xworkmate-bridge/.github/workflows/pipeline.yml

name: Pipeline

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      target_host:
        description: "Ansible inventory host or alias"
        required: false
        default: "jp-xhttp-contabo.svc.plus"
        type: string
      run_apply:
        description: "Apply deployment (false = dry-run)"
        required: true
        default: true
        type: boolean
      internal_service_token:
        description: "Optional ACP auth token for deploy"
        required: false
        default: ""
        type: string

permissions:
  contents: read

concurrency:
  group: pipeline-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

env:
  DEFAULT_TARGET_HOST: jp-xhttp-contabo.svc.plus

jobs:
  prep:
    name: Prep
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Install golangci-lint
        run: |
          GOBIN="$(go env GOPATH)/bin"
          go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.8
          echo "${GOBIN}" >> "$GITHUB_PATH"          

      - name: Run lint and tests
        run: bash ./scripts/github-actions/prep.sh

  build:
    name: Build
    needs: prep
    runs-on: ubuntu-latest
    outputs:
      artifact_name: ${{ steps.artifact_meta.outputs.artifact_name }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Build x86 artifact
        run: bash ./scripts/github-actions/build-artifact.sh dist

      - name: Smoke test built artifact
        run: ./dist/xworkmate-bridge --help >/dev/null

      - name: Record artifact metadata
        id: artifact_meta
        run: echo "artifact_name=xworkmate-bridge-linux-amd64" >> "$GITHUB_OUTPUT"

      - name: Upload artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ${{ steps.artifact_meta.outputs.artifact_name }}
          path: dist/xworkmate-bridge

  deploy:
    name: Deploy
    needs: build
    if: ${{ github.event_name != 'pull_request' }}
    runs-on: ubuntu-latest
    outputs:
      run_apply: ${{ steps.deploy_meta.outputs.run_apply }}
    env:
      INTERNAL_SERVICE_TOKEN: ${{ github.event_name == 'workflow_dispatch' && inputs.internal_service_token || secrets.INTERNAL_SERVICE_TOKEN }}
    steps:
      - name: Checkout service repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          path: xworkmate-bridge

      - name: Checkout playbooks repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: x-evor/playbooks
          token: ${{ secrets.WORKSPACE_REPO_TOKEN || github.token }}
          path: playbooks

      - name: Download build artifact
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
        with:
          name: ${{ needs.build.outputs.artifact_name }}
          path: xworkmate-bridge/dist

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: xworkmate-bridge/go.mod
          cache: true
          cache-dependency-path: xworkmate-bridge/go.sum

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.11"

      - name: Install Ansible runtime
        run: |
          python -m pip install --upgrade pip
          python -m pip install "ansible-core==2.18.3"          

      - name: Resolve deployment settings
        id: deploy_meta
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            target_host="${{ inputs.target_host }}"
            run_apply="${{ inputs.run_apply }}"
          else
            target_host="${DEFAULT_TARGET_HOST}"
            run_apply="true"
          fi

          if [[ -z "${target_host}" ]]; then
            target_host="${DEFAULT_TARGET_HOST}"
          fi

          echo "target_host=${target_host}" >> "$GITHUB_OUTPUT"
          echo "run_apply=${run_apply}" >> "$GITHUB_OUTPUT"          

      - name: Prepare runner SSH access
        working-directory: xworkmate-bridge
        env:
          SINGLE_NODE_VPS_SSH_PRIVATE_KEY: ${{ secrets.SINGLE_NODE_VPS_SSH_PRIVATE_KEY }}
          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
        run: bash ./scripts/github-actions/prepare-ssh.sh "${{ steps.deploy_meta.outputs.target_host }}" "${SSH_KNOWN_HOSTS}"

      - name: Run Ansible deploy playbook
        working-directory: xworkmate-bridge
        env:
          INTERNAL_SERVICE_TOKEN: ${{ env.INTERNAL_SERVICE_TOKEN }}
          XWORKMATE_BRIDGE_ARTIFACT_PATH: ${{ github.workspace }}/xworkmate-bridge/dist/xworkmate-bridge
        run: bash ./scripts/github-actions/deploy.sh "${{ steps.deploy_meta.outputs.target_host }}" "${{ steps.deploy_meta.outputs.run_apply }}" ../playbooks

  validate:
    name: Validate
    needs: deploy
    if: ${{ needs.deploy.result == 'success' && needs.deploy.outputs.run_apply == 'true' }}
    runs-on: ubuntu-latest
    env:
      BRIDGE_SERVER_URL: https://xworkmate-bridge.svc.plus
      OPENCLAW_URL: wss://openclaw.svc.plus
      CODEX_RPC_URL: https://acp-server.svc.plus/codex/acp/rpc
      OPENCODE_RPC_URL: https://acp-server.svc.plus/opencode/acp/rpc
      GEMINI_RPC_URL: https://acp-server.svc.plus/gemini/acp/rpc
      INTERNAL_SERVICE_TOKEN: ${{ secrets.INTERNAL_SERVICE_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Validate deployed endpoints
        run: bash ./scripts/github-actions/validate-deploy.sh