sync.yml

name: sync

on:
  push:

env:
  GIT_CONFIG_PARAMETERS: "'user.name=Git for Windows Build Agent' 'user.email=ci@git-for-windows.build' 'windows.sdk64.path=${{ github.workspace }}' 'windows.sdk32.path=' 'http.sslbackend=schannel' 'core.autocrlf=false' 'checkout.workers=16'"
  HOME: "${{ github.workspace }}\\home\\git-ci"
  MSYSTEM: MSYS

jobs:
  sync:
    if: github.repository_owner == 'git-for-windows' || github.event.inputs.debug_with_ssh_key != ''
    runs-on: [Windows, ARM64]
    environment: sync
    steps:
      - name: clone git-sdk-arm64
        uses: actions/checkout@v4
        with:
          persist-credentials: true
          token: ${{ secrets.PUSH_TOKEN }}
      - name: download patched MSYS2 runtime
        id: download
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          # Only do this if `pacman` is prevented from being upgraded
          grep '^ *IgnorePkg *= *pacman' etc/pacman.conf || exit 0

          cat >/dev/null <<\EOF
          sha="$(gh api repos/git-for-windows/msys2-runtime/pulls/73 \
               --jq '.head.sha')" &&
          check_run_url="$(gh api repos/git-for-windows/msys2-runtime/commits/$sha/check-runs \
                         --jq '.check_runs[] | select(.name=="build") | .url')" &&
          workflow_job_url="$(gh api "${check_run_url#https://api.github.com/}" --jq '.details_url')" &&
          workflow_run_url="${workflow_job_url%/job/*}" &&
          artifacts_url="$(gh api "repos/${workflow_run_url#https://github.com/}" --jq '.artifacts_url')" &&
          zip_url="$(gh api "${artifacts_url#https://api.github.com/}" --jq '.artifacts[].archive_download_url')"
          EOF
          zip_url=https://api.github.com/repos/git-for-windows/msys2-runtime/actions/artifacts/2178808019/zip &&
          curl -H "Authorization: token ${{secrets.GITHUB_TOKEN}}" -#sLo /tmp/install.zip "$zip_url" &&
          echo "result=$(cygpath -aw /tmp/install.zip)" >>$GITHUB_OUTPUT
      - name: unzip MSYS2 runtime
        if: steps.download.outputs.result != ''
        shell: pwsh
        run: "C:\\Windows\\system32\\tar -xf ${{ steps.download.outputs.result }}"
      - name: use git-sdk-arm64's Bash and Git for Windows' git.exe
        run: "usr\\bin\\bash.exe -lc 'cygpath -aw /usr/bin >>$GITHUB_PATH && cygpath -aw /c/Program\\ Files/Git/cmd/ >>$GITHUB_PATH'"
      - name: commit MSYS2 runtime
        shell: bash
        run: |
          # Give the `/etc/profile.d/` scripts a chance to set things up
          bash -lc 'uname -a' &&

          git add -A &&
          git commit -m 'Install patches MSYS2 runtime' &&
          sed -i 's/^*\(IgnorePkg *=\).*/# &/' etc/pacman.conf &&
          git commit -m 'Allow `pacman` to be upgraded again' \
            -m 'It had been overridden with a version that does not deadlock on Windows/ARM64, but now an MSYS2 runtime has been installed that prevents that deadlock in a much better way' \
            etc/pacman.conf &&
          git push origin HEAD
      - name: Update all Pacman packages
        shell: pwsh
        run: |
          & .\update-via-pacman.ps1
      - name: Update all Pacman packages again, for good measure
        shell: pwsh
        run: |
          & .\update-via-pacman.ps1
      - name: use git-sdk-arm64's Bash and Git for Windows' git.exe
        run: "usr\\bin\\bash.exe -lc 'cygpath -aw /usr/bin >>$GITHUB_PATH && cygpath -aw /c/Program\ Files/Git/cmd/ >>$GITHUB_PATH'"
      - name: deal with large DLL files
        shell: bash
        run: |
          set -ex
          large_dlls=$(find clangarm64/bin -size +100M)
          test -n "$large_dlls" || exit 0

          # Okay, we have a problem. GitHub does not like to host files >100MB.
          # But libLLVM-<version>.dll easily blasts through that limit.
          #
          # Ideally, we would use UPX to compress that `.dll`, but there is no
          # support for compressing Windows/ARM64 files using UPX (yet).
          #
          # So let's do the next best thing and `strip` the file. Sadly, we need
          # to download the entire (also *large*) `mingw-w64-x86_64-llvm` to get
          # `llvm-strip.exe` to perform this job because the already-installed
          # `/usr/bin/strip.exe` does not know what to do with Windows/ARM64 files,
          # either.

          pacman -S --noconfirm mingw-w64-x86_64-llvm
          ret=0
          for dll in $large_dlls
          do
            /mingw64/bin/llvm-strip.exe $dll || ret=1
          done
          test 0 = $ret || exit $ret

          # Clean up; We do *not* want the x86_64 LLVM packages in git-sdk-arm64!
          pacman -R --noconfirm $(pacman -Q | grep mingw-w64-x86_64 | cut -f 1 -d ' ')
      - name: commit & push ARM64 SDK
        shell: bash
        run: |
          set -x &&
          PATH=/c/Program\ Files/Git/cmd:/usr/bin:$PATH &&
          sh -x .github/commit-sdk.sh commit &&
          git push origin ${{ github.ref }}
      - name: use MSYS2 for tmate
        if: failure() && github.event.inputs.debug_with_ssh_key != ''
        run: "usr\\bin\\bash.exe -lc 'cygpath -aw /c/msys64/usr/bin >>$GITHUB_PATH'"
      - name: Debug using tmate
        if: failure() && github.event.inputs.debug_with_ssh_key != ''
        shell: bash
        run: |
          # Install tmate
          pacman -Sy --noconfirm tmate openssh &&

          # Restrict SSH access to the "actor", i.e. the GitHub user who triggered this workflow
          mkdir -p ~/.ssh &&
          echo '${{github.event.inputs.debug_with_ssh_key}}' >~/.ssh/authorized_keys &&

          # Generate an SSH key (needed for tmate)
          echo -e 'y\n' | ssh-keygen -q -t rsa -N '' -f ~/.ssh/id_rsa &&

          # Start tmate session
          export CHERE_INVOKING=1 &&
          tmate -S /tmp/tmate.sock -a ~/.ssh/authorized_keys new-session -d &&
          tmate -S /tmp/tmate.sock wait tmate-ready &&

          # Print SSH invocation every 5 seconds, until tmate session has terminated
          while test -e /tmp/tmate.sock
          do
            tmate -S /tmp/tmate.sock display -p '#{tmate_ssh}'
            sleep 5
          done