plex-playlist/.gitea/workflows/cicd-start.yaml

name: CICD Start

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]
  workflow_dispatch:

env:
  GITEA_SSH_HOST: kankali.darkhelm.lan
  GITEA_SSH_PORT: "2222"
  GITEA_REPO_SSH_URL: ssh://git@kankali.darkhelm.lan:2222/DarkHelm.org/plex-playlist.git
  GITEA_REGISTRY: kankali.darkhelm.lan:3001
  GITEA_REGISTRY_IP: 10.18.75.2
  GITEA_REGISTRY_HOST: kankali.darkhelm.lan

concurrency:
  group: start-${{ github.ref }}
  cancel-in-progress: true

jobs:
  sanity-and-routing:
    name: Sanity and Base Decision
    # Keep startup lightweight to avoid runner image setup stalls.
    runs-on: ubuntu-latest
    outputs:
      base_needed: ${{ steps.base-decision.outputs.base_needed }}
      head_sha: ${{ steps.base-decision.outputs.head_sha }}
      base_hash: ${{ steps.base-decision.outputs.base_hash }}

    steps:
      - name: Audit trigger context
        env:
          EVENT_NAME: ${{ github.event_name }}
          REPOSITORY: ${{ github.repository }}
          ACTOR: ${{ github.actor }}
          REF: ${{ github.ref }}
          REF_NAME: ${{ github.ref_name }}
          HEAD_REF: ${{ github.head_ref }}
          SHA: ${{ github.sha }}
        run: |
          echo "=== Dispatch Audit: CICD Start ==="
          echo "event_name=${EVENT_NAME}"
          echo "repository=${REPOSITORY}"
          echo "actor=${ACTOR}"
          echo "ref=${REF}"
          echo "ref_name=${REF_NAME}"
          echo "head_ref=${HEAD_REF}"
          echo "sha=${SHA}"

      - name: Configure registry host resolution
        run: |
          if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
            echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
          fi

      - name: Compute routing signal
        id: base-decision
        run: |
          set -e

          # Keep this workflow container-agnostic: do not rely on checkout/actions/node.
          # docker-build-base handles canonical base hash/existence checks.
          echo "head_sha=${GITHUB_SHA}" >> "${GITHUB_OUTPUT}"
          echo "base_hash=deferred" >> "${GITHUB_OUTPUT}"
          echo "base_needed=true" >> "${GITHUB_OUTPUT}"

          echo "Routing via docker-build-base.yaml"
          echo "Base hash delegated to Docker Build Base workflow"

      - name: Dispatch downstream workflow
        if: steps.base-decision.outcome == 'success' && steps.base-decision.outputs.head_sha != '' && steps.base-decision.outputs.base_needed != ''
        env:
          ACTIONS_TRIGGER_TOKEN: ${{ secrets.ACTIONS_TRIGGER_TOKEN }}
          PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
          BASE_NEEDED: ${{ steps.base-decision.outputs.base_needed }}
          HEAD_SHA: ${{ steps.base-decision.outputs.head_sha }}
          BASE_HASH: ${{ steps.base-decision.outputs.base_hash }}
          REPO_FULL: ${{ github.repository }}
          HEAD_REF: ${{ github.head_ref }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          set -e

          DISPATCH_TOKEN="${ACTIONS_TRIGGER_TOKEN:-${PACKAGE_ACCESS_TOKEN:-}}"

          if [ -z "${DISPATCH_TOKEN}" ]; then
            echo "❌ Missing dispatch token. Set ACTIONS_TRIGGER_TOKEN (repo write scope) or ensure PACKAGE_ACCESS_TOKEN has Actions workflow-dispatch permissions."
            exit 1
          fi

