sync.yml

# Mirror every enabled target to GHCR: plan, then one chain per pending target
# (.github/workflows/sync-target.yml: mirror in shards, stage, verify with
# pacman through the wrapper, promote), then one report.
#
# ⛔ A database reaches latest only after every file it names is on the
# registry and every file new since the promoted database has passed pacman's
# own checks through the wrapper. Targets are independent: each runs its own
# chain, and a slow or held target never delays or holds another.
# docs/design.md has the whole design.
#
# promote runs only on main. A run from any other branch does everything else,
# writes only write-once package tags and its own staging-<branch> tag, and
# never moves latest. Runs from every branch share one concurrency group, so
# two runs never write the same tags at once.
#
# A re-run: "Re-run failed jobs" keeps the plan and its artifacts. "Re-run all
# jobs" plans again under a new plan id; a download by name or pattern still
# returns the earlier attempt's artifact for every name not uploaded again.
# So each artifact a chain makes carries the plan id, and scripts/stage and
# scripts/report read none of another plan (docs/operations.md).
name: Sync

on:
  schedule:
    - cron: '17 */3 * * *'
  workflow_dispatch:
    inputs:
      targets:
        description: Targets (arch-repo, space separated); empty for every enabled one
        type: string
        default: ''
      max_targets:
        description: Target chains at once; the organisation shares 20 jobs
        type: number
        default: 4
      max_shards:
        description: Mirror shards at once in each target's chain
        type: number
        default: 3
      max_batches:
        description: Verify batches at once in each target's chain
        type: number
        default: 3
      parallel:
        description: Files mirrored at once in each shard
        type: number
        default: 6
      debloat:
        description: Free runner disk before mirroring
        type: choice
        options: [auto, always, never]
        default: auto
      allow_older:
        description: Targets whose upstream may go back to older builds this run (comma separated)
        type: string
        default: ''

permissions: {}

# With the default queue (single), a group holds one pending run, and a newer
# run cancels it: a dispatch with allow_older could be replaced by the next
# scheduled run. queue: max keeps up to 100 pending runs, each in its turn
# (docs.github.com, "Control the concurrency of workflows and jobs").
# actionlint 1.7.12 does not know the key: tests/static/20-actionlint.sh
# ignores that one message.
concurrency:
  group: sync
  cancel-in-progress: false
  queue: max

defaults:
  run:
    shell: bash

env:
  MIRROR_REGISTRY: ghcr.io
  SHARD_BYTES: '536870912'
  SHARD_FILES: '400'
  MAX_SHARDS: '32'

