plex-playlist/.gitea/workflows/cicd-start.yaml

name: CICD Start

on:
  push:
    branches: [ main, develop, feature/* ]
  pull_request:
    branches: [ main, develop ]
  workflow_dispatch:

env:
  GITEA_SSH_HOST: kankali.darkhelm.lan
  GITEA_SSH_PORT: "2222"
  GITEA_REPO_SSH_URL: ssh://git@kankali.darkhelm.lan:2222/DarkHelm.org/plex-playlist.git
  GITEA_REGISTRY: kankali.darkhelm.lan:3001
  GITEA_REGISTRY_IP: 10.18.75.2
  GITEA_REGISTRY_HOST: kankali.darkhelm.lan

concurrency:
  group: start-${{ github.ref }}
  cancel-in-progress: true

jobs:
  sanity-and-routing:
    name: Sanity and Base Decision
    runs-on: ubuntu-act
    outputs:
      base_needed: ${{ steps.base-decision.outputs.base_needed }}
      head_sha: ${{ steps.base-decision.outputs.head_sha }}

    steps:
      - name: Audit trigger context
        env:
          EVENT_NAME: ${{ github.event_name }}
          REPOSITORY: ${{ github.repository }}
          ACTOR: ${{ github.actor }}
          REF: ${{ github.ref }}
          REF_NAME: ${{ github.ref_name }}
          HEAD_REF: ${{ github.head_ref }}
          SHA: ${{ github.sha }}
        run: |
          echo "=== Dispatch Audit: CICD Start ==="
          echo "event_name=${EVENT_NAME}"
          echo "repository=${REPOSITORY}"
          echo "actor=${ACTOR}"
          echo "ref=${REF}"
          echo "ref_name=${REF_NAME}"
          echo "head_ref=${HEAD_REF}"
          echo "sha=${SHA}"

      - name: Configure registry host resolution
        run: |
          if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
            echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
          fi

      - name: Registry sanity login
        env:
          PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
          REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.actor }}
        run: |
          echo "${PACKAGE_ACCESS_TOKEN}" | docker login "http://${GITEA_REGISTRY}" -u "${REGISTRY_USER}" --password-stdin

      - name: Registry sanity push and pull
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.actor }}
        run: |
          PREFLIGHT_TAG="${GITHUB_SHA:-manual}"
          PREFLIGHT_REF="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-ci-preflight:${PREFLIGHT_TAG}"

          cat <<'EOF' > /tmp/Dockerfile.preflight
          FROM scratch
          LABEL org.opencontainers.image.title="plex-playlist registry preflight"
          LABEL org.opencontainers.image.description="Minimal image used to verify registry push/pull access"
          EOF

          docker build -f /tmp/Dockerfile.preflight -t registry-preflight:latest /tmp
          docker tag registry-preflight:latest "${PREFLIGHT_REF}"
          docker push "${PREFLIGHT_REF}"
          docker pull "${PREFLIGHT_REF}"

      - name: Compute base hash and base-needed signal
        id: base-decision
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
        run: |
          set -e

          compute_hash() {
            local file1="$1"
            local file2="$2"
            sha256sum "${file1}" "${file2}" | sha256sum | cut -c1-16
          }

          if [ -f "Dockerfile.cicd-base" ] && [ -f ".dockerignore" ]; then
            BASE_HASH=$(compute_hash "Dockerfile.cicd-base" ".dockerignore")
          else
            umask 077
            trap 'rm -f ~/.ssh/id_rsa' EXIT

            if [ -z "${SSH_PRIVATE_KEY}" ]; then
              echo "❌ SSH_PRIVATE_KEY is empty"
              exit 1
            fi

            mkdir -p ~/.ssh /tmp/base-hash-repo
            echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa
            chmod 600 ~/.ssh/id_rsa
            ssh-keyscan -p "${GITEA_SSH_PORT}" "${GITEA_SSH_HOST}" >> ~/.ssh/known_hosts 2>/dev/null

            cd /tmp/base-hash-repo
            git init -q
            git remote add origin "${GITEA_REPO_SSH_URL}"
            GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
              git fetch --depth 1 origin "${GITHUB_SHA}"

            git show FETCH_HEAD:Dockerfile.cicd-base > /tmp/Dockerfile.cicd-base
            git show FETCH_HEAD:.dockerignore > /tmp/.dockerignore

