computer-playbook/.github/workflows/call-orchestrator.yml

name: "🎵 CI: Orchestrator"
on:
  workflow_call:
    inputs:
      distros:
        description: "Distro pool the deploy matrix spreads its rows over. Empty: every declared distro, which is what a sweep wants. The rows rotate over the pool, so narrowing it only makes sense to chase one distribution."
        required: false
        type: string
        default: ""
      whitelist:
        description: "Optional space-separated whitelist of app ids"
        required: false
        type: string
        default: ""
      lifecycles:
        description: "Lifecycle envelope for test-deploy discovery (comma/space-separated)."
        required: false
        type: string
        default: ""
      mode:
        description: "Deploy modes rows may be drawn from: 'auto' rotates every row over the modes its role offers; a subset of 'host compose swarm' keeps only the rows those modes can take."
        required: false
        type: string
        default: "auto"
      priority:
        description: "Optional space-separated app ids for the priority line: sorted to the head of the list and cut into chunks of their own, so every priority row is deployed before the first regular one starts. Priority rows skip the sweep rotation and run every combination they can take (each variant, each offered mode, Tor and clearnet)."
        required: false
        type: string
        default: ""
      sweep:
        description: "Sweep number driving the mode and tor rotation. Empty: the run number."
        required: false
        type: string
        default: ""
      offset:
        description: "Regular rows to skip before filling the chunks. 0 starts at the head of the ranking; raise it to reach rows the budget leaves behind."
        required: false
        type: string
        default: "0"
      chunk_size:
        description: "📦 Rows one chunk holds. Empty or 0 derives it from the runner slots a chunk may assume and the waves the queue window affords. Typed string for the same reason as resume_from_chunk."
        required: false
        type: string
        default: "0"
      resume_from_chunk:
        description: "⏭️ Skip every chunk below this index. Use to continue a sweep after fixing what broke it, instead of re-running the green chunks. Typed string, not number: a workflow_dispatch number input reaches the caller as a string, and handing that to a number-typed workflow_call input makes GitHub reject the job before it is created."
        required: false
        type: string
        default: "0"
      chunk_gate:
        description: "🛑 Stop the chunk chain at its first failed chunk. Off: keep deploying the remaining chunks."
        required: false
        type: boolean
        default: true
      filesystem:
        description: "🗄️ Filesystem pool the deploy matrix spreads its rows over (ext4, btrfs, zfs). Empty: all three."
        required: false
        type: string
        default: ""
      image_wait_attempts:
        description: "Polling attempts for waiting on prebuilt or mirrored images"
        required: false
        type: string
        default: "1980"
      image_wait_sleep_seconds:
        description: "Polling interval in seconds for waiting on prebuilt or mirrored images"
        required: false
        type: string
        default: "10"
      workspace:
        description: "Run the workspace test (dev-runtime image matrix). 'auto' runs it on a global scope only, 'true'/'false' force it."
        required: false
        type: string
        default: "auto"
      workspace_track:
        description: "Which workspace track each distro runs: 'rotate' splits them across compose and swarm and flips with the run number, 'compose'/'swarm' pin every distro."
        required: false
        type: string
        default: "rotate"
      tor:
        description: "Tor axis of the deploy matrix: 'auto' rotates the onion over the tor-capable rows, 'enforced' onions all of them, 'exclusive' also drops the rows that cannot, 'disabled' onions none."
        required: false
        type: string
        default: "auto"
      vpn:
        description: "WireGuard axis of the deploy matrix: 'auto' rotates the mesh over the swarm rows, 'enforced' meshes all of them, 'disabled' meshes none."
        required: false
        type: string
        default: "auto"
      meshes:
        description: "WireGuard layout a meshed swarm row deploys, e.g. an inventories/examples/*/wireguard.yml. Empty: INFINITO_SWARM_MESHES from default.env."
        required: false
        type: string
        default: ""
      trusted_pr:
        description: "True when the PR carries the maintainer '🛡️ Trusted' label; skips the fork-prereq wait."
        required: false
        type: boolean
        default: false

permissions:
  actions: read
  contents: read
  packages: read

jobs:
  validate-selection:
    name: 🎯 Selection
    uses: ./.github/workflows/call-validation.yml
    with:
      whitelist: ${{ inputs.whitelist }}
      priority: ${{ inputs.priority }}
      mode: ${{ inputs.mode }}
      tor: ${{ inputs.tor }}
      distros: ${{ inputs.distros }}
      filesystem: ${{ inputs.filesystem }}
      lifecycles: ${{ inputs.lifecycles }}
      fork_prereqs: true
      trusted_pr: ${{ inputs.trusted_pr }}
      image_wait_attempts: ${{ inputs.image_wait_attempts }}
      image_wait_sleep_seconds: ${{ inputs.image_wait_sleep_seconds }}
    secrets: inherit

