name: tidy-check-generate

on:
  workflow_dispatch:
  push:
    branches:
      - main
      - "release/**"
  pull_request:

jobs:
  tidycheck:
    name: tidy, check and generate
    runs-on: [arc-runner-set]
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          ref: ${{ !github.event.pull_request.head.repo.fork && github.head_ref || '' }}
          # No token available for forks, so we can't push changes
          token: ${{ !github.event.pull_request.head.repo.fork && secrets.CI_COMMIT_PUSH_PR || '' }}

      - name: Install Dependencies
        run: |
          echo "::group::Install Dependencies"
          sudo apt-get update && sudo apt-get -y install libcryptsetup-dev libvirt-dev
          echo "::endgroup::"

      - name: Setup Bazel
        uses: ./.github/actions/setup_bazel_nix
        with:
          useCache: "rbe"
          rbePlatform: "ubuntu-22.04"

      - name: Assume AWS role to upload Bazel dependencies to S3
        if: startsWith(github.head_ref, 'renovate/')
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: arn:aws:iam::795746500882:role/GithubConstellationMirrorWrite
          aws-region: eu-central-1

      - name: Upload Bazel dependencies to the mirror
        if: startsWith(github.head_ref, 'renovate/')
        shell: bash
        run: |
          bazel run //bazel/ci:deps_mirror_upgrade
          bazel run //bazel/ci:deps_mirror_upload

      - name: Run Bazel tidy
        shell: bash
        run: |
          bazel run //:tidy
          bazel mod deps --lockfile_mode=update

      - name: Check if untidy
        id: untidy
        shell: bash
        run: |
          diff=$(git diff)
          if [[ -z "$diff" ]]; then
            echo "Everything is tidy."
            echo "untidy=false" | tee -a "$GITHUB_OUTPUT"
            exit 0
          fi
          echo "Detected changes after tidy"
          echo "untidy=true" | tee -a "$GITHUB_OUTPUT"
          diffsum=$(echo "$diff" | sha256sum | cut -d' ' -f1)
          echo "diffsum=${diffsum}" | tee -a "$GITHUB_OUTPUT"

      - name: Run Bazel generate
        shell: bash
        run: bazel run //:generate

      - name: Check if ungenerated
        id: ungenerated
        shell: bash
        run: |
          diff=$(git diff)
          diffsum=$(echo "$diff" | sha256sum| cut -d' ' -f1)
          if [[ "${{ steps.untidy.outputs.diffsum }}" == "${diffsum}" ]]; then
            echo "Everything is tidy."
            echo "ungenerated=false" | tee -a "$GITHUB_OUTPUT"
            exit 0
          fi
          echo "Detected changes after tidy"
          echo "ungenerated=true" | tee -a "$GITHUB_OUTPUT"

      - name: Check if tidy or generate made modifications
        id: modified
        shell: bash
        run: |
          diff=$(git diff)
          if [[ -z "$diff" ]]; then
            echo "Everything is tidy and generated."
            exit 0
          fi

          # Use quadruple backticks to escape triple backticks in diff'ed files.
          cat << EOF >> "${GITHUB_STEP_SUMMARY}"
          \`\`\`\`diff
          ${diff}
          \`\`\`\`
          EOF

          if [[ "${{ steps.untidy.outputs.untidy }}" == "true" ]] &&
             [[ "${{ steps.ungenerated.outputs.ungenerated }}" == "true" ]]; then
            suggestCmd="'bazel run //:generate' &&' bazel run //:tidy'"
          elif [[ "${{ steps.untidy.outputs.untidy }}" == "true" ]]; then
            suggestCmd="'bazel run //:tidy'"
          elif [[ "${{ steps.ungenerated.outputs.ungenerated }}" == "true" ]]; then
            suggestCmd="'bazel run //:generate'"
          fi

          echo "::error::The repo is not tidy. Please run ${suggestCmd} and commit the changes."
          exit 1

      - name: Run Bazel check
        shell: bash
        run: bazel run //:check

      # The following steps are only executed if the previous tidy check failed
      # and the action runs on an renovate branch. In this case, we tidy all
      # modules again and commit the changes, so the user doesn't need to do it.

      - name: Push changes
        if: |
          failure() &&
          (steps.modified.conclusion == 'failure') &&
          startsWith(github.head_ref, 'renovate/') &&
          !github.event.pull_request.head.repo.fork
        shell: bash
        run: |
          git config --global user.name "edgelessci"
          git config --global user.email "edgelessci@users.noreply.github.com"
          git commit -am "deps: tidy all modules"
          git push