# Nightly snapshot of the kernel images: the acceptance protocol, the proofs, the board images,
# then Nexus. Each stage is a step of scripts/nightly.sh (its header says what each does); any
# failure stops the run, and nothing is published unless every stage before it passed.
#
#   org.starship:kernelImage:<LITHOS_VERSION>-SNAPSHOT, starshipos-snapshots
#     classifier pc      StarshipOS.iso   amd64, UEFI -- the ISO the amd64 acceptance boot booted
#     classifier raspi5  raspi5.img.xz    Raspberry Pi 5, for Raspberry Pi Imager
#     classifier milkv   MilkV.img.xz     Milk-V Mars
#     classifier logs    logs.tar.gz      this run's serial logs, proof log and DoE CSVs
#
# Gitea runs a schedule from the default branch, master, so this builds master.
name: Nightly snapshot

on:
  schedule:
    - cron: '0 3 * * *'        # 03:00 UTC; the documents are at 04:00 (nightly-docs.yml)
  workflow_dispatch:

concurrency:
  group: qemu                     # one QEMU at a time on the runner: shared with acceptance.yml
  cancel-in-progress: false

jobs:
  nightly:
    name: Acceptance, proofs, images
    runs-on: ubuntu-latest
    container:
      image: gitea/runner-images:ubuntu-24.04-v26.11.03   # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye)
    timeout-minutes: 150
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0          # the SBOM's version is git describe
          lfs: false              # only the logs and DoE CSVs are in LFS; the build needs neither

      - name: Install the build's dependencies
        run: |
          make ARCH=amd64,aarch64,riscv64 init INIT_DOCS=0
          DEBIAN_FRONTEND=noninteractive apt-get install -y -qq maven default-jre-headless

      - name: Acceptance amd64
        run: scripts/nightly.sh accept amd64
      - name: Acceptance aarch64
        run: scripts/nightly.sh accept aarch64
      - name: Acceptance riscv64
        run: scripts/nightly.sh accept riscv64
      - name: Acceptance PC stick loaded high
        run: scripts/nightly.sh accept stick-high
      - name: Acceptance 32-bit build
        run: scripts/nightly.sh test-32
      - name: Isabelle/HOL proofs
        run: scripts/nightly.sh proofs

      - name: Images
        run: scripts/nightly.sh images

      - name: Publish to Nexus
        env:
          NEXUS_USER: ci-publisher
          NEXUS_PASSWORD: ${{ secrets.NEXUS_CI_PASSWORD }}
        run: scripts/nightly.sh publish https://nexus.starshipos-f18.org/repository/starshipos-snapshots

      - name: Keep the images
        uses: actions/upload-artifact@v3
        with:
          name: kernel-images-${{ github.run_number }}
          path: build/nightly/

      - name: Keep the logs and DoE CSVs
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: logs-${{ github.run_number }}
          path: |
            logs/
            experiments/bare_metal/runs/