  security-codeql:
    needs: validate-selection
    permissions:
      contents: read
      packages: read
      security-events: write
    uses: ./.github/workflows/cron-security-codeql.yml

  lint:
    needs: validate-selection
    uses: ./.github/workflows/call-lint.yml

  test:
    needs: validate-selection
    uses: ./.github/workflows/call-test.yml

  build-ci-images:
    needs: validate-selection
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/call-images-build-ci.yml
    with:
      distros: "arch debian ubuntu fedora centos"
      concurrency_channel: ci-orchestrator-build-consumer
    secrets: inherit

  test-dns:
    needs:
      - build-ci-images
      - images-mirror-missing
      - validate-selection
    uses: ./.github/workflows/call-test-dns.yml
    with:
      distros: "arch debian ubuntu fedora centos"

  images-mirror-missing:
    needs: validate-selection
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/call-images-mirror-missing.yml
    with:
      concurrency_channel: ci-orchestrator-mirror-consumer
      image_wait_attempts: ${{ inputs.image_wait_attempts }}
      image_wait_sleep_seconds: ${{ inputs.image_wait_sleep_seconds }}
    secrets: inherit

  test-deploy-chunk-0:
    name: 🧱 Chunk 0
    if: >-
      ${{ !cancelled()
          && inputs.resume_from_chunk <= 0
          && needs.lint.result == 'success'
          && needs.test.result == 'success'
          && needs.build-ci-images.result == 'success'
          && needs.images-mirror-missing.result == 'success' }}
    needs:
      - lint
      - test
      - build-ci-images
      - images-mirror-missing
      - validate-selection
    uses: ./.github/workflows/call-test-deploy.yml
    with:
      distros: ${{ inputs.distros }}
      index: "0"
      sweep: ${{ inputs.sweep != '' && inputs.sweep || github.run_number }}
      offset: ${{ inputs.offset }}
      chunk_size: ${{ inputs.chunk_size }}
      whitelist: ${{ inputs.whitelist }}
      priority: ${{ inputs.priority }}
      lifecycles: ${{ inputs.lifecycles }}
      modes: ${{ inputs.mode }}
      filesystem: ${{ inputs.filesystem }}
      tor: ${{ inputs.tor }}
      vpn: ${{ inputs.vpn }}
      meshes: ${{ inputs.meshes }}

  test-deploy-chunk-1:
    name: 🧱 Chunk 1
    if: >-
      ${{ !cancelled()
          && inputs.resume_from_chunk <= 1
          && needs.lint.result == 'success'
          && needs.test.result == 'success'
          && needs.build-ci-images.result == 'success'
          && needs.images-mirror-missing.result == 'success'
          && (!inputs.chunk_gate
              || contains(fromJSON('["success","skipped"]'), needs.test-deploy-chunk-0.result)) }}
    needs:
      - lint
      - test
      - build-ci-images
      - images-mirror-missing
      - validate-selection
      - test-deploy-chunk-0
    uses: ./.github/workflows/call-test-deploy.yml
    with:
      distros: ${{ inputs.distros }}
      index: "1"
      sweep: ${{ inputs.sweep != '' && inputs.sweep || github.run_number }}
      offset: ${{ inputs.offset }}
      chunk_size: ${{ inputs.chunk_size }}
      whitelist: ${{ inputs.whitelist }}
      priority: ${{ inputs.priority }}
      lifecycles: ${{ inputs.lifecycles }}
      modes: ${{ inputs.mode }}
      filesystem: ${{ inputs.filesystem }}
      tor: ${{ inputs.tor }}
      vpn: ${{ inputs.vpn }}
      meshes: ${{ inputs.meshes }}

  test-deploy-chunk-2:
    name: 🧱 Chunk 2
    if: >-
      ${{ !cancelled()
          && inputs.resume_from_chunk <= 2
          && needs.lint.result == 'success'
          && needs.test.result == 'success'
          && needs.build-ci-images.result == 'success'
          && needs.images-mirror-missing.result == 'success'
          && (!inputs.chunk_gate
              || (contains(fromJSON('["success","skipped"]'), needs.test-deploy-chunk-0.result)
                  && contains(fromJSON('["success","skipped"]'), needs.test-deploy-chunk-1.result))) }}
    needs:
      - lint
      - test
      - build-ci-images
      - images-mirror-missing
      - validate-selection
      - test-deploy-chunk-0
      - test-deploy-chunk-1
    uses: ./.github/workflows/call-test-deploy.yml
    with:
      distros: ${{ inputs.distros }}
      index: "2"
      sweep: ${{ inputs.sweep != '' && inputs.sweep || github.run_number }}
      offset: ${{ inputs.offset }}
      chunk_size: ${{ inputs.chunk_size }}
      whitelist: ${{ inputs.whitelist }}
      priority: ${{ inputs.priority }}
      lifecycles: ${{ inputs.lifecycles }}
      modes: ${{ inputs.mode }}
      filesystem: ${{ inputs.filesystem }}
      tor: ${{ inputs.tor }}
      vpn: ${{ inputs.vpn }}
      meshes: ${{ inputs.meshes }}

