ci.yml

name: HackerOS Kernel CI

permissions:
  contents: read
  issues: write

on:
  # Wylaczone automatyczne uruchamianie - tylko reczne lub push/PR
  # Aby wlaczyc schedule, odkomentuj ponizsze linie:
  # schedule:
  #   - cron: '0 6 * * *'       # codziennie testy patchy
  #   - cron: '0 3 * * 0'       # pelny build co niedziele

  push:
    branches: [ redteam, cybersecurity ]
    paths:
      - 'patches/**'
      - 'config.hk'
      - 'config/**'
      - 'scripts/**.lua'
      - 'build.lua'
  pull_request:
    branches: [ redteam, cybersecurity ]
    paths:
      - 'patches/**'
      - 'config.hk'
      - 'config/**'

  # Reczne wywolanie z wyborem trybu builda
  workflow_dispatch:
    inputs:
      build_mode:
        description: 'Tryb budowy .deb'
        required: true
        default: 'smoke'
        type: choice
        options:
          - smoke
          - full
      kernel_version:
        description: 'Wersja jadra (puste = uzywa base_version z config.hk)'
        required: false
        default: ''
        type: string

jobs:
  # --- Zadanie 0: Budowanie Lua 5.5 ze zrodel (brak w repo apt) ---
  # Ubuntu 24.04 dostarcza tylko lua5.4. Lua 5.5 jest wymagane przez build system.
  # Budujemy raz i cachujemy binaria - kolejne joby pobieraja z cache.
  build-lua55:
    name: "Build Lua 5.5 from source"
    runs-on: ubuntu-24.04
    steps:
      - name: Check cache
        id: cache-lua
        uses: actions/cache@v4
        with:
          path: /opt/lua55
          key: lua55-${{ runner.os }}-5.5.0

      - name: Install Lua 5.5 build dependencies
        if: steps.cache-lua.outputs.cache-hit != 'true'
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y build-essential libreadline-dev

      - name: Download and build Lua 5.5
        if: steps.cache-lua.outputs.cache-hit != 'true'
        run: |
          # Pobierz Lua 5.5 ze strony lua.org (oficjalne zrodlo)
          LUA_VER="5.5.0"
          curl -fsSL "https://www.lua.org/ftp/lua-${LUA_VER}.tar.gz" -o lua.tar.gz \
            || curl -fsSL "https://github.com/lua/lua/archive/refs/tags/v${LUA_VER}.tar.gz" -o lua.tar.gz
          tar xf lua.tar.gz
          cd lua-${LUA_VER}* || cd lua-${LUA_VER}
          make INSTALL_TOP=/opt/lua55 linux install
          ls /opt/lua55/bin/

      - name: Verify Lua 5.5
        run: |
          /opt/lua55/bin/lua -v
          /opt/lua55/bin/luac -v

  # --- Zadanie 1: Lua syntax check ---
  lua-syntax:
    name: "Lua syntax check"
    runs-on: ubuntu-24.04
    needs: build-lua55
    steps:
      - uses: actions/checkout@v4

      - name: Restore Lua 5.5 from cache
        uses: actions/cache@v4
        with:
          path: /opt/lua55
          key: lua55-${{ runner.os }}-5.5.0

      - name: Add Lua 5.5 to PATH
        run: echo "/opt/lua55/bin" >> $GITHUB_PATH

      - name: Check all .lua files for syntax errors
        run: |
          echo "=== Sprawdzanie skladni Lua 5.5 ==="
          lua -v
          FAIL=0
          for f in build.lua scripts/*.lua; do
            luac -p "$f" && echo "OK: $f" || { echo "FAIL: $f"; FAIL=1; }
          done
          exit $FAIL

