: Dispatch downstream workflow
        if: steps.base-decision.outcome == 'success' && steps.base-decision.outputs.head_sha != '' && steps.base-decision.outputs.base_needed != ''
        env:
          ACTIONS_TRIGGER_TOKEN: ${{ secrets.ACTIONS_TRIGGER_TOKEN }}
          PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
          BASE_NEEDED: ${{ steps.base-decision.outputs.base_needed }}
          HEAD_SHA: ${{ steps.base-decision.outputs.head_sha }}
          BASE_HASH: ${{ steps.base-decision.outputs.base_hash }}
          REPO_FULL: ${{ github.repository }}
          HEAD_REF: ${{ github.head_ref }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          set -e

          DISPATCH_TOKEN="${ACTIONS_TRIGGER_TOKEN:-${PACKAGE_ACCESS_TOKEN:-}}"

          if [ -z "${DISPATCH_TOKEN}" ]; then
            echo "❌ Missing dispatch token. Set ACTIONS_TRIGGER_TOKEN (repo write scope) or ensure PACKAGE_ACCESS_TOKEN has Actions workflow-dispatch permissions."
            exit 1
          fi

          REPO_OWNER="${REPO_FULL%/*}"
          REPO_NAME="${REPO_FULL#*/}"
          TARGET_REF="${HEAD_REF:-${REF_NAME}}"

          if [ "${BASE_NEEDED}" = "true" ]; then
            TARGET_WORKFLOW="docker-build-base.yaml"
          else
            TARGET_WORKFLOW="docker-build-main.yaml"
          fi

          payload=$(cat <<EOF
          {
            "ref": "${TARGET_REF}",
            "inputs": {
              "head_sha": "${HEAD_SHA}",
              "base_hash": "${BASE_HASH}",
              "source_workflow": "CICD Start",
              "base_needed": "${BASE_NEEDED}"
            }
          }
          EOF
          )

          CANDIDATE_API_BASES=()
          if [ -n "${GITHUB_SERVER_URL:-}" ]; then
            CANDIDATE_API_BASES+=("${GITHUB_SERVER_URL%/}/api/v1")
          fi
          if [ -n "${GITEA_SSH_HOST:-}" ]; then
            CANDIDATE_API_BASES+=("http://${GITEA_SSH_HOST}:3001/api/v1")
          fi
          if [ -n "${GITEA_REGISTRY_HOST:-}" ]; then
            CANDIDATE_API_BASES+=("http://${GITEA_REGISTRY_HOST}:3001/api/v1")
          fi
          if [ -n "${GITEA_REGISTRY_IP:-}" ]; then
            CANDIDATE_API_BASES+=("http://${GITEA_REGISTRY_IP}:3001/api/v1")
          fi

          ensure_curl() {
            if command -v curl >/dev/null 2>&1; then
              return 0
            fi

            if command -v apt-get >/dev/null 2>&1; then
              export DEBIAN_FRONTEND=noninteractive
              apt-get update -qq
              apt-get install -y -qq curl ca-certificates
            fi

            if command -v curl >/dev/null 2>&1; then
              return 0
            fi

            echo "❌ curl is required for dispatch and could not be installed"
            return 1
          }

          ensure_curl

          dispatched=false
          for API_BASE in "${CANDIDATE_API_BASES[@]}"; do
            DISPATCH_URL="${API_BASE}/repos/${REPO_OWNER}/${REPO_NAME}/actions/workflows/${TARGET_WORKFLOW}/dispatches"

            RESPONSE_FILE="/tmp/dispatch-response.txt"
            : > "${RESPONSE_FILE}"

            HTTP_CODE=$(curl -sS --connect-timeout 5 --max-time 20 -o "${RESPONSE_FILE}" -w "%{http_code}" -X POST \
              -H "Authorization: token ${DISPATCH_TOKEN}" \
              -H "Content-Type: application/json" \
              -H "User-Agent: plex-playlist-cicd-start" \
              "${DISPATCH_URL}" \
              -d "${payload}" || true)

            if [[ "${HTTP_CODE}" =~ ^[0-9]+$ ]] && [ "${HTTP_CODE}" -ge 200 ] && [ "${HTTP_CODE}" -lt 300 ]; then
              echo "✓ Dispatch succeeded via ${API_BASE}"
              dispatched=true
              break
            fi

            echo "Dispatch attempt failed via ${API_BASE} (HTTP ${HTTP_CODE})"
            if [ -s "${RESPONSE_FILE}" ]; then
              echo "Response body:"
              cat "${RESPONSE_FILE}"
            fi
          done

          if [ "${dispatched}" != "true" ]; then
            echo "❌ Dispatch failed on all candidate API endpoints"
            exit 1
          fi