jobs:
  plan:
    runs-on: ubuntu-24.04
    # 20 min of plan reads (PLAN_BUDGET), plus the fetcher client install and the
    # keyring image pulls for the powerpc targets, fit under 40.
    timeout-minutes: 40
    permissions:
      contents: read
      packages: read
    outputs:
      targets: ${{ steps.plan.outputs.targets }}
      has_targets: ${{ steps.plan.outputs.has_targets }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install the fetcher clients when a powerpc target is in scope
        env:
          TARGETS: ${{ inputs.targets }}
        run: |
          # The powerpc targets read a host that needs a browser-profile
          # client. curl-impersonate (patched curl, one browser's TLS and HTTP/2
          # profile) reads it cheaply; chromium (a full browser) is the fallback
          # when a host needs a real engine. curl-impersonate is installed
          # best-effort so a client-install hiccup never blocks the run, and the
          # fetcher switches to chromium on its own. A run with no powerpc target
          # in scope needs no client. An empty TARGETS is every enabled target,
          # which includes the powerpc ones. This job plans every target at once,
          # so when neither client lands MIRROR_FETCHER stays unset: the powerpc
          # targets read with curl and go to error on their own, and the other
          # targets plan as before.
          need=0
          if [ -z "$TARGETS" ]; then
            need=1
          else
            for t in $TARGETS; do
              case "$t" in powerpc*) need=1 ;; esac
            done
          fi
          if [ "$need" -eq 1 ]; then
            imp=0; chr=0
            fetchers/install.sh curl-impersonate || imp=$?
            PLAYWRIGHT_WITH_DEPS=1 fetchers/install.sh chromium || chr=$?
            [ "$imp" -eq 0 ] || echo "::notice::curl-impersonate did not install (status $imp)"
            [ "$chr" -eq 0 ] || echo "::notice::chromium did not install (status $chr)"
            if [ "$imp" -eq 0 ] || [ "$chr" -eq 0 ]; then
              echo "MIRROR_FETCHER=$GITHUB_WORKSPACE/fetchers/fetcher.sh" >> "$GITHUB_ENV"
            else
              echo "::warning::no browser-profile client installed; powerpc targets read upstream with curl and may go to error"
            fi
          fi
      - name: Plan
        id: plan
        env:
          REGISTRY_USER: ${{ github.actor }}
          REGISTRY_TOKEN: ${{ github.token }}
          TARGETS: ${{ inputs.targets }}
          ALLOW_OLDER: ${{ inputs.allow_older }}
        run: |
          args=()
          for t in $TARGETS; do
            case "$t" in
              *[!a-z0-9_.-]*)
                echo "::error::not a target name: $t"
                exit 1
                ;;
            esac
            args+=("targets/$t.conf")
          done
          scripts/plan "$RUNNER_TEMP/plan" "${args[@]}"
          mkdir -p "$RUNNER_TEMP/plan-summary"
          cp "$RUNNER_TEMP/plan/summary.tsv" "$RUNNER_TEMP/plan/targets.json" "$RUNNER_TEMP/plan/pending.json" \
            "$RUNNER_TEMP/plan/plan-id" "$RUNNER_TEMP/plan-summary/"
      - name: Upload the plan's summary, for the report
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-summary
          path: ${{ runner.temp }}/plan-summary
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      # One artifact per pending target, plan-<target>, so a chain downloads its
      # own target's plan and nothing else. The plan names a target per slot;
      # tests/static/60-targets.sh checks there is a slot for every enabled
      # target.
      - name: Upload the plan of slot 0
        if: ${{ steps.plan.outputs.slot0 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot0 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot0 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 1
        if: ${{ steps.plan.outputs.slot1 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot1 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot1 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 2
        if: ${{ steps.plan.outputs.slot2 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot2 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot2 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 3
        if: ${{ steps.plan.outputs.slot3 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot3 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot3 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 4
        if: ${{ steps.plan.outputs.slot4 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot4 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot4 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 5
        if: ${{ steps.plan.outputs.slot5 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot5 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot5 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 6
        if: ${{ steps.plan.outputs.slot6 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot6 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot6 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 7
        if: ${{ steps.plan.outputs.slot7 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot7 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot7 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 8
        if: ${{ steps.plan.outputs.slot8 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot8 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot8 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 9
        if: ${{ steps.plan.outputs.slot9 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot9 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot9 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 10
        if: ${{ steps.plan.outputs.slot10 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot10 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot10 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 11
        if: ${{ steps.plan.outputs.slot11 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot11 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot11 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 12
        if: ${{ steps.plan.outputs.slot12 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot12 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot12 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 13
        if: ${{ steps.plan.outputs.slot13 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot13 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot13 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 14
        if: ${{ steps.plan.outputs.slot14 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot14 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot14 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 15
        if: ${{ steps.plan.outputs.slot15 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot15 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot15 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 16
        if: ${{ steps.plan.outputs.slot16 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot16 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot16 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 17
        if: ${{ steps.plan.outputs.slot17 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot17 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot17 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 18
        if: ${{ steps.plan.outputs.slot18 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot18 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot18 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 19
        if: ${{ steps.plan.outputs.slot19 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot19 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot19 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true
      - name: Upload the plan of slot 20
        if: ${{ steps.plan.outputs.slot20 != '' }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plan-${{ steps.plan.outputs.slot20 }}
          path: ${{ runner.temp }}/plan/${{ steps.plan.outputs.slot20 }}
          retention-days: 7
          if-no-files-found: error
          overwrite: true

