actions-template/.gitea/workflows/prepare.yml

name: 🧰 准备环境

on:
  push:
  workflow_dispatch:

concurrency:
  group: prepare-${{ github.repository }}
  cancel-in-progress: false

env:
  ACCESS_TOKEN: ${{ secrets.WORKFLOW }}
  GIT_CONFIG_COUNT: "3"
  GIT_CONFIG_KEY_0: "credential.helper"
  GIT_CONFIG_VALUE_0: ""
  GIT_CONFIG_KEY_1: '!f() { test "$1" = get || exit 0; printf "%s\n" username=oauth2; printf "%s\n" "password=${ACCESS_TOKEN}"; }; f'
  GIT_CONFIG_KEY_2: "credential.interactive"
  GIT_CONFIG_VALUE_2: "never"
  WORKSPACE_ROOT: "/data/workspace"

jobs:
  prepare:
    runs-on: standard-ubuntu-22
    permissions:
      contents: read

    steps:
      - name: 🔧 检查并安装共享工具
        id: tools
        shell: bash
        run: |
          set -euo pipefail

          declare -A package_for=(
            [git]="git"
            [python3]="python3"
            [curl]="curl"
            [jq]="jq"
            [bc]="bc"
            [flock]="util-linux"
            [realpath]="coreutils"
          )
          required_commands=(git python3 curl jq bc flock realpath)
          missing_commands=()
          missing_packages=()
          declare -A seen_packages=()

          for command in "${required_commands[@]}"; do
            if ! command -v "$command" >/dev/null 2>&1; then
              package="${package_for[$command]}"
              missing_commands+=("$command")
              if [[ -z "${seen_packages[$package]+x}" ]]; then
                missing_packages+=("$package")
                seen_packages[$package]=1
              fi
            fi
          done

          installed=false
          if [ "${#missing_packages[@]}" -gt 0 ]; then
            echo "缺失命令: ${missing_commands[*]}"
            echo "准备安装: ${missing_packages[*]}"

            if [ "$(id -u)" -eq 0 ]; then
              APT=(apt-get)
            elif command -v sudo >/dev/null 2>&1; then
              APT=(sudo apt-get)
            else
              echo "无法安装缺失命令；当前用户不是 root 且没有 sudo" >&2
              echo "命令: ${missing_commands[*]}" >&2
              echo "包: ${missing_packages[*]}" >&2
              exit 1
            fi

            "${APT[@]}" update -qq
            "${APT[@]}" install -y -qq "${missing_packages[@]}"
            installed=true
          fi

          for command in "${required_commands[@]}"; do
            if ! command -v "$command" >/dev/null 2>&1; then
              echo "安装后仍找不到命令: $command (${package_for[$command]})" >&2
              exit 1
            fi
          done

          {
            echo "## Prepare 环境"
            echo ""
            echo "| 命令 | 版本 |"
            echo "| --- | --- |"
            for command in "${required_commands[@]}"; do
              version_output=$("$command" --version 2>&1 || true)
              version_line=${version_output%%$'\n'*}
              version_line=${version_line//|/\\|}
              printf '| `%s` | `%s` |\n' "$command" "$version_line"
            done
            echo ""
            if [ "$installed" = true ]; then
              echo "安装的包：\`${missing_packages[*]}\`"
            else
              echo "安装的包：无，所有命令已存在。"
            fi
          } >> "$GITHUB_STEP_SUMMARY"

          echo "installed=$installed" >> "$GITHUB_OUTPUT"

      - name: 📥 准备共享 bare 仓库
        shell: bash
        run: |
          set -euo pipefail

          REPO_NAME="${{ github.event.repository.name }}"
          REMOTE_URL="${{ github.server_url }}/${{ github.repository }}.git"
          HEAD_SHA="${{ github.sha }}"
          REPOSITORY_DIR="${WORKSPACE_ROOT}/${REPO_NAME}/repository.git"

          case "$HEAD_SHA" in
            ''|*[!0-9a-fA-F]*)
              echo "无效的触发提交 SHA: $HEAD_SHA" >&2
              exit 1
              ;;
          esac
          case "$REMOTE_URL" in
            https://*) ;;
            *)
              echo "拒绝通过非 HTTPS remote 使用 WORKFLOW token: $REMOTE_URL" >&2
              exit 1
              ;;
          esac
          if [ -z "$ACCESS_TOKEN" ]; then
            echo "未配置 WORKFLOW secret，无法读取仓库" >&2
            exit 1
          fi

          mkdir -p "$(dirname "$REPOSITORY_DIR")"
          if [ ! -e "$REPOSITORY_DIR" ]; then
            git init --bare "$REPOSITORY_DIR"
          else
            if [ ! -d "$REPOSITORY_DIR" ]; then
              echo "共享仓库路径存在但不是目录: $REPOSITORY_DIR" >&2
              exit 1
            fi
            if ! is_bare=$(git --git-dir="$REPOSITORY_DIR" rev-parse --is-bare-repository 2>/dev/null) || \
               [ "$is_bare" != "true" ]; then
              echo "共享仓库路径不是有效 bare 仓库: $REPOSITORY_DIR" >&2
              exit 1
            fi
          fi

          if git --git-dir="$REPOSITORY_DIR" remote get-url origin >/dev/null 2>&1; then
            git --git-dir="$REPOSITORY_DIR" remote set-url origin "$REMOTE_URL"
          else
            git --git-dir="$REPOSITORY_DIR" remote add origin "$REMOTE_URL"
          fi

          git --git-dir="$REPOSITORY_DIR" fetch \
            --prune --prune-tags --tags --force origin \
            '+refs/heads/*:refs/remotes/origin/*'

          if ! git --git-dir="$REPOSITORY_DIR" cat-file -e "${HEAD_SHA}^{commit}"; then
            echo "共享仓库中不存在触发提交: $HEAD_SHA" >&2
            exit 1
          fi

          resolved_sha=$(git --git-dir="$REPOSITORY_DIR" rev-parse "${HEAD_SHA}^{commit}")
          {
            echo ""
            echo "## Prepare 仓库"
            echo ""
            echo "- bare 仓库：\`$REPOSITORY_DIR\`"
            echo "- 触发提交：\`$resolved_sha\`"
            echo "- 远端：\`$REMOTE_URL\`"
          } >> "$GITHUB_STEP_SUMMARY"

          echo "Prepare 完成: $REPOSITORY_DIR @ $resolved_sha"