name: port-to-omp

# Keep the omp port of ralpi in lockstep with this repo.
#
# Two jobs:
#   - verify: port to a scratch dir, then typecheck + test the ported tree on
#     EVERY push and PR. Source drift — a base change that breaks a port op —
#     fails here, on the branch that introduced it, before it reaches master.
#     (The ported tree contains the full test suite, so this also gives the
#     base repo its CI test coverage.)
#   - publish: regenerate the omp port into Mike/omp-ralpi and push it, but
#     only on master, and only after verify passed — a broken port can never
#     ship. The port commit lands in the omp repo, never here, so this
#     workflow cannot re-trigger itself.
#
# Prerequisites on git.freno.me:
#   - an access token with write:repository scope, stored as the repo secret
#     PORTING_KEY (the workflow authenticates as https://Mike:<token>@…)
#   - a registered Actions runner (act_runner) for this repo
#   - the omp repo must exist (Mike/omp-ralpi)
#
# Manual run: Actions tab → Run workflow (workflow_dispatch), or push.

on:
  push:
  pull_request:

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install bun
        uses: oven-sh/setup-bun@v2

      - name: Port to scratch dir (drift check)
        run: |
          set -euo pipefail
          bun port-to-omp.mjs --out "$RUNNER_TEMP/omp-port-check"
          cd "$RUNNER_TEMP/omp-port-check"
          bun run typecheck
          bun test

  publish:
    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
    needs: verify
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install bun
        uses: oven-sh/setup-bun@v2

      - name: Port to omp
        env:
          PORTING_KEY: ${{ secrets.PORTING_KEY }}
          OMP_REPO: omp-ralpi
        run: |
          set -euo pipefail
          # Trim the secret: a stray newline from pasting silently breaks
          # basic auth. Fail loudly when it is missing entirely.
          PORTING_KEY="$(printf '%s' "${PORTING_KEY}" | tr -d '[:space:]')"
          : "${PORTING_KEY:?PORTING_KEY secret is not set}" || exit 1
          URL="https://Mike:${PORTING_KEY}@git.freno.me/Mike/${OMP_REPO}.git"

          # The omp checkout lives in $RUNNER_TEMP, outside the pi checkout:
          # the port script refuses to write into a subdirectory of its own
          # source (cpSync would recurse into itself).
          PORT_DIR="${RUNNER_TEMP:-/tmp}/omp-port"

          # Preflight: reach the omp repo with the token. Fail with a clear
          # message instead of a confusing error later at push time.
          if ! git ls-remote "$URL" HEAD >/dev/null 2>&1; then
            echo "::error::cannot read Mike/omp-ralpi with PORTING_KEY — is the secret set on this repo, valid, and write:repository-scoped?"
            exit 1
          fi
          git clone --depth 1 "$URL" "$PORT_DIR"
          git -C "$PORT_DIR" config user.name  "omp-port"
          git -C "$PORT_DIR" config user.email "omp-port@freno.me"

          # Regenerate the port directly into the omp checkout. The script
          # preserves .git, asserts every patch rule, and runs `bun install`
          # (refreshing bun.lock + node_modules).
          bun "$GITHUB_WORKSPACE/port-to-omp.mjs" --out "$PORT_DIR"

          cd "$PORT_DIR"
          # The port must compile against the pinned @oh-my-pi SDK before it
          # ships to users.
          bun run typecheck

          if git diff --quiet HEAD; then
            echo "port unchanged; nothing to push"
            exit 0
          fi
          git add -A
          git commit -m "port: sync from ${GITHUB_REPOSITORY}@${GITHUB_SHA::8}"
          git push origin HEAD:main