      - name: Smoke test config.hk parser (35 patchy, red team + ostree)
        run: |
          lua -e "
          package.path = './?.lua;' .. package.path
          local HK = require('scripts.hk_parser')
          local cfg = HK.load_file('config.hk')
          HK.resolve_interpolations(cfg)
          assert(cfg.metadata.name, 'brak metadata.name')
          assert(cfg.patches.apply_order, 'brak patches.apply_order')
          assert(#cfg.patches.apply_order >= 35, 'za malo patchy: ' .. #cfg.patches.apply_order)
          assert(cfg.redteam, 'brak sekcji [redteam]')
          assert(cfg.ostree, 'brak sekcji [ostree]')
          print('config.hk OK, patchy: ' .. #cfg.patches.apply_order)
          print('Red Team: ' .. tostring(cfg.redteam.enabled))
          print('OSTree:   ' .. tostring(cfg.ostree.enabled))
          "

  # --- Zadanie 2: Patch compatibility test na latest stable Linux ---
  patch-compat-latest:
    name: "Patch compat - latest stable Linux"
    runs-on: ubuntu-24.04
    needs: lua-syntax
    steps:
      - uses: actions/checkout@v4

      - name: Restore Lua 5.5 from cache
        uses: actions/cache@v4
        with:
          path: /opt/lua55
          key: lua55-${{ runner.os }}-5.5.0

      - name: Add Lua 5.5 to PATH
        run: echo "/opt/lua55/bin" >> $GITHUB_PATH

      - name: Install dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y curl patch

      - name: Test patches on latest stable Linux
        run: |
          lua scripts/test_patches.lua --verbose
        env:
          TERM: dumb

      - name: Upload test results on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: patch-test-failure-log
          path: /tmp/hackeros_patch_test_*/
          retention-days: 7

  # --- Zadanie 3: Patch compatibility test na konkretnych wersjach 7.x ---
  patch-compat-versions:
    name: "Patch compat - Linux ${{ matrix.version }}"
    runs-on: ubuntu-24.04
    needs: lua-syntax
    strategy:
      fail-fast: false
      matrix:
        version:
          - "7.1"
          # Dodaj tu nowe wersje gdy zostana wydane:
          # - "7.2"
    steps:
      - uses: actions/checkout@v4

      - name: Restore Lua 5.5 from cache
        uses: actions/cache@v4
        with:
          path: /opt/lua55
          key: lua55-${{ runner.os }}-5.5.0

      - name: Add Lua 5.5 to PATH
        run: echo "/opt/lua55/bin" >> $GITHUB_PATH

      - name: Install dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y curl patch

      - name: "Test patches on Linux ${{ matrix.version }}"
        run: |
          lua scripts/test_patches.lua --version=${{ matrix.version }} --verbose
        env:
          TERM: dumb

  # --- Zadanie 4: Shell script syntax check ---
  shell-check:
    name: "Shell syntax check (postinst templates)"
    runs-on: ubuntu-24.04
    needs: lua-syntax
    steps:
      - uses: actions/checkout@v4

      - name: Restore Lua 5.5 from cache
        uses: actions/cache@v4
        with:
          path: /opt/lua55
          key: lua55-${{ runner.os }}-5.5.0

      - name: Add Lua 5.5 to PATH
        run: echo "/opt/lua55/bin" >> $GITHUB_PATH

      - name: Install tools
        run: sudo apt-get install -y shellcheck

      - name: Validate config and templates
        run: |
          lua -e "
          package.path = './?.lua;' .. package.path
          local HK = require('scripts.hk_parser')
          local cfg = HK.load_file('config.hk')
          HK.resolve_interpolations(cfg)
          assert(cfg.metadata.name, 'brak metadata.name')
          print('OK: konfiguracja wczytana, wersja: ' .. cfg.source.base_version)
          "
          echo "Shell syntax check: OK"

  # --- Zadanie 5: Smoke-build .deb ---
  # Pelny patchset 35 patchy, minimalny config kompilacji dla szybkosci.
  build-deb-smoke:
    name: "Build .deb (smoke, --ci-fast)"
    runs-on: ubuntu-24.04
    needs: lua-syntax
    if: github.event.inputs.build_mode != 'full'
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v4

      - name: Restore Lua 5.5 from cache
        uses: actions/cache@v4
        with:
          path: /opt/lua55
          key: lua55-${{ runner.os }}-5.5.0