            BASE_HASH=$(compute_hash "/tmp/Dockerfile.cicd-base" "/tmp/.dockerignore")
          fi

          BASE_REF_HASH="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-cicd-base:${BASE_HASH}"

          echo "Base hash: ${BASE_HASH}"
          echo "Base ref: ${BASE_REF_HASH}"

          echo "head_sha=${GITHUB_SHA}" >> "$GITHUB_OUTPUT"

          for i in 1 2 3; do
            echo "Base availability check ${i}/3 for ${BASE_REF_HASH}"

            if timeout 30 docker manifest inspect "${BASE_REF_HASH}" >/dev/null 2>&1; then
              echo "manifest_check=ok"
            else
              echo "manifest_check=missing_or_unreachable"
              if [ "${i}" -lt 3 ]; then
                sleep 20
              fi
              continue
            fi

            if timeout 60 docker pull "${BASE_REF_HASH}" >/dev/null 2>&1; then
              echo "pull_check=ok"
              echo "Base rebuild needed: false"
              echo "base_needed=false" >> "$GITHUB_OUTPUT"
              exit 0
            else
              echo "pull_check=failed"
            fi

            if [ "${i}" -lt 3 ]; then
              sleep 20
            fi
          done

          echo "Base rebuild needed: true"
          echo "base_needed=true" >> "$GITHUB_OUTPUT"

      - name: Dispatch downstream workflow
        if: steps.base-decision.outcome == 'success' && steps.base-decision.outputs.head_sha != '' && steps.base-decision.outputs.base_needed != ''
        env:
          DISPATCH_TOKEN: ${{ secrets.ACTIONS_TRIGGER_TOKEN || secrets.PACKAGE_ACCESS_TOKEN }}
          BASE_NEEDED: ${{ steps.base-decision.outputs.base_needed }}
          HEAD_SHA: ${{ steps.base-decision.outputs.head_sha }}
          REPO_FULL: ${{ github.repository }}
          HEAD_REF: ${{ github.head_ref }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          set -e

          if [ -z "${DISPATCH_TOKEN}" ]; then
            echo "❌ Missing dispatch token. Set ACTIONS_TRIGGER_TOKEN (repo write scope) or ensure PACKAGE_ACCESS_TOKEN has Actions workflow-dispatch permissions."
            exit 1
          fi

          if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
            echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
          fi

          API_BASE="http://${GITEA_REGISTRY_IP}:3000/api/v1"
          REPO_OWNER="${REPO_FULL%/*}"
          REPO_NAME="${REPO_FULL#*/}"
          TARGET_REF="${HEAD_REF:-${REF_NAME}}"

          if [ "${BASE_NEEDED}" = "true" ]; then
            TARGET_WORKFLOW="docker-build-base.yaml"
          else
            TARGET_WORKFLOW="docker-build-main.yaml"
          fi

          payload=$(cat <<EOF
          {
            "ref": "${TARGET_REF}",
            "inputs": {
              "head_sha": "${HEAD_SHA}",
              "source_workflow": "CICD Start",
              "base_needed": "${BASE_NEEDED}"
            }
          }
          EOF
          )

          DISPATCH_URL="${API_BASE}/repos/${REPO_OWNER}/${REPO_NAME}/actions/workflows/${TARGET_WORKFLOW}/dispatches"
          RESPONSE_FILE="/tmp/dispatch-response.txt"
          : > "${RESPONSE_FILE}"
          HTTP_CODE=$(curl -sS -o "${RESPONSE_FILE}" -w "%{http_code}" -X POST \
            -H "Authorization: token ${DISPATCH_TOKEN}" \
            -H "Content-Type: application/json" \
            "${DISPATCH_URL}" \
            -d "${payload}" || true)

          if [ "${HTTP_CODE}" -lt 200 ] || [ "${HTTP_CODE}" -ge 300 ]; then
            echo "❌ Dispatch failed with HTTP ${HTTP_CODE}"
            echo "Dispatch URL: ${DISPATCH_URL}"
            echo "Response body:"
            cat "${RESPONSE_FILE}" || true
            exit 1
          fi