  test-deploy-chunk-3:
    name: 🧱 Chunk 3
    if: >-
      ${{ !cancelled()
          && inputs.resume_from_chunk <= 3
          && needs.lint.result == 'success'
          && needs.test.result == 'success'
          && needs.build-ci-images.result == 'success'
          && needs.images-mirror-missing.result == 'success'
          && (!inputs.chunk_gate
              || (contains(fromJSON('["success","skipped"]'), needs.test-deploy-chunk-0.result)
                  && contains(fromJSON('["success","skipped"]'), needs.test-deploy-chunk-1.result)
                  && contains(fromJSON('["success","skipped"]'), needs.test-deploy-chunk-2.result))) }}
    needs:
      - lint
      - test
      - build-ci-images
      - images-mirror-missing
      - validate-selection
      - test-deploy-chunk-0
      - test-deploy-chunk-1
      - test-deploy-chunk-2
    uses: ./.github/workflows/call-test-deploy.yml
    with:
      distros: ${{ inputs.distros }}
      index: "3"
      sweep: ${{ inputs.sweep != '' && inputs.sweep || github.run_number }}
      offset: ${{ inputs.offset }}
      chunk_size: ${{ inputs.chunk_size }}
      whitelist: ${{ inputs.whitelist }}
      priority: ${{ inputs.priority }}
      lifecycles: ${{ inputs.lifecycles }}
      modes: ${{ inputs.mode }}
      filesystem: ${{ inputs.filesystem }}
      tor: ${{ inputs.tor }}
      vpn: ${{ inputs.vpn }}
      meshes: ${{ inputs.meshes }}

  test-runner-smoke:
    needs:
      - test-deploy-chunk-0
    if: ${{ !cancelled() && vars.CI_SELF_HOSTED_RUNNER_COUNT != '0' && vars.CI_SELF_HOSTED_RUNNER_COUNT != '' && (needs.test-deploy-chunk-0.result == 'success' || needs.test-deploy-chunk-0.result == 'failure') }}
    uses: ./.github/workflows/call-test-runner-smoke.yml
    with:
      ref: ${{ github.sha }}
    secrets: inherit

  test-install-make:
    needs: validate-selection
    uses: ./.github/workflows/call-test-install-make.yml
  test-install-pkgmgr:
    needs: validate-selection
    uses: ./.github/workflows/call-test-install-pkgmgr.yml

  test-workspace:
    if: ${{ inputs.workspace == 'true' || (inputs.workspace == 'auto' && (inputs.whitelist == '' || inputs.whitelist == '__ALL__')) }}
    uses: ./.github/workflows/call-test-workspace.yml
    with:
      workspace_track: ${{ inputs.workspace_track }}
    needs:
      - images-mirror-missing
      - lint
      - test
    secrets: inherit

  report-main-failures:
    name: 🐞 Report main role failures
    needs:
      - test-deploy-chunk-0
      - test-deploy-chunk-1
      - test-deploy-chunk-2
      - test-deploy-chunk-3
    if: ${{ always() && github.ref == 'refs/heads/main' && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) }}
    runs-on: ubuntu-26.04
    permissions:
      issues: write
      actions: read
      contents: read
    steps:
      - uses: actions/checkout@v7.0.0
      - name: 🐞 Open or append issues for failed roles
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: python3 -m cli.meta.ci.report_failures --run-id "${{ github.run_id }}" --repo "${{ github.repository }}"

  done:
    name: 🏁 Finish pipeline
    needs:
      - validate-selection
      - build-ci-images
      - images-mirror-missing
      - test-dns
      - test-install-make
      - test-install-pkgmgr
      - test-deploy-chunk-0
      - test-deploy-chunk-1
      - test-deploy-chunk-2
      - test-deploy-chunk-3
      - test-runner-smoke
      - test-workspace
      - test
      - lint
      - security-codeql
    if: ${{ always() }}
    runs-on: ubuntu-26.04
    steps:
      - name: 🛑 Fail if any upstream job failed or was cancelled
        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
        run: |
          echo "Pipeline failed: at least one upstream job failed or was cancelled." >&2
          exit 1
      - name: ✅ Done
        run: echo "All checks passed."