name: Backend candidate (Gitea)

# Private Linux candidate only. The reviewed dispatcher supplies the exact Builds
# head. Fleet admits its exact canonical GitHub source parent before dispatch.
on:
  workflow_dispatch:
    inputs:
      expected_sha:
        description: Exact reviewed Builds main commit
        required: true
        type: string

env:
  CARGO_TERM_COLOR: never
  PYTHONDONTWRITEBYTECODE: '1'
  EXPECTED_BUILD_SHA: ${{ inputs.expected_sha }}

defaults:
  run:
    shell: bash

jobs:
  linux:
    name: Linux candidate
    runs-on: ubuntu-latest
    container:
      image: node:22-bookworm@sha256:0557ac14e0d45d02ed563067b82856ca5e7aa3437fa28d98d4350ea9c3d9494a
    env:
      RUSTUP_HOME: ${{ runner.temp }}/rustup-backend-candidate
      CARGO_HOME: ${{ runner.temp }}/cargo-backend-candidate
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ inputs.expected_sha }}
          persist-credentials: false
      - name: Require reviewed source selectors before setup
        run: |
          test "$GITHUB_REPOSITORY" = Builds/smirk-backend-core || { echo 'This repository is not admitted for backend Builds.' >&2; exit 1; }
          test "$(git rev-parse HEAD)" = "$EXPECTED_BUILD_SHA" || { echo 'Checkout differs from the reviewed event or dispatch head.' >&2; exit 1; }
      - name: Install isolated container build dependencies
        run: |
          apt-get update -qq
          apt-get install -y --no-install-recommends python3 build-essential pkg-config libssl-dev binutils
      - name: Admit reviewed source and exact dispatch head
        run: |
          if [ "$GITHUB_EVENT_NAME" = pull_request ]; then
            canonical_source=$(git rev-parse HEAD)
          else
            read -r -a parents <<< "$(git show -s --format=%P HEAD)"
            test "${#parents[@]}" -eq 2 || { echo 'Builds main requires a two-parent source wrapper.' >&2; exit 1; }
            canonical_source=${parents[1]}
          fi
          git fetch --no-tags https://github.com/Such-Software/smirk-backend-core.git "$canonical_source"
          python3 tools/check-build-source.py
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-unknown-linux-gnu
      - uses: Swatinem/rust-cache@v2
      - name: Build Linux candidate
        run: cargo build --locked --release --target x86_64-unknown-linux-gnu --bin smirk-backend-core
      - name: Stage binary and provenance
        run: python3 tools/stage-backend-candidate.py --output "$RUNNER_TEMP/backend-candidate"
      - name: Retain private candidate
        uses: actions/upload-artifact@v3
        with:
          name: smirk-backend-core-linux-x86_64-${{ inputs.expected_sha }}
          path: ${{ runner.temp }}/backend-candidate/
          if-no-files-found: error
          retention-days: 14