# CI-12: goes red when admin/goodwe release/1.0 has moved past .gitea/infra-pin.
# It runs on add-on activity only; admin/goodwe's own `addon-pin` workflow
# covers a move of release/1.0 there. Deliberately NOT a required check: it
# reports; `checks / unit` stays the only gate. How to bump: README.md,
# "CI and the infra pin".
name: infra-pin

on:
  pull_request:
  push:
    branches: [release/1.0]

jobs:
  fresh:
    runs-on: [self-hosted, goodwe-rig]
    timeout-minutes: 30   # seconds of work; the rest is queueing for the shared slot
    steps:
      - name: compare .gitea/infra-pin with admin/goodwe release/1.0
        env:
          SELF: ${{ github.server_url }}/${{ github.repository }}.git
          INFRA: ${{ github.server_url }}/admin/goodwe.git
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
          INFRA_TOKEN: ${{ secrets.INFRA_READ_TOKEN }}   # admin/goodwe is private
        run: |
          set -eu
          D=$(mktemp -d) && trap 'cd / && rm -rf "$D"' EXIT && cd "$D"
          git init -q .
          # The pin of the commit this event is about (the PR head, or the push).
          # Token as an env-set header: not in argv or .git/config (TOOL-9).
          GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraHeader GIT_CONFIG_VALUE_0="Authorization: token $TOKEN" \
            git fetch -q --depth 1 "$SELF" "$GITHUB_SHA" || { echo "FAIL: could not fetch $GITHUB_SHA here."; exit 1; }
          # `|| true`: under the runner's pipefail a missing or comment-only pin
          # would stop here on git's error instead of the FAIL line below (TOOL-9).
          PIN=$(git show FETCH_HEAD:.gitea/infra-pin | grep -v '^#' | tr -d '[:space:]') || true
          test -n "$PIN" || { echo "FAIL: .gitea/infra-pin is missing at $GITHUB_SHA, or holds only comments."; exit 1; }
          test -n "$INFRA_TOKEN" || { echo "FAIL: secret INFRA_READ_TOKEN is not available to this run (a fork PR?)."; exit 1; }
          # Header via env, as in checks.yml: the token stays out of argv.
          HEAD=$(GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraHeader GIT_CONFIG_VALUE_0="Authorization: token $INFRA_TOKEN" \
            git ls-remote "$INFRA" refs/heads/release/1.0 | cut -f1) || true
          test -n "$HEAD" || { echo "FAIL: could not read admin/goodwe release/1.0."; exit 1; }
          if [ "$PIN" != "$HEAD" ]; then
            echo "STALE: .gitea/infra-pin is $PIN but admin/goodwe release/1.0 is $HEAD."
            echo "       Test against $HEAD and bump the pin (README.md, \"CI and the infra pin\")."
            exit 1
          fi
          echo "OK: .gitea/infra-pin $PIN is admin/goodwe release/1.0 HEAD."