# The acceptance protocol, as the gate on every pull request into master (Captain Bob, 2026-11-06:
# "failures should not be allowed to be merged to master"). It is .claude/CLAUDE.md's protocol,
# run by the same stages a developer and the nightly run (scripts/nightly.sh), in its order, one
# QEMU at a time:
#
#   amd64, aarch64, riscv64   to [zuse@Hera] ok>, POST: PASSED, `3 4 + .` -> 7 ok
#   the PC stick loaded high  the same; and the three architectures' dict_hash agree
#   the 32-bit build          make -C v4 test-32, 0 failures
#
# master's branch protection requires this check to pass before a PR merges. The serial logs and
# DoE CSVs are kept as the run's artifacts, pass or fail.
name: Acceptance

on:
  pull_request:
    branches: [master]
    types: [opened, synchronize, reopened]
  workflow_dispatch:

concurrency:
  group: qemu                     # every workflow shares this one group: one run at a time,
                                  # a runner-image rebuild included (Captain Bob, 2026-11-07)
  cancel-in-progress: false

jobs:
  acceptance:
    name: Acceptance
    runs-on: ubuntu-latest
    container:
      image: gitea.starshipos-f18.org/rajames/lithosananke-runner:4f675c8b75b2   # ci/runner-image (#120)
      credentials:                # the registry refuses anonymous pulls
        username: rajames
        password: ${{ secrets.PACKAGES_TOKEN }}
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0          # the SBOM's version is git describe
          lfs: false              # only the logs and DoE CSVs are in LFS; the build needs neither

      - name: The capsule-signing key
        env:
          KEY: ${{ secrets.CAPSULE_SIGN_KEY }}
        run: |                    # ci/pki/make-ca.sh; kernel/Makefile signs with SIGN_KEY
          if [ -n "$KEY" ]; then
            f="${RUNNER_TEMP:-/tmp}/capsule-signing.key"
            (umask 077; printf '%s\n' "$KEY" > "$f")
            echo "SIGN_KEY=$f" >> "$GITHUB_ENV"; echo "The capsules will be signed."
          else
            echo "::warning::No CAPSULE_SIGN_KEY secret: the capsules are built unsigned."
          fi

      - name: Acceptance amd64
        run: scripts/nightly.sh accept amd64
      - name: Acceptance aarch64
        run: scripts/nightly.sh accept aarch64
      - name: Acceptance riscv64
        run: scripts/nightly.sh accept riscv64
      - name: Acceptance PC stick loaded high
        run: scripts/nightly.sh accept stick-high
      - name: Acceptance 32-bit build
        run: scripts/nightly.sh test-32

      - name: Keep the logs and DoE CSVs
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: acceptance-logs-${{ github.run_number }}
          path: |
            logs/
            experiments/bare_metal/runs/
            build/nightly/accept-*.txt
            build/nightly/test-32.txt