name: 🧰 准备环境

on:
  push:
    # 主分支：下游 sync / thirdparty 消费者只关心 main。
    # 其它分支（含 ci bot 推送的 tsl-playbook / thirdparty/skill 分支）跑 Prepare 纯属空耗，故在此过滤。
    branches:
      - main
  pull_request:
    # PR：为下游 checks 消费者（standards + tests）预备 bare 仓库。
    # PR 的 github.sha 是 Gitea 生成的 merge commit，不在 refs/heads/*，
    # 故下面的 fetch 额外取 PR ref 并按事件类型选校验目标。
    branches:
      - main
  workflow_dispatch:
  schedule:
    # thirdparty 快照每日轮询：Prepare 定时成功后，update-thirdparty-skills 通过 workflow_run 触发。
    - cron: "17 3 * * *"

concurrency:
  group: prepare-${{ github.repository }}
  cancel-in-progress: false

env:
  ACCESS_TOKEN: ${{ secrets.WORKFLOW }}
  FNM_ARCHIVE_SHA256: "7807664f39d39fc518da1c35ba0181e4b3267603c4b1dedeb4b5fc6ae440a224"
  FNM_BIN: "/data/bin/fnm"
  FNM_DIR: "/data/fnm"
  FNM_VERSION: "1.39.0"
  WORKSPACE_ROOT: "/data/workspace"

jobs:
  prepare:
    runs-on: standard-ubuntu-22
    permissions:
      contents: read

    steps:
      - name: 🔧 检查并安装共享工具
        id: tools
        shell: bash
        run: |
          set -euo pipefail

          declare -A package_for=(
            [git]="git"
            [python3]="python3"
            [python3.11]="python3.11"
            [curl]="curl"
            [flock]="util-linux"
            [realpath]="coreutils"
            [unzip]="unzip"
          )
          required_commands=(git python3 python3.11 curl flock realpath unzip)
          missing_commands=()
          missing_packages=()
          declare -A seen_packages=()

          for command in "${required_commands[@]}"; do
            if ! command -v "$command" >/dev/null 2>&1; then
              package="${package_for[$command]}"
              missing_commands+=("$command")
              if [[ -z "${seen_packages[$package]+x}" ]]; then
                missing_packages+=("$package")
                seen_packages[$package]=1
              fi
            fi
          done

          installed=false
          if [ "${#missing_packages[@]}" -gt 0 ]; then
            echo "缺失命令: ${missing_commands[*]}"
            echo "准备安装: ${missing_packages[*]}"

            if [ "$(id -u)" -eq 0 ]; then
              APT=(apt-get)
            elif command -v sudo >/dev/null 2>&1; then
              APT=(sudo apt-get)
            else
              echo "无法安装缺失命令；当前用户不是 root 且没有 sudo" >&2
              echo "命令: ${missing_commands[*]}" >&2
              echo "包: ${missing_packages[*]}" >&2
              exit 1
            fi

            "${APT[@]}" update -qq
            "${APT[@]}" install -y -qq "${missing_packages[@]}"
            installed=true
          fi

          for command in "${required_commands[@]}"; do
            if ! command -v "$command" >/dev/null 2>&1; then
              echo "安装后仍找不到命令: $command (${package_for[$command]})" >&2
              exit 1
            fi
          done

          python3.11 -c 'import sys; raise SystemExit(0 if sys.version_info >= (3, 11) else "Python 3.11 or newer is required")'

          fnm_installed=false
          expected_fnm_version="fnm $FNM_VERSION"
          current_fnm_version=""
          if [ -x "$FNM_BIN" ]; then
            current_fnm_version=$($FNM_BIN --version 2>/dev/null || true)
          fi

          if [ "$current_fnm_version" != "$expected_fnm_version" ]; then
            echo "准备安装 $expected_fnm_version"
            mkdir -p "$(dirname "$FNM_BIN")"
            fnm_tmp_dir=$(mktemp -d)
            trap 'rm -rf "$fnm_tmp_dir"' EXIT
            fnm_archive="$fnm_tmp_dir/fnm-linux.zip"
            curl -fsSL --retry 5 --retry-all-errors \
              "https://github.com/Schniz/fnm/releases/download/v${FNM_VERSION}/fnm-linux.zip" \
              -o "$fnm_archive"
            printf '%s  %s\n' "$FNM_ARCHIVE_SHA256" "$fnm_archive" | sha256sum -c -
            unzip -q "$fnm_archive" -d "$fnm_tmp_dir"
            install -m 0755 "$fnm_tmp_dir/fnm" "${FNM_BIN}.new"
            mv -f "${FNM_BIN}.new" "$FNM_BIN"
            fnm_installed=true
          fi

