# The reusable half. Every yukart repo calls this on push (see caller/crosscheck.yml):
# it clones every repo of the org at master, puts the caller at the commit that was
# pushed, and runs crosscheck.py over the lot. A finding fails the caller's run, on
# the commit that introduced it.
on:
  workflow_call:
    inputs:
      repo:
        description: "The calling repository's name"
        required: true
        type: string
      sha:
        description: "The commit pushed to it"
        required: true
        type: string

jobs:
  crosscheck:
    # halogen-yukart, the org's runner on halogen (host mode). Needs only git, curl and python3.
    runs-on: halogen
    steps:
      - name: Clone every yukart repo
        env:
          # Every yukart repo is public, so no token is needed. Should one become private,
          # an org secret YUKART_READ_TOKEN (read-only) lets this clone it again.
          TOKEN: ${{ secrets.YUKART_READ_TOKEN }}
          SERVER: ${{ gitea.server_url }}
        run: |
          set -euo pipefail
          rm -rf ws && mkdir ws
          host="${SERVER#*://}"; scheme="${SERVER%%://*}"
          auth=(); [ -n "$TOKEN" ] && auth=(-H "Authorization: token $TOKEN")
          repos=$(curl -fsS "${auth[@]}" "$SERVER/api/v1/orgs/yukart/repos?limit=50" \
                  | python3 -c 'import json,sys; print(" ".join(r["name"] for r in json.load(sys.stdin) if not r["archived"]))')
          for r in $repos; do
            url="$scheme://${TOKEN:+crosscheck:$TOKEN@}$host/yukart/$r.git"
            git clone -q --depth 1 "$url" "ws/$r"
          done
          git -C "ws/${{ inputs.repo }}" fetch -q --depth 1 origin "${{ inputs.sha }}"
          git -C "ws/${{ inputs.repo }}" checkout -q FETCH_HEAD
          echo "checking: $repos"

      - name: Crosscheck
        run: python3 ws/tool-crosscheck/crosscheck.py ws