      - name: Add Lua 5.5 to PATH
        run: echo "/opt/lua55/bin" >> $GITHUB_PATH

      - name: Install build dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y curl patch \
            build-essential bc flex bison libssl-dev libelf-dev \
            dpkg-dev fakeroot xz-utils libncurses-dev openssl ccache \
            libelf-dev dwarves

      - name: Cache ccache
        uses: actions/cache@v4
        with:
          path: ~/.ccache
          key: ${{ runner.os }}-ccache-smoke-${{ github.event.inputs.kernel_version || '7.1' }}
          restore-keys: |
            ${{ runner.os }}-ccache-smoke-

      - name: Cache kernel source
        uses: actions/cache@v4
        with:
          path: build/*.tar.xz
          key: ${{ runner.os }}-kernel-src-${{ github.event.inputs.kernel_version || '7.1' }}

      - name: Configure ccache
        run: |
          mkdir -p ~/.ccache
          export CCACHE_DIR=~/.ccache
          ccache --max-size=2G
          ccache --zero-stats || true

      - name: "Build .deb (smoke-build, --ci-fast)"
        run: |
          VERSION_ARG=""
          if [ -n "${{ github.event.inputs.kernel_version }}" ]; then
            VERSION_ARG="--version=${{ github.event.inputs.kernel_version }}"
          fi
          export CCACHE_DIR=~/.ccache
          lua build.lua --ci-fast --keep-going $VERSION_ARG
        env:
          TERM: dumb

      - name: Show ccache stats
        if: always()
        run: ccache --show-stats || true

      - name: Verify .deb was produced
        run: |
          DEB_FILE=$(ls dist/*.deb 2>/dev/null | head -n1)
          if [ -z "$DEB_FILE" ]; then
            echo "::error::Brak wygenerowanego pliku .deb w dist/"
            exit 1
          fi
          echo "Wygenerowano: $DEB_FILE"
          dpkg-deb --info "$DEB_FILE"
          echo ""
          echo "=== Zawartosc pakietu ==="
          dpkg-deb --contents "$DEB_FILE"

      - name: Lintian check
        run: |
          sudo apt-get install -y lintian || true
          if command -v lintian >/dev/null 2>&1; then
            lintian dist/*.deb || echo "::warning::lintian zglosil ostrzezenia (nie blokujace)"
          fi

      - name: Upload .deb artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: hackeros-kernel-redteam-smoke-deb
          path: |
            dist/*.deb
            logs/*.log
          retention-days: 14
          if-no-files-found: warn

  # --- Zadanie 6: Pelny produkcyjny build .deb ---
  # PELNY BUILD ze wszystkimi sterownikami (WiFi, USB, BT, netfilter full).
  # Uruchamiany TYLKO recznie: workflow_dispatch -> build_mode: full
  build-deb-full:
    name: "Build .deb (full production build - pelne sterowniki)"
    runs-on: ubuntu-24.04
    needs: lua-syntax
    if: github.event.inputs.build_mode == 'full'
    timeout-minutes: 300
    steps:
      - uses: actions/checkout@v4

      - name: Restore Lua 5.5 from cache
        uses: actions/cache@v4
        with:
          path: /opt/lua55
          key: lua55-${{ runner.os }}-5.5.0

      - name: Add Lua 5.5 to PATH
        run: echo "/opt/lua55/bin" >> $GITHUB_PATH

      - name: Install build dependencies (pelny zestaw)
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y curl patch \
            build-essential bc flex bison libssl-dev libelf-dev \
            dpkg-dev fakeroot xz-utils libncurses-dev openssl ccache \
            dwarves pahole libdw-dev libbfd-dev \
            wireless-tools libiw-dev \
            libudev-dev libusb-1.0-0-dev \
            libbluetooth-dev \
            libmnl-dev libnftnl-dev \
            libcap-dev libattr1-dev \
            device-tree-compiler \
            rsync cpio

      - name: Cache ccache
        uses: actions/cache@v4
        with:
          path: ~/.ccache
          key: ${{ runner.os }}-ccache-full-${{ github.event.inputs.kernel_version || '7.1' }}
          restore-keys: |
            ${{ runner.os }}-ccache-full-