  # One chain per pending target, each on its own: a target's promote waits
  # for its own shards and batches only. A job that calls a reusable workflow
  # takes no timeout-minutes (GitHub refuses the key there); every job of
  # sync-target.yml has its own.
  # A dispatch input reaches an expression as a string, and max-parallel and a
  # number input of a called workflow refuse a string ("Unexpected value '4'",
  # run 38569214434). fromJSON(format('{0}', x)) gives a number in every case.
  target:
    needs: plan
    if: ${{ needs.plan.outputs.has_targets == 'true' }}
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      max-parallel: ${{ fromJSON(format('{0}', inputs.max_targets || 4)) }}
      matrix: ${{ fromJSON(needs.plan.outputs.targets) }}
    uses: ./.github/workflows/sync-target.yml
    with:
      target: ${{ matrix.target }}
      shards: ${{ toJSON(matrix.shards) }}
      max_shards: ${{ fromJSON(format('{0}', inputs.max_shards || 3)) }}
      max_batches: ${{ fromJSON(format('{0}', inputs.max_batches || 3)) }}
      parallel: ${{ fromJSON(format('{0}', inputs.parallel || 6)) }}
      debloat: ${{ inputs.debloat || 'auto' }}

  report:
    needs: [plan, target]
    if: ${{ always() }}
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      actions: write
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # By a pattern, so an artifact that a skipped job never made is not an
      # error. Each summary-<target> holds <target>/..., so merged they land
      # side by side whichever way the action lays out a single match.
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: plan-summary
          path: ${{ runner.temp }}/dl-plan
          merge-multiple: true
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: summary-*
          path: ${{ runner.temp }}/summaries
          merge-multiple: true
      - name: Report
        env:
          GH_TOKEN: ${{ github.token }}
          TRACK_ISSUES: ${{ github.ref == 'refs/heads/main' && '1' || '0' }}
        run: |
          mkdir -p "$RUNNER_TEMP/dl-plan" "$RUNNER_TEMP/summaries"
          scripts/report "$RUNNER_TEMP/dl-plan" "$RUNNER_TEMP/summaries"
      # GitHub refuses to start a workflow that is not active, and a person
      # may disable status.yml on purpose: a notice, as in
      # scripts/dispatch-overdue, not a red sync. A state that does not read
      # still fails the step.
      - name: Start the status workflow
        if: ${{ always() && github.ref == 'refs/heads/main' }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          rc=0
          state="$(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/status.yml" --jq .state)" || rc=$?
          if [ "$rc" -ne 0 ]; then
            echo "::error::could not read the state of status.yml (gh ended $rc)"
            echo "  reproduce: gh api repos/$GITHUB_REPOSITORY/actions/workflows/status.yml --jq .state"
            exit "$rc"
          fi
          if [ "$state" = active ]; then
            gh workflow run status.yml --ref main --repo "$GITHUB_REPOSITORY"
          else
            echo "::notice::status.yml is $state; it is not started"
          fi

  # No needs, in either direction: this runs whatever the sync does, and the
  # watchdog workflow runs the same two checks, so each witnesses the other.
  keepalive:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      actions: write
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # keep-schedules-enabled, then check-schedules-fired; a schedule that
      # stopped, or a workflow disabled by hand, raises schedules-stopped.
      # Exit 3 (a schedule stopped) keeps the run red.
      - name: Keep every schedule enabled, check every schedule fired
        env:
          GH_TOKEN: ${{ github.token }}
        run: scripts/watch-schedules
      # Each scheduled workflow starts the others when theirs did not fire.
      # always(): a check above that fails must not stop the restart.
      - name: Start an overdue status run
        if: ${{ always() && github.ref == 'refs/heads/main' }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: scripts/dispatch-overdue status.yml 120