name: cache-kernel
run-name: Cache ${{ format('{0}-{1}', inputs.kernel_flavor, inputs.version) }} Kernel
on:
  workflow_call:
    inputs:
      architecture:
        description: "JSON string of architectures to build, '[aarch64, x86_64]'"
        default: "['x86_64']"
        required: false
        type: string
      kernel_flavor:
        description: "The Kernel flavor: main, coreos-stable, longterm-6.12, etc"
        required: true
        type: string
      version:
        description: "Release Version: 10, 41, 42, etc"
        required: true
        type: string
    outputs:
      KCKEY:
        description: Cache Key
        value: ${{ jobs.cache-kernel.outputs.KCKEY }}
  workflow_dispatch:
    inputs:
      architecture:
        description: "JSON string of architectures to build, '[aarch64, x86_64]'"
        default: "['x86_64']"
        required: false
        type: string
      kernel_flavor:
        description: "The Kernel flavor: main, coreos-stable, longterm-6.12, etc"
        required: true
        type: string
      version:
        description: "Release Version: 10, 41, 42, etc"
        required: true
        type: string
env:
  AKMODS_KERNEL: ${{ inputs.kernel_flavor }}
  AKMODS_VERSION: ${{ inputs.version }}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.version }}-${{ inputs.kernel_flavor }}
  cancel-in-progress: true

jobs:
  cache-kernel:
    name: Cache ${{ matrix.architecture }}
    runs-on: ${{ matrix.architecture == 'x86_64' && 'ubuntu-26.04' || 'ubuntu-26.04-arm' }}
    outputs:
      KCKEY: ${{ inputs.kernel_flavor }}-${{ steps.kernel-version.outputs.kernel_major_minor_patch }}
    container:
      image: "ghcr.io/ublue-os/devcontainer:latest@sha256:ec1046d2cb7d16e3cefaaae0915764f9ed4d4d74eabc25d1931923ce6670858d"
      options: "--privileged --volume /var/lib/containers:/var/lib/containers --security-opt seccomp=unconfined --security-opt label=disable --user 0:0"
    permissions:
      actions: read
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        architecture: ${{ fromJson(inputs.architecture) }}
    env:
      AKMODS_KERNEL: ${{ inputs.kernel_flavor }}
      AKMODS_VERSION: ${{ inputs.version }}
    
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      
      - name: Mark Directory as Safe
        run: git config --system --add safe.directory "$GITHUB_WORKSPACE"
      
      - name: Get Kernel Version
        id: kernel-version
        run: just cache-kernel-version

      - name: Cache Kernel RPMs
        id: cache-kernel
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: ${{ steps.kernel-version.outputs.KCPATH }}
          key: ${{ matrix.architecture }}-${{ inputs.kernel_flavor }}-${{ steps.kernel-version.outputs.kernel_major_minor_patch }} # job outputs KCKEY

      - name: Retrieve Signing Key
        if: contains(fromJSON('["schedule", "workflow_dispatch", "merge_group"]'), github.event_name) && steps.cache-kernel.outputs.cache-hit != 'true'
        shell: bash
        run: |
          mkdir -p certs
          echo "${{ secrets.KERNEL_PRIVKEY }}" > certs/private_key.priv
          echo "${{ secrets.AKMOD_PRIVKEY_20230518 }}" > certs/private_key_2.priv
          # DEBUG: get character count of key
          wc -c certs/private_key.priv
          wc -c certs/private_key_2.priv

      - name: Fetch Kernel
        if: steps.cache-kernel.outputs.cache-hit != 'true'
        run: just fetch-kernel

      - name: List Cached Kernel RPMs
        run: find ${{ steps.kernel-version.outputs.KCPATH }}
  check:
    name: Check all ${{ format('{0}-{1}', inputs.kernel_flavor, inputs.version) }} cache successful
    runs-on: ubuntu-26.04
    needs: [cache-kernel]
    permissions:
      actions: read
    steps:
      - name: Exit on failure
        if: ${{ needs.cache-kernel.result == 'failure' }}
        run: exit 1
      - name: Exit
        run: exit 0