storage-runtime-qualification.yml

name: Manual storage runtime qualification (RouteListToTesla)

on:
  workflow_dispatch:
    inputs:
      phase:
        description: "Test-only phase; cache hit requires a prior completed cache miss with the same key and source revision."
        required: true
        type: choice
        options:
          - cache-miss
          - cache-hit
          - hold
          - physical-enospc
      cache_key:
        description: "Safe bounded fixture key. Use a fresh key for each cache-miss/cache-hit pair."
        required: true
        type: string
        default: fixture-v1
      hold_seconds:
        description: "Bounded interval to keep real quota pressure present (1-300 seconds)."
        required: true
        type: string
        default: "30"

permissions:
  contents: read

concurrency:
  group: storage-runtime-${{ github.workflow }}-${{ inputs.cache_key }}
  cancel-in-progress: false

jobs:
  qualify:
    name: RouteListToTesla 32 GiB runtime fixture
    runs-on: truenas-routelisttotesla-storage-32g
    timeout-minutes: 180
    permissions:
      contents: read
    env:
      CI_CACHE_DISABLE: ${{ inputs.phase == 'cache-miss' && '1' || '0' }}
    steps:
      - name: Start BuildKit storage collection
        run: ci-storage-efficiency start

      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          package-manager-cache: false
          node-version: "24"

      - name: Set up authenticated remote BuildKit for cache phases
        if: ${{ inputs.phase == 'cache-miss' || inputs.phase == 'cache-hit' }}
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
        with:
          cache-binary: false
          driver: remote
          endpoint: tcp://buildkit:1234
          driver-opts: |
            cacert=/run/buildkit/tls/ca.pem
            cert=/run/buildkit/tls/client.pem
            key=/run/buildkit/tls/client.key

      - name: Run bounded runtime qualification fixture
        env:
          RUNTIME_QUALIFICATION_TARGET: routelisttotesla
          RUNTIME_QUALIFICATION_PHASE: ${{ inputs.phase }}
          RUNTIME_QUALIFICATION_CACHE_KEY: ${{ inputs.cache_key }}
          RUNTIME_QUALIFICATION_HOLD_SECONDS: ${{ inputs.hold_seconds }}
        run: node .github/scripts/ci-storage-runtime-qualification.mjs

      - name: Finish and enforce BuildKit storage usage
        if: always()
        run: ci-storage-efficiency finish

      - name: Format bounded plaintext runtime and storage evidence
        id: storage_log
        if: always()
        run: |
          python3 .github/scripts/format-storage-evidence.py \
            --output "$RUNNER_TEMP/ci-storage-evidence.log" \
            --repository "$GITHUB_REPOSITORY" --revision "$GITHUB_SHA" \
            --runtime-input "$RUNNER_TEMP/storage-runtime-qualification.json" \
            --usage-input "$RUNNER_TEMP/ci-storage-usage-start.json" \
            --usage-input "$RUNNER_TEMP/ci-storage-usage.json"
      - name: Upload bounded runtime and storage log
        if: ${{ always() && steps.storage_log.outputs.available == 'true' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ci-log-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
          path: ${{ runner.temp }}/ci-storage-evidence.log
          if-no-files-found: error
          retention-days: 1

  cleanup-artifacts:
    name: Remove transient build artifacts
    needs: ["qualify"]
    if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
    runs-on: truenas-routelisttotesla-storage-8g
    timeout-minutes: 10
    permissions:
      actions: write
      contents: read
    steps:
      - name: Check out trusted default branch cleanup code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false
      - name: Set up Python for bounded cleanup
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.13'
      - name: Delete non-retained current-run artifacts
        env:
          GH_TOKEN: ${{ github.token }}
        run: python3 .github/scripts/cleanup-actions-artifacts.py --current