computer-playbook/.github/workflows/ci-orchestrator.yml

name: "🎵 CI: Orchestrator"
on:
  workflow_call:
    inputs:
      distros:
        description: "Space-separated distro list"
        required: false
        type: string
        default: "arch debian ubuntu fedora centos"
      whitelist:
        description: "Optional space-separated whitelist of app ids"
        required: false
        type: string
        default: ""
      image_wait_attempts:
        description: "Polling attempts for waiting on prebuilt or mirrored images"
        required: false
        type: string
        default: "1980"
      image_wait_sleep_seconds:
        description: "Polling interval in seconds for waiting on prebuilt or mirrored images"
        required: false
        type: string
        default: "10"

concurrency:
  group: infinito-test-${{ github.ref }}
  cancel-in-progress: false

permissions:
  actions: write
  contents: read
  packages: write
  security-events: write

jobs:
  wait-fork-prereq-run:
    name: ⏳ Wait for fork run
    runs-on: ubuntu-latest
    steps:
      - name: Mark fork prerequisites as ready outside fork PRs
        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
        shell: bash
        run: |
          set -euo pipefail
          echo "Fork prerequisites are implicitly ready outside fork pull_request events."

      - name: Checkout trusted workflow repo (helpers)
        if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.base.sha }}
          persist-credentials: false

      - name: Login to GHCR for CI image checks
        if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Wait for privileged fork CI images
        if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          WORKFLOW_FILE: entry-pull-request-change.yml
          TARGET_EVENT: pull_request_target
          PR_NUMBER: ${{ github.event.pull_request.number }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PR_UPDATED_AT: ${{ github.event.pull_request.updated_at }}
          DISTROS: "arch debian ubuntu fedora centos"
          IMAGE_TAG: ci-${{ github.sha }}
          WAIT_ATTEMPTS: ${{ inputs.image_wait_attempts }}
          WAIT_SLEEP_SECONDS: ${{ inputs.image_wait_sleep_seconds }}
        run: ./scripts/meta/wait/images.sh

  fork-prereqs-ready:
    name: 🚦 Gate fork prerequisites
    needs: wait-fork-prereq-run
    if: ${{ always() }}
    runs-on: ubuntu-latest
    steps:
      - name: Assert privileged prerequisites are ready
        shell: bash
        run: |
          set -euo pipefail
          result="${{ needs.wait-fork-prereq-run.result }}"
          if [[ "${result}" != "success" && "${result}" != "skipped" ]]; then
            echo "Fork prerequisites are not ready. wait-fork-prereq-run=${result}" >&2
            exit 1
          fi
          echo "Fork prerequisites are ready."

  # Security Checks
  security-codeql:
    uses: ./.github/workflows/security-codeql.yml

  # Linting
  lint-ansible:
    uses: ./.github/workflows/lint-ansible.yml
  lint-docker:
    uses: ./.github/workflows/lint-docker.yml
  lint-python:
    uses: ./.github/workflows/lint-python.yml
  lint-shell:
    uses: ./.github/workflows/lint-shell.yml
  lint-gate:
    name: 🚦 Gate lint
    needs: [lint-ansible, lint-python, lint-docker, lint-shell]
    runs-on: ubuntu-latest
    steps:
      - run: echo "lint gate passed"

  # Build Docker Images 
  build-ci-images:
    needs: fork-prereqs-ready
    uses: ./.github/workflows/images-build-ci.yml
    with:
      distros: "arch debian ubuntu fedora centos"
      concurrency_channel: ci-orchestrator-build-consumer
    secrets: inherit

  # Code Testing
  test-code-integration:
    uses: ./.github/workflows/test-code-integration.yml
    needs: build-ci-images
  test-code-lint:
    uses: ./.github/workflows/test-code-lint.yml
    needs: build-ci-images
  test-code-external:
    uses: ./.github/workflows/test-code-external.yml
    needs: build-ci-images
  test-code-unit:
    uses: ./.github/workflows/test-code-unit.yml 
    needs: build-ci-images
  test-code-gate:
    name: 🚦 Gate code
    needs: [test-code-integration, test-code-lint, test-code-external, test-code-unit]
    runs-on: ubuntu-latest
    steps:
      - run: echo "code gate passed"

  # Gate for the code Quality
  code-quality-gate:
    needs: [lint-gate, test-code-gate, security-codeql]
    runs-on: ubuntu-latest
    steps:
      - run: echo "Quality Checks passed"
  
  # Test DNS configuration
  test-dns:
    needs: 
      - build-ci-images
      - code-quality-gate
    uses: ./.github/workflows/test-dns.yml
    with:
      distros: "arch debian ubuntu fedora centos"
  
  # Sync Missing Images
  images-mirror-missing:
    uses: ./.github/workflows/images-mirror-missing.yml
    with:
      concurrency_channel: ci-orchestrator-mirror-consumer
      image_wait_attempts: ${{ inputs.image_wait_attempts }}
      image_wait_sleep_seconds: ${{ inputs.image_wait_sleep_seconds }}
    secrets: inherit

  # Deploy tests

  test-deploy-server:
    needs:
      - test-dns
      - images-mirror-missing
    uses: ./.github/workflows/test-deploy-server.yml
    with:
      distros: ${{ inputs.distros }}
      whitelist: ${{ inputs.whitelist }}

  test-deploy-universal:
    needs:
      - test-dns
      - images-mirror-missing
    uses: ./.github/workflows/test-deploy-universal.yml
    with:
      distros: ${{ inputs.distros }}
      whitelist: ${{ inputs.whitelist }}

  test-deploy-workstation:
    needs:
      - code-quality-gate
      - build-ci-images
    uses: ./.github/workflows/test-deploy-workstation.yml
    with:
      distros: ${{ inputs.distros }}
      whitelist: ${{ inputs.whitelist }}

  # Test Installation
  test-install-make:
    uses: ./.github/workflows/test-install-make.yml
    needs:
      - code-quality-gate
  test-install-pkgmgr:
    uses: ./.github/workflows/test-install-pkgmgr.yml
    needs:
      - code-quality-gate
  test-install-gate:
    name: 🚦 Gate installation
    needs:
      - test-install-make
      - test-install-pkgmgr
    runs-on: ubuntu-latest
    steps:
      - run: echo "Installation is possible via pkgmgr and make"

  # Test Development Environment
  test-development:
    uses: ./.github/workflows/test-environment.yml
    needs:
      - images-mirror-missing
      - code-quality-gate
    secrets: inherit

  done:
    name: 🏁 Finish pipeline
    needs:
      - test-deploy-server
      - test-deploy-universal
      - test-deploy-workstation
      - test-install-gate
      - test-development
    runs-on: ubuntu-latest
    steps:
      - name: Done
        run: echo "All checks passed."