name: gcp-iap-operator

on:
  workflow_dispatch:
    inputs:
      operation:
        description: Fixed reviewed operation
        required: true
        type: choice
        options:
          - status
          - direct-claim-replay
          - cleanup-clone
      request_id:
        description: iap- followed by 12-32 lowercase letters or digits
        required: true
        type: string
      target_db:
        description: teleo_clone_status for status, otherwise the exact generated clone database
        required: true
        default: teleo_clone_status
        type: string

permissions:
  contents: read
  id-token: write

concurrency:
  group: gcp-iap-operator-${{ github.run_id }}
  cancel-in-progress: false

env:
  PROJECT_ID: teleo-501523
  WORKLOAD_IDENTITY_PROVIDER: projects/785938879453/locations/global/workloadIdentityPools/github-actions/providers/teleo-iap-operator
  STATUS_SERVICE_ACCOUNT: sa-teleo-iap-status@teleo-501523.iam.gserviceaccount.com
  CLONE_SERVICE_ACCOUNT: sa-teleo-iap-clone-operator@teleo-501523.iam.gserviceaccount.com
  EXPECTED_WORKFLOW_REF: living-ip/teleo-infrastructure/.github/workflows/gcp-iap-operator.yml@refs/heads/main
  DISPATCHER_VERSION: teleo-gcp-iap-operator-v1

jobs:
  operate:
    name: Fixed IAP operator command
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - name: Check out the dispatched main revision
        uses: actions/checkout@v4

      - name: Initialize runner-local paths
        id: paths
        shell: bash
        run: |
          set -euo pipefail
          [[ -n "${RUNNER_TEMP:-}" ]] || exit 2
          printf 'BUNDLE_DIR=%s\n' "${RUNNER_TEMP}/gcp-iap-operator-bundle" >> "${GITHUB_ENV}"
          printf 'RESULT_DIR=%s\n' "${RUNNER_TEMP}/gcp-iap-operator-result" >> "${GITHUB_ENV}"

      - name: Validate fixed inputs and select identity
        id: validate
        shell: bash
        env:
          OPERATION: ${{ inputs.operation }}
          REQUEST_ID: ${{ inputs.request_id }}
          TARGET_DB: ${{ inputs.target_db }}
        run: |
          set -euo pipefail
          [[ "${GITHUB_REF}" == "refs/heads/main" ]] || exit 2
          [[ "${GITHUB_WORKFLOW_REF}" == "${EXPECTED_WORKFLOW_REF}" ]] || exit 2
          request_id_re='^iap-[a-z0-9]{12,32}$'
          target_db_re='^teleo_clone_[a-z0-9][a-z0-9_]{0,50}$'
          [[ "${REQUEST_ID}" =~ ${request_id_re} ]] || exit 2
          [[ "${TARGET_DB}" =~ ${target_db_re} ]] || exit 2
          case "${OPERATION}" in
            status)
              [[ "${TARGET_DB}" == "teleo_clone_status" ]] || exit 2
              service_account="${STATUS_SERVICE_ACCOUNT}"
              ;;
            direct-claim-replay|cleanup-clone)
              [[ "${TARGET_DB}" != "teleo_clone_status" ]] || exit 2
              service_account="${CLONE_SERVICE_ACCOUNT}"
              ;;
            *) exit 2 ;;
          esac
          printf 'service_account=%s\n' "${service_account}" >> "${GITHUB_OUTPUT}"
          install -d -m 0700 "${RESULT_DIR}"
          : > "${RESULT_DIR}/result.json"
          chmod 0600 "${RESULT_DIR}/result.json"

      - name: Build strict reviewed operation bundle
        if: ${{ inputs.operation != 'status' }}
        shell: bash
        env:
          OPERATION: ${{ inputs.operation }}
          REQUEST_ID: ${{ inputs.request_id }}
          TARGET_DB: ${{ inputs.target_db }}
        run: |
          set -euo pipefail
          python3 - <<'PY'
          import gzip
          import hashlib
          import io
          import json
          import os
          import subprocess
          import tarfile
          from pathlib import Path