          if [ "$($FNM_BIN --version)" != "$expected_fnm_version" ]; then
            echo "fnm 安装后版本不符合要求: $($FNM_BIN --version 2>&1)" >&2
            exit 1
          fi

          {
            echo "## Prepare 环境"
            echo ""
            echo "| 命令 | 版本 |"
            echo "| --- | --- |"
            for command in "${required_commands[@]}"; do
              version_output=$("$command" --version 2>&1 || true)
              version_line=${version_output%%$'\n'*}
              version_line=${version_line//|/\\|}
              printf '| `%s` | `%s` |\n' "$command" "$version_line"
            done
            printf '| `%s` | `%s` |\n' "fnm" "$($FNM_BIN --version)"
            echo ""
            if [ "$installed" = true ]; then
              echo "安装的包：\`${missing_packages[*]}\`"
            else
              echo "安装的包：无，所有命令已存在。"
            fi
            if [ "$fnm_installed" = true ]; then
              echo "安装的版本管理器：\`$expected_fnm_version\`"
            else
              echo "安装的版本管理器：无，\`$expected_fnm_version\` 已存在。"
            fi
          } >> "$GITHUB_STEP_SUMMARY"

          echo "installed=$installed" >> "$GITHUB_OUTPUT"

      - name: 📥 准备共享 bare 仓库
        shell: bash
        run: |
          set -euo pipefail

          REPO_NAME="${{ github.event.repository.name }}"
          REMOTE_URL="${{ github.server_url }}/${{ github.repository }}.git"
          EVENT_NAME="${{ github.event_name }}"
          REPOSITORY_DIR="${WORKSPACE_ROOT}/${REPO_NAME}/repository.git"

          # 校验目标 SHA 因事件而异：
          # - pull_request：github.sha 是 Gitea 生成的 merge commit，不在
          #   refs/heads/* 里，直接校验会失败；改用 PR head SHA，并在下方额外
          #   fetch PR ref 把 head 提交拉进 bare 仓库。下游 workflow_run 消费者
          #   读到的 head_sha 也正是这个 PR head，两者一致。
          # - 其它事件（push / schedule / dispatch）：沿用 github.sha。
          if [ "$EVENT_NAME" = "pull_request" ]; then
            HEAD_SHA="${{ github.event.pull_request.head.sha }}"
            PR_NUMBER="${{ github.event.pull_request.number }}"
          else
            HEAD_SHA="${{ github.sha }}"
            PR_NUMBER=""
          fi

          case "$HEAD_SHA" in
            ''|*[!0-9a-fA-F]*)
              echo "无效的触发提交 SHA: $HEAD_SHA" >&2
              exit 1
              ;;
          esac
          case "$REMOTE_URL" in
            https://*) ;;
            *)
              echo "拒绝通过非 HTTPS remote 使用 WORKFLOW token: $REMOTE_URL" >&2
              exit 1
              ;;
          esac
          if [ -z "$ACCESS_TOKEN" ]; then
            echo "未配置 WORKFLOW secret，无法读取仓库" >&2
            exit 1
          fi

          mkdir -p "$(dirname "$REPOSITORY_DIR")"
          if [ ! -e "$REPOSITORY_DIR" ]; then
            git init --bare "$REPOSITORY_DIR"
          else
            if [ ! -d "$REPOSITORY_DIR" ]; then
              echo "共享仓库路径存在但不是目录: $REPOSITORY_DIR" >&2
              exit 1
            fi
            if ! is_bare=$(git --git-dir="$REPOSITORY_DIR" rev-parse --is-bare-repository 2>/dev/null) || \
               [ "$is_bare" != "true" ]; then
              echo "共享仓库路径不是有效 bare 仓库: $REPOSITORY_DIR" >&2
              exit 1
            fi
          fi

