# CI-12: goes red when admin/goodwe master has moved past .gitea/infra-pin, so
# the pin cannot go stale silently. Deliberately NOT a required check: it
# reports; `checks / unit` stays the only gate. How to bump: README.md,
# "CI and the infra pin".
name: infra-pin

on:
  pull_request:
  push:
    branches: [release/1.0]

jobs:
  fresh:
    runs-on: [self-hosted, goodwe-rig]
    timeout-minutes: 30   # seconds of work; the rest is queueing for the shared slot
    steps:
      - name: compare .gitea/infra-pin with admin/goodwe master
        env:
          SELF: ${{ github.server_url }}/${{ github.repository }}.git
          INFRA: ${{ github.server_url }}/admin/goodwe.git
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -eu
          auth() { echo "$1" | sed "s#://#://x-access-token:${TOKEN}@#"; }
          D=$(mktemp -d) && cd "$D"
          git init -q . && git remote add origin "$(auth "$SELF")"
          # The pin of the commit this event is about (the PR head, or the push).
          git fetch -q --depth 1 origin "$GITHUB_SHA"
          PIN=$(git show FETCH_HEAD:.gitea/infra-pin | grep -v '^#' | tr -d '[:space:]')
          HEAD=$(git ls-remote "$(auth "$INFRA")" refs/heads/master | cut -f1)
          cd / && rm -rf "$D"
          test -n "$HEAD" || { echo "FAIL: could not read admin/goodwe master."; exit 1; }
          if [ "$PIN" != "$HEAD" ]; then
            echo "STALE: .gitea/infra-pin is $PIN but admin/goodwe master is $HEAD."
            echo "       Test against $HEAD and bump the pin (README.md, \"CI and the infra pin\")."
            exit 1
          fi
          echo "OK: .gitea/infra-pin $PIN is admin/goodwe master HEAD."