          root = Path.cwd().resolve()
          operation = os.environ["OPERATION"]
          request_id = os.environ["REQUEST_ID"]
          target_db = os.environ["TARGET_DB"]
          common = ["scripts/gcp_iap_operator.sh"]
          direct_claim = [
              "scripts/run_gcp_generated_db_direct_claim_suite.py",
              "scripts/run_leo_clone_bound_handler_checkpoint.py",
              "scripts/working_leo_open_ended_benchmark.py",
              "hermes-agent/leoclean-bin/cloudsql_memory_tool.py",
              "ops/postgres_parity_manifest.sql",
              f"docs/reports/leo-working-state-20260709/{target_db}-canonical-parity-receipt.json",
          ]
          allowed = common + (direct_claim if operation == "direct-claim-replay" else [])
          if operation not in {"direct-claim-replay", "cleanup-clone"}:
              raise SystemExit("bundle requested for a non-clone operation")
          head = subprocess.check_output(["git", "rev-parse", "HEAD"], text=True).strip()
          if head != os.environ["GITHUB_SHA"]:
              raise SystemExit("checkout HEAD does not match GITHUB_SHA")
          files = {}
          payloads = {}
          for relative in allowed:
              subprocess.run(
                  ["git", "ls-files", "--error-unmatch", "--", relative],
                  check=True,
                  stdout=subprocess.DEVNULL,
              )
              path = root / relative
              if not path.is_file() or path.is_symlink() or root not in path.resolve().parents:
                  raise SystemExit(f"unsafe or missing tracked bundle file: {relative}")
              data = path.read_bytes()
              payloads[relative] = data
              files[relative] = {"sha256": hashlib.sha256(data).hexdigest(), "size": len(data)}
          manifest = {
              "schema": "livingip.gcpIapOperatorBundle.v1",
              "dispatcher_version": os.environ["DISPATCHER_VERSION"],
              "operation": operation,
              "request_id": request_id,
              "target_db": target_db,
              "git_commit": head,
              "ref": os.environ["GITHUB_REF"],
              "workflow_ref": os.environ["GITHUB_WORKFLOW_REF"],
              "files": files,
          }
          manifest_bytes = (json.dumps(manifest, indent=2, sort_keys=True) + "\n").encode()
          bundle_dir = Path(os.environ["BUNDLE_DIR"])
          bundle_dir.mkdir(mode=0o700, parents=True, exist_ok=True)
          os.chmod(bundle_dir, 0o700)
          bundle_path = bundle_dir / f"{request_id}.tar.gz"
          with bundle_path.open("xb") as raw:
              with gzip.GzipFile(fileobj=raw, mode="wb", mtime=0) as compressed:
                  with tarfile.open(fileobj=compressed, mode="w", format=tarfile.PAX_FORMAT) as archive:
                      for relative, data in sorted({**payloads, "bundle-manifest.json": manifest_bytes}.items()):
                          info = tarfile.TarInfo(relative)
                          info.size = len(data)
                          info.mode = 0o600
                          info.mtime = 0
                          info.uid = info.gid = 0
                          info.uname = info.gname = "root"
                          archive.addfile(info, io.BytesIO(data))
          os.chmod(bundle_path, 0o600)
          PY

      - name: Authenticate with short-lived workload identity federation
        id: auth
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ env.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ steps.validate.outputs.service_account }}
          create_credentials_file: true
          cleanup_credentials: true
          export_environment_variables: true

      - name: Install Google Cloud CLI
        id: setup_gcloud
        uses: google-github-actions/setup-gcloud@v3
        with:
          project_id: ${{ env.PROJECT_ID }}

      - name: Run fixed IAP operation
        id: operate
        shell: bash
        env:
          OPERATION: ${{ inputs.operation }}
          REQUEST_ID: ${{ inputs.request_id }}
          TARGET_DB: ${{ inputs.target_db }}
        run: |
          set -euo pipefail
          scripts/gcp_iap_operator.sh "${OPERATION}" "${REQUEST_ID}" "${TARGET_DB}"

      - name: Ensure sanitized result receipt
        if: always()
        shell: bash
        env:
          OPERATION: ${{ inputs.operation }}
          REQUEST_ID: ${{ inputs.request_id }}
          TARGET_DB: ${{ inputs.target_db }}
          VALIDATE_OUTCOME: ${{ steps.validate.outcome }}
          AUTH_OUTCOME: ${{ steps.auth.outcome }}
          SETUP_GCLOUD_OUTCOME: ${{ steps.setup_gcloud.outcome }}
          OPERATE_OUTCOME: ${{ steps.operate.outcome }}
        run: |
          set -euo pipefail
          install -d -m 0700 "${RESULT_DIR}"
          result_path="${RESULT_DIR}/result.json"
          if [[ -s "${result_path}" ]] && python3 -c 'import json,sys; json.load(open(sys.argv[1]))' "${result_path}"; then
            exit 0
          fi
          RESULT_PATH="${result_path}" python3 - <<'PY'
          import json
          import os
          from pathlib import Path

          result = {
              "schema": "livingip.gcpIapOperatorResult.v1",
              "operation": os.environ["OPERATION"],
              "request_id": os.environ["REQUEST_ID"],
              "target_db": os.environ["TARGET_DB"],
              "status": "fail",
              "failure_class": "workflow_stopped_before_valid_operator_result",
              "step_outcomes": {
                  "validate": os.environ["VALIDATE_OUTCOME"],
                  "auth": os.environ["AUTH_OUTCOME"],
                  "setup_gcloud": os.environ["SETUP_GCLOUD_OUTCOME"],
                  "operate": os.environ["OPERATE_OUTCOME"],
              },
              "credential_values_logged": False,
              "raw_stdout_retained": False,
              "raw_stderr_retained": False,
          }
          path = Path(os.environ["RESULT_PATH"])
          path.write_text(json.dumps(result, indent=2, sort_keys=True) + "\n", encoding="utf-8")
          path.chmod(0o600)
          PY

      - name: Upload sanitized result receipt
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: gcp-iap-operator-${{ github.run_id }}
          path: ${{ env.RESULT_DIR }}/result.json
          if-no-files-found: error
          retention-days: 7
