name: Dependency Verification

on:
  workflow_dispatch:
  schedule:
    - cron: '17 3 * * *'

permissions:
  contents: read

env:
  ALLOW_ADDITIONAL_ARTIFACT_CHECKSUMS: 'false'
  CLEAN_STALE_VERIFICATION_METADATA: 'false'
  CACHE_GRADLE_WRAPPER_DISTRIBUTION: 'true'
  JDK_JAVAC_OPTIONS: '-Xlint:-module'

concurrency:
  group: dependency-verification-${{ github.ref }}
  cancel-in-progress: false

jobs:
  linux-x64:
    name: Generate (Linux x64)
    runs-on: ubuntu-22.04

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: recursive

      - uses: ./.github/actions/update-gradle-verification
        with:
          cache-gradle-wrapper-distribution: ${{ env.CACHE_GRADLE_WRAPPER_DISTRIBUTION }}
          clean-start: ${{ env.CLEAN_STALE_VERIFICATION_METADATA }}
          output-artifact: gradle-verification-linux-x64

  linux-arm64:
    name: Generate (Linux arm64)
    runs-on: ubuntu-22.04-arm
    needs: linux-x64

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: recursive

      - uses: ./.github/actions/update-gradle-verification
        with:
          cache-gradle-wrapper-distribution: ${{ env.CACHE_GRADLE_WRAPPER_DISTRIBUTION }}
          previous-artifact: gradle-verification-linux-x64
          output-artifact: gradle-verification-linux-arm64

  windows-x64:
    name: Generate (Windows x64)
    runs-on: windows-2022
    needs: linux-arm64

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: recursive

      - uses: ./.github/actions/update-gradle-verification
        with:
          cache-gradle-wrapper-distribution: ${{ env.CACHE_GRADLE_WRAPPER_DISTRIBUTION }}
          previous-artifact: gradle-verification-linux-arm64
          output-artifact: gradle-verification-windows-x64

  macos-x64:
    name: Generate (macOS x64)
    runs-on: macos-15-intel
    needs: windows-x64

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: recursive

      - uses: ./.github/actions/update-gradle-verification
        with:
          cache-gradle-wrapper-distribution: ${{ env.CACHE_GRADLE_WRAPPER_DISTRIBUTION }}
          previous-artifact: gradle-verification-windows-x64
          output-artifact: gradle-verification-macos-x64

  macos-arm64:
    name: Generate (macOS arm64)
    runs-on: macos-14
    needs: macos-x64

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: recursive

      - uses: ./.github/actions/update-gradle-verification
        with:
          cache-gradle-wrapper-distribution: ${{ env.CACHE_GRADLE_WRAPPER_DISTRIBUTION }}
          previous-artifact: gradle-verification-macos-x64
          output-artifact: gradle-verification-final

  update-pr:
    name: Open update PR
    runs-on: ubuntu-22.04
    needs: macos-arm64
    permissions:
      contents: write
      pull-requests: write

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: recursive

      - name: Download final verification files
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: gradle-verification-final
          path: build/final-verification

      - name: Create or update pull request
        env:
          GH_TOKEN: ${{ github.token }}
          BRANCH_NAME: automation/update-gradle-verification-metadata
        run: |
          verification_metadata_diff() {
            if git ls-files --error-unmatch gradle/verification-metadata.xml >/dev/null 2>&1; then
              git diff -- gradle/verification-metadata.xml
            else
              git diff --no-index -- /dev/null gradle/verification-metadata.xml || true
            fi
          }

          reset_verification_files() {
            for file in gradle/verification-metadata.xml gradle/verification-keyring.keys; do
              if git ls-files --error-unmatch "$file" >/dev/null 2>&1; then
                git restore "$file"
              else
                rm -f "$file"
              fi
            done
          }

          mkdir -p /tmp/dependency-verification/gradle
          cp build/final-verification/gradle/verification-* /tmp/dependency-verification/gradle/
          cp /tmp/dependency-verification/gradle/verification-* gradle/

          if [ -z "$(git status --porcelain -- gradle/verification-metadata.xml gradle/verification-keyring.keys)" ]; then
            echo "No dependency verification changes detected."
            exit 0
          fi
          if [ "$ALLOW_ADDITIONAL_ARTIFACT_CHECKSUMS" != "true" ] && verification_metadata_diff | grep -q '^[+] *<also-trust '; then
            echo "Generated verification metadata adds also-trust checksums."
            echo "This indicates an existing artifact coordinate resolved to a checksum not currently trusted by the repository."
            echo "Set ALLOW_ADDITIONAL_ARTIFACT_CHECKSUMS to 'true' to allow opening an automated metadata update PR for this case."
            exit 1
          fi

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          if git fetch origin "+refs/heads/$BRANCH_NAME:refs/remotes/origin/$BRANCH_NAME"; then
            mkdir -p /tmp/dependency-verification/existing/gradle
            if git show "refs/remotes/origin/$BRANCH_NAME:gradle/verification-metadata.xml" > /tmp/dependency-verification/existing/gradle/verification-metadata.xml &&
              git show "refs/remotes/origin/$BRANCH_NAME:gradle/verification-keyring.keys" > /tmp/dependency-verification/existing/gradle/verification-keyring.keys &&
              cmp -s /tmp/dependency-verification/gradle/verification-metadata.xml /tmp/dependency-verification/existing/gradle/verification-metadata.xml &&
              cmp -s /tmp/dependency-verification/gradle/verification-keyring.keys /tmp/dependency-verification/existing/gradle/verification-keyring.keys &&
              git merge-base --is-ancestor HEAD "refs/remotes/origin/$BRANCH_NAME"; then
              echo "Existing automation branch already contains these verification changes."
              exit 0
            fi
          fi

          reset_verification_files
          git checkout -B "$BRANCH_NAME"
          cp /tmp/dependency-verification/gradle/verification-* gradle/
          git add gradle/verification-metadata.xml gradle/verification-keyring.keys
          git commit -m "Update Gradle dependency verification metadata"
          git push --force-with-lease origin "HEAD:$BRANCH_NAME"

          if gh pr list --base master --head "$BRANCH_NAME" --json number --jq '.[0].number' | grep -q .; then
            echo "Existing dependency verification PR found; branch was updated."
          else
            gh pr create \
              --base master \
              --head "$BRANCH_NAME" \
              --title "Update Gradle dependency verification metadata" \
              --body "Regenerates Gradle dependency verification metadata across Linux, Windows, and macOS using Gradle's incremental verification metadata update flow."
          fi