          if git --git-dir="$REPOSITORY_DIR" remote get-url origin >/dev/null 2>&1; then
            git --git-dir="$REPOSITORY_DIR" remote set-url origin "$REMOTE_URL"
          else
            git --git-dir="$REPOSITORY_DIR" remote add origin "$REMOTE_URL"
          fi

          git \
            -c credential.helper= \
            -c 'credential.helper=!f() { test "$1" = get || exit 0; printf "%s\n" username=oauth2; printf "%s\n" "password=${ACCESS_TOKEN}"; }; f' \
            -c credential.interactive=never \
            --git-dir="$REPOSITORY_DIR" fetch \
            --prune --prune-tags --tags --force origin \
            '+refs/heads/*:refs/remotes/origin/*'

          # PR head 不在 refs/heads/*，按需补取 PR ref 把 head 提交拉进 bare 仓库。
          # 先试 PR head SHA 是否已在库（同仓库分支 PR 的 head 常已随 refs/heads/*
          # 到位），不在再按 PR 号 fetch Gitea 的 refs/pull/<n>/head。
          if [ -n "$PR_NUMBER" ] && \
             ! git --git-dir="$REPOSITORY_DIR" cat-file -e "${HEAD_SHA}^{commit}" 2>/dev/null; then
            git \
              -c credential.helper= \
              -c 'credential.helper=!f() { test "$1" = get || exit 0; printf "%s\n" username=oauth2; printf "%s\n" "password=${ACCESS_TOKEN}"; }; f' \
              -c credential.interactive=never \
              --git-dir="$REPOSITORY_DIR" fetch --force origin \
              "+refs/pull/${PR_NUMBER}/head:refs/remotes/origin/pull/${PR_NUMBER}/head" || true
          fi

          if ! git --git-dir="$REPOSITORY_DIR" cat-file -e "${HEAD_SHA}^{commit}"; then
            echo "共享仓库中不存在触发提交: $HEAD_SHA（事件: $EVENT_NAME）" >&2
            exit 1
          fi

          resolved_sha=$(git --git-dir="$REPOSITORY_DIR" rev-parse "${HEAD_SHA}^{commit}")
          echo "PREPARED_REPOSITORY_DIR=$REPOSITORY_DIR" >> "$GITHUB_ENV"
          echo "PREPARED_SHA=$resolved_sha" >> "$GITHUB_ENV"
          {
            echo ""
            echo "## Prepare 仓库"
            echo ""
            echo "- bare 仓库：\`$REPOSITORY_DIR\`"
            echo "- 触发提交：\`$resolved_sha\`"
            echo "- 远端：\`$REMOTE_URL\`"
          } >> "$GITHUB_STEP_SUMMARY"

          echo "Prepare 完成: $REPOSITORY_DIR @ $resolved_sha"

      - name: 🟢 准备 Node.js
        shell: bash
        run: |
          set -euo pipefail

          node_version=$(git --git-dir="$PREPARED_REPOSITORY_DIR" show "${PREPARED_SHA}:.node-version" | tr -d '[:space:]')
          if ! [[ "$node_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo ".node-version 必须是完整的 Node.js 版本号: $node_version" >&2
            exit 1
          fi
          node_major=${node_version%%.*}
          if [ "$node_major" -lt 20 ]; then
            echo "Node.js 版本必须不低于 20: $node_version" >&2
            exit 1
          fi

          mkdir -p "$FNM_DIR"
          exec 9>"${FNM_DIR}.install.lock"
          flock 9
          "$FNM_BIN" install "$node_version"
          flock -u 9

          actual_node_version=$($FNM_BIN exec --using="$node_version" node --version)
          actual_npm_version=$($FNM_BIN exec --using="$node_version" npm --version)
          if [ "$actual_node_version" != "v$node_version" ]; then
            echo "Node.js 安装后版本不符合要求: $actual_node_version" >&2
            exit 1
          fi

          {
            echo ""
            echo "## Prepare Node.js"
            echo ""
            echo "- fnm：\`$($FNM_BIN --version)\`"
            echo "- Node.js：\`$actual_node_version\`"
            echo "- npm：\`$actual_npm_version\`"
            echo "- 缓存目录：\`$FNM_DIR\`"
          } >> "$GITHUB_STEP_SUMMARY"