plex-playlist/.gitea/workflows/cicd-start.yaml

name: CICD Start

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]
  workflow_dispatch:
    inputs:
      trace_id:
        description: Correlation id propagated across CICD dispatch chain
        required: false

env:
  GITEA_SSH_HOST: kankali.darkhelm.lan
  GITEA_SSH_PORT: "2222"
  GITEA_REPO_SSH_URL: ssh://git@kankali.darkhelm.lan:2222/DarkHelm.org/plex-playlist.git
  GITEA_REGISTRY: kankali.darkhelm.lan:3001
  GITEA_REGISTRY_IP: 10.18.75.2
  GITEA_REGISTRY_HOST: kankali.darkhelm.lan

concurrency:
  group: start-${{ github.ref }}
  cancel-in-progress: true

jobs:
  sanity-and-routing:
    name: Sanity and Base Decision
    # Keep startup lightweight to avoid runner image setup stalls.
    runs-on: ubuntu-latest
    timeout-minutes: 12
    outputs:
      base_needed: ${{ steps.base-decision.outputs.base_needed }}
      head_sha: ${{ steps.base-decision.outputs.head_sha }}
      base_hash: ${{ steps.base-decision.outputs.base_hash }}

    steps:
      - name: Identify runner
        run: |
          echo "=== Runner Identity ==="
          echo "runner_name=${RUNNER_NAME:-}"
          echo "runner_name_hint=${GITEA_RUNNER_NAME:-${ACT_RUNNER_NAME:-${RUNNER_NAME:-unknown}}}"
          echo "runner_hostname_env=${HOSTNAME:-unknown}"
          echo "runner_uname_n=$(uname -n 2>/dev/null || echo unknown)"
          echo "runner_etc_hostname=$(cat /etc/hostname 2>/dev/null || echo unknown)"
          echo "runner_os=${RUNNER_OS:-unknown}"
          echo "runner_arch=${RUNNER_ARCH:-unknown}"
          echo "timestamp_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)"

      - name: Audit trigger context
        env:
          EVENT_NAME: ${{ github.event_name }}
          REPOSITORY: ${{ github.repository }}
          ACTOR: ${{ github.actor }}
          REF: ${{ github.ref }}
          REF_NAME: ${{ github.ref_name }}
          HEAD_REF: ${{ github.head_ref }}
          SHA: ${{ github.sha }}
          TRACE_ID_INPUT: ${{ github.event.inputs.trace_id }}
        run: |
          TRACE_ID="${TRACE_ID_INPUT:-cicd-start-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-${SHA:0:8}}"
          echo "=== Dispatch Audit: CICD Start ==="
          echo "event_name=${EVENT_NAME}"
          echo "repository=${REPOSITORY}"
          echo "actor=${ACTOR}"
          echo "ref=${REF}"
          echo "ref_name=${REF_NAME}"
          echo "head_ref=${HEAD_REF}"
          echo "sha=${SHA}"
          echo "trace_id=${TRACE_ID}"

      - name: Configure registry host resolution
        run: |
          if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
            echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
          fi

      - name: Compute routing signal
        id: base-decision
        run: |
          set -e

          # Keep this workflow container-agnostic: do not rely on checkout/actions/node.
          # docker-build-base handles canonical base hash/existence checks.
          echo "head_sha=${GITHUB_SHA}" >> "${GITHUB_OUTPUT}"
          echo "base_hash=deferred" >> "${GITHUB_OUTPUT}"
          echo "base_needed=true" >> "${GITHUB_OUTPUT}"

          echo "Routing via docker-build-base.yaml"
          echo "Base hash delegated to Docker Build Base workflow"

      - name: Dispatch downstream workflow
        if: steps.base-decision.outcome == 'success' && steps.base-decision.outputs.head_sha != '' && steps.base-decision.outputs.base_needed != ''
        env:
          ACTIONS_TRIGGER_TOKEN: ${{ secrets.ACTIONS_TRIGGER_TOKEN }}
          PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
          BASE_NEEDED: ${{ steps.base-decision.outputs.base_needed }}
          HEAD_SHA: ${{ steps.base-decision.outputs.head_sha }}
          BASE_HASH: ${{ steps.base-decision.outputs.base_hash }}
          REPO_FULL: ${{ github.repository }}
          HEAD_REF: ${{ github.head_ref }}
          REF_NAME: ${{ github.ref_name }}
          TRACE_ID_INPUT: ${{ github.event.inputs.trace_id }}
        run: |
          set -e

