name: E2E Bare-Metal

on:
  workflow_dispatch:

permissions:
  contents: read
  statuses: write

env:
  GIT_BRANCH: ${{ github.ref_name }}

jobs:
  e2e_baremetal:
    name: Bare-Metal Multi-Node E2E
    runs-on: [ self-hosted, ci-baremetal ]
    timeout-minutes: 120
    concurrency:
      group: e2e-baremetal-cluster
      cancel-in-progress: false
    env:
      BM_ISO_CACHE: /var/cache/spinifex-iso-builder
    steps:
      - name: Clean Workspace
        run: sudo rm -rf "$GITHUB_WORKSPACE"/*

      - uses: actions/checkout@v6

      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          client-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          repositories: mulga

      - uses: actions/checkout@v6
        with:
          repository: mulgadc/mulga
          token: ${{ steps.app-token.outputs.token }}
          sparse-checkout: |
            scripts/iso-builder
            scripts/baremetal
          path: mulga

      - name: Install SSH Key
        run: |
          echo "${{ secrets.BM_SSH_PRIVATE_KEY }}" > "${RUNNER_TEMP}/bm-ci"
          chmod 0600 "${RUNNER_TEMP}/bm-ci"
          ssh-keygen -y -f "${RUNNER_TEMP}/bm-ci" > "${RUNNER_TEMP}/bm-ci.pub"

      - name: Build Artifacts
        run: |
          mulga/scripts/baremetal/bm-build-artifacts.sh \
            "$GITHUB_WORKSPACE" \
            "${RUNNER_TEMP}/spinifex-tests.tar" \
            "${RUNNER_TEMP}/bm-bins"

      - name: Build PXE Artifacts
        run: |
          sudo make -C mulga/scripts/iso-builder \
            build-rootfs build-squashfs build-initramfs \
            CACHE="${BM_ISO_CACHE}" \
            SPINIFEX_BIN="${RUNNER_TEMP}/bm-bins/spx" \
            INSTALLER_BIN="${RUNNER_TEMP}/bm-bins/spinifex-installer" \
            SPINIFEX_SRC="${GITHUB_WORKSPACE}" \
            VIPERBLOCK_SRC="${RUNNER_TEMP}/bm-bins/viperblock" \
            VERSION="$(cd "$GITHUB_WORKSPACE" && git describe --tags --always 2>/dev/null || echo dev)"

      - name: Write ePDU credentials
        run: |
          install -m 0600 /dev/null "${RUNNER_TEMP}/epdu.env"
          cat >> "${RUNNER_TEMP}/epdu.env" <<EOF
          EPDU_HOST=192.168.1.63
          EPDU_SNMP_USER=ci-bmpower
          EPDU_SNMP_SEC_LEVEL=authPriv
          EPDU_SNMP_AUTH_PROTO=MD5
          EPDU_SNMP_AUTH_PASS=${{ secrets.BM_EPDU_AUTH_PASS }}
          EPDU_SNMP_PRIV_PROTO=DES
          EPDU_SNMP_PRIV_PASS=${{ secrets.BM_EPDU_PRIV_PASS }}
          EOF

      - name: Cache VM images
        run: |
          UBUNTU_IMG="${BM_ISO_CACHE}/ubuntu-26.04-cloudimg-amd64.img"
          if [ ! -f "$UBUNTU_IMG" ]; then
            echo "Downloading Ubuntu 26.04 cloud image..."
            sudo curl -fsSL -o "$UBUNTU_IMG" \
              "https://cloud-images.ubuntu.com/resolute/current/resolute-server-cloudimg-amd64.img"
            echo "  Downloaded $(du -h "$UBUNTU_IMG" | cut -f1)"
          else
            echo "Ubuntu 26.04 cloud image cached ($(du -h "$UBUNTU_IMG" | cut -f1))"
          fi


      - name: Run Bare-Metal E2E
        env:
          BM_CI_PASSWORD: ${{ secrets.BM_CI_PASSWORD }}
          BM_SSH_KEY: ${{ runner.temp }}/bm-ci
          BM_EPDU_ENV: ${{ runner.temp }}/epdu.env
          BM_UBUNTU_IMAGE: ${{ env.BM_ISO_CACHE }}/ubuntu-26.04-cloudimg-amd64.img
          SPX_EXTERNAL_POOL: ${{ env.SPINIFEX_CI_POOL }}
        run: |
          sudo -E mulga/scripts/baremetal/run-baremetal-e2e.sh \
            --vmlinuz   "${BM_ISO_CACHE}/vmlinuz" \
            --initrd    "${BM_ISO_CACHE}/initrd.img" \
            --squashfs  "${BM_ISO_CACHE}/spinifex.squashfs" \
            --tests-tar "${RUNNER_TEMP}/spinifex-tests.tar"