infrastructure-repository-update.yml

name: "Infrastructure: APT repositories update"
on:
  workflow_dispatch:
    inputs:
      purge_external:
        description: 'Purge external packages before download'
        required: true
        type: boolean
        default: true
      download_external:
        description: 'Download external packages'
        required: true
        type: boolean
        default: true
  repository_dispatch:
    types: ["Repository update"]

env:
  STORAGE_PATH: /armbian/openssh-server/storage
  INCOMING_PATH: /armbian/openssh-server/storage/incoming
  PUBLISHING_PATH: /publishing/repository
  CLEANUP_INPUT: true
  DRY_RUN_SYNC: false

concurrency:
  group: pipeline
  cancel-in-progress: false

jobs:

  Check:
    name: "Check membership" # Only release manager can execute this manually
    runs-on: Linux
    steps:

      - name: "Check membership"
        uses: armbian/actions/team-check@main
        with:
          ORG_MEMBERS: ${{ secrets.ORG_MEMBERS }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TEAM: "Release manager"

  external:
    name: "Download external (chunk ${{ matrix.chunk_index }}/4)"
    needs: Check
    # Fan out across 4 chunks. The child workflow filters its matrix to
    # only entries where `index % CHUNK_COUNT == CHUNK_INDEX`, so each
    # invocation stays under GitHub Actions' 256-entry strategy.matrix
    # cap. Effective concurrency is 4 × max-parallel (180) = 720.
    # Bump `chunk_index` and `CHUNK_COUNT` together when total packages
    # × arches × releases approaches 4 × 256 = 1024.
    strategy:
      fail-fast: false
      matrix:
        chunk_index: [0, 1, 2, 3]
    uses: armbian/armbian.github.io/.github/workflows/infrastructure-download-external.yml@main
    with:
      ENABLED: ${{ inputs.download_external != false || github.event.client_payload.download_external != false }}
      SKIP_VERSION_CHECK: false
      ACCESS_NAME: armbian
      BUILD_RUNNER: "docker"
      HOST_DEPLOY: "repo.armbian.com"
      PURGE: ${{ inputs