          DISPATCH_TOKEN="${ACTIONS_TRIGGER_TOKEN:-${PACKAGE_ACCESS_TOKEN:-}}"

          if [ -z "${DISPATCH_TOKEN}" ]; then
            echo "❌ Missing dispatch token. Set ACTIONS_TRIGGER_TOKEN (repo write scope) or ensure PACKAGE_ACCESS_TOKEN has Actions workflow-dispatch permissions."
            exit 1
          fi

          REPO_OWNER="${REPO_FULL%/*}"
          REPO_NAME="${REPO_FULL#*/}"
          TARGET_REF="${HEAD_REF:-${REF_NAME}}"
          TRACE_ID="${TRACE_ID_INPUT:-cicd-start-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-${HEAD_SHA:0:8}}"

          echo "trace_id=${TRACE_ID}"
          echo "target_ref=${TARGET_REF}"

          if [ "${BASE_NEEDED}" = "true" ]; then
            TARGET_WORKFLOW="docker-build-base.yaml"
          else
            TARGET_WORKFLOW="docker-build-main.yaml"
          fi

          CANDIDATE_API_BASES=()
          if [ -n "${GITHUB_SERVER_URL:-}" ]; then
            CANDIDATE_API_BASES+=("${GITHUB_SERVER_URL%/}/api/v1")
          fi
          if [ -n "${GITEA_SSH_HOST:-}" ]; then
            CANDIDATE_API_BASES+=("http://${GITEA_SSH_HOST}:3001/api/v1")
          fi
          if [ -n "${GITEA_REGISTRY_HOST:-}" ]; then
            CANDIDATE_API_BASES+=("http://${GITEA_REGISTRY_HOST}:3001/api/v1")
          fi
          if [ -n "${GITEA_REGISTRY_IP:-}" ]; then
            CANDIDATE_API_BASES+=("http://${GITEA_REGISTRY_IP}:3001/api/v1")
          fi

          ensure_curl() {
            if command -v curl >/dev/null 2>&1; then
              return 0
            fi

            if command -v apt-get >/dev/null 2>&1; then
              export DEBIAN_FRONTEND=noninteractive
              apt-get update -qq
              apt-get install -y -qq curl ca-certificates
            fi

            if command -v curl >/dev/null 2>&1; then
              return 0
            fi

            echo "❌ curl is required for dispatch and could not be installed"
            return 1
          }

          ensure_curl

          HELPER_PATH="/tmp/dispatch-workflow.sh"

          fetch_dispatch_helper() {
            local helper_ref="$1"
            local api_base
            for api_base in "${CANDIDATE_API_BASES[@]}"; do
              helper_url="${api_base}/repos/${REPO_OWNER}/${REPO_NAME}/raw/scripts/dispatch-workflow.sh?ref=${helper_ref}"
              if curl -fsS --connect-timeout 5 --max-time 20 \
                -H "Authorization: token ${DISPATCH_TOKEN}" \
                -H "User-Agent: plex-playlist-cicd-start" \
                -o "${HELPER_PATH}" \
                "${helper_url}"; then
                chmod +x "${HELPER_PATH}"
                return 0
              fi
            done
            return 1
          }

          if ! fetch_dispatch_helper "${TARGET_REF}" && ! fetch_dispatch_helper "${HEAD_SHA}"; then
            echo "❌ Failed to fetch scripts/dispatch-workflow.sh from repository"
            exit 1
          fi

          DISPATCH_ARGS=(
            --token "${DISPATCH_TOKEN}"
            --repo "${REPO_FULL}"
            --workflow "${TARGET_WORKFLOW}"
            --ref "${TARGET_REF}"
            --head-sha "${HEAD_SHA}"
            --source-workflow "CICD Start"
            --trace-id "${TRACE_ID}"
            --base-needed "${BASE_NEEDED}"
            --base-hash "${BASE_HASH}"
          )

          for API_BASE in "${CANDIDATE_API_BASES[@]}"; do
            DISPATCH_ARGS+=(--api-base "${API_BASE}")
          done

          "${HELPER_PATH}" "${DISPATCH_ARGS[@]}"