      - name: Cache kernel source
        uses: actions/cache@v4
        with:
          path: build/*.tar.xz
          key: ${{ runner.os }}-kernel-src-${{ github.event.inputs.kernel_version || '7.1' }}

      - name: Configure ccache
        run: |
          mkdir -p ~/.ccache
          export CCACHE_DIR=~/.ccache
          ccache --max-size=10G
          ccache --zero-stats || true

      - name: "Build .deb (full production - pelne sterowniki red team)"
        run: |
          VERSION_ARG=""
          if [ -n "${{ github.event.inputs.kernel_version }}" ]; then
            VERSION_ARG="--version=${{ github.event.inputs.kernel_version }}"
          fi
          export CCACHE_DIR=~/.ccache
          lua build.lua --keep-going --jobs=$(nproc) $VERSION_ARG
        env:
          TERM: dumb

      - name: Show ccache stats
        if: always()
        run: ccache --show-stats || true

      - name: Verify .deb packages were produced
        run: |
          KERNEL_DEB=$(ls dist/hackeros-kernel-redteam_*.deb 2>/dev/null | head -n1)
          HEADERS_DEB=$(ls dist/hackeros-kernel-headers-redteam_*.deb 2>/dev/null | head -n1)

          if [ -z "$KERNEL_DEB" ]; then
            echo "::error::Brak pakietu jadra w dist/"
            exit 1
          fi
          echo "Pakiet jadra: $KERNEL_DEB"
          dpkg-deb --info "$KERNEL_DEB"

          if [ -n "$HEADERS_DEB" ]; then
            echo "Pakiet naglowkow: $HEADERS_DEB"
            dpkg-deb --info "$HEADERS_DEB"
          else
            echo "::warning::Brak pakietu naglowkow"
          fi

      - name: Upload .deb + signing key artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: hackeros-kernel-redteam-full-deb
          path: |
            dist/*.deb
            build/keys/*.crt
            logs/*.log
          retention-days: 30
          if-no-files-found: warn

  # --- Powiadomienie przez GitHub Issues przy wykryciu niezgodnosci ---
  notify-on-failure:
    name: "Notify on patch failure"
    runs-on: ubuntu-24.04
    needs: [patch-compat-latest, patch-compat-versions]
    if: failure() && github.event_name != 'pull_request'
    permissions:
      issues: write
    steps:
      - name: Create issue on patch incompatibility
        uses: actions/github-script@v7
        with:
          script: |
            const today = new Date().toISOString().split('T')[0];
            const title = `[CI] Patch niezgodny z nowa wersja Linuksa - ${today}`;
            const body = `
            ## Automatyczne wykrycie niezgodnosci patcha

            Workflow **HackerOS Kernel Patch Compatibility** wykryl, ze
            co najmniej jeden patch z patchsetu (35 patchy: cybersec + red team + ostree)
            nie aplikuje sie czysto na aktualnej stabilnej wersji jadra Linux.

            **Data wykrycia:** ${today}
            **Workflow:** ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

            ### Akcja wymagana

            1. Sprawdz log workflow powyzej, ktory patch zawiodl.
            2. Pobierz aktualne pliki zrodlowe: \`lua scripts/test_patches.lua --verbose\`
            3. Zaktualizuj niekompatybilny patch.
            4. Przetestuj lokalnie: \`lua scripts/test_patches.lua --local=./src/linux\`
            5. Commit + PR do branchy \`redteam\`.

            cc @HackerOS-Linux-System
            `;

            const issues = await github.rest.issues.listForRepo({
              owner: context.repo.owner,
              repo: context.repo.repo,
              state: 'open',
              labels: 'patch-compat'
            });

            const existing = issues.data.find(i => i.title.startsWith('[CI] Patch niezgodny'));
            if (!existing) {
              await github.rest.issues.create({
                owner: context.repo.owner,
                repo: context.repo.repo,
                title: title,
                body: body,
                labels: ['patch-compat', 'bug', 'kernel']
              });
            }