          REPO_OWNER="${REPO_FULL%/*}"
          REPO_NAME="${REPO_FULL#*/}"
          TARGET_REF="${HEAD_REF:-${REF_NAME}}"

          if [ "${BASE_NEEDED}" = "true" ]; then
            TARGET_WORKFLOW="docker-build-base.yaml"
          else
            TARGET_WORKFLOW="docker-build-main.yaml"
          fi

          payload=$(cat <<EOF
          {
            "ref": "${TARGET_REF}",
            "inputs": {
              "head_sha": "${HEAD_SHA}",
              "base_hash": "${BASE_HASH}",
              "source_workflow": "CICD Start",
              "base_needed": "${BASE_NEEDED}"
            }
          }
          EOF
          )

          CANDIDATE_API_BASES=()
          if [ -n "${GITHUB_SERVER_URL:-}" ]; then
            CANDIDATE_API_BASES+=("${GITHUB_SERVER_URL%/}/api/v1")
          fi
          if [ -n "${GITEA_SSH_HOST:-}" ]; then
            CANDIDATE_API_BASES+=("http://${GITEA_SSH_HOST}:3001/api/v1")
          fi
          if [ -n "${GITEA_REGISTRY_HOST:-}" ]; then
            CANDIDATE_API_BASES+=("http://${GITEA_REGISTRY_HOST}:3001/api/v1")
          fi
          if [ -n "${GITEA_REGISTRY_IP:-}" ]; then
            CANDIDATE_API_BASES+=("http://${GITEA_REGISTRY_IP}:3001/api/v1")
          fi

          dispatched=false
          for API_BASE in "${CANDIDATE_API_BASES[@]}"; do
            DISPATCH_URL="${API_BASE}/repos/${REPO_OWNER}/${REPO_NAME}/actions/workflows/${TARGET_WORKFLOW}/dispatches"

            HTTP_RESULT=$(
              printf '%s\n' \
                'import os' \
                'import sys' \
                'import urllib.error' \
                'import urllib.request' \
                '' \
                'url = os.environ["DISPATCH_URL"]' \
                'token = os.environ["DISPATCH_TOKEN"]' \
                'payload = os.environ["DISPATCH_PAYLOAD"]' \
                '' \
                'request = urllib.request.Request(' \
                '    url,' \
                '    data=payload.encode("utf-8"),' \
                '    headers={' \
                '        "Authorization": "token " + token,' \
                '        "Content-Type": "application/json" ,' \
                '        "User-Agent": "plex-playlist-cicd-start" ,' \
                '    },' \
                '    method="POST",' \
                ')' \
                '' \
                'try:' \
                '    with urllib.request.urlopen(request, timeout=20) as response:' \
                '        sys.stdout.write(f"{response.status}\\n")' \
                '        body = response.read().decode("utf-8", "replace")' \
                '        if body:' \
                '            sys.stdout.write(body)' \
                'except urllib.error.HTTPError as error:' \
                '    sys.stdout.write(f"{error.code}\\n")' \
                '    body = error.read().decode("utf-8", "replace")' \
                '    if body:' \
                '        sys.stdout.write(body)' \
                'except Exception as error:' \
                '    sys.stdout.write(f"000\\n{error}\\n")' \
              | DISPATCH_URL="${DISPATCH_URL}" \
                DISPATCH_TOKEN="${DISPATCH_TOKEN}" \
                DISPATCH_PAYLOAD="${payload}" \
                python3 -
            )

            HTTP_CODE=$(printf '%s\n' "${HTTP_RESULT}" | sed -n '1p')
            RESPONSE_BODY=$(printf '%s\n' "${HTTP_RESULT}" | sed '1d')

            if [ "${HTTP_CODE}" -ge 200 ] && [ "${HTTP_CODE}" -lt 300 ]; then
              echo "✓ Dispatch succeeded via ${API_BASE}"
              dispatched=true
              break
            fi

            echo "Dispatch attempt failed via ${API_BASE} (HTTP ${HTTP_CODE})"
            if [ -n "${RESPONSE_BODY}" ]; then
              echo "Response body:"
              printf '%s\n' "${RESPONSE_BODY}"
            fi
          done

          if [ "${dispatched}" != "true" ]; then
            echo "❌ Dispatch failed on all candidate API endpoints"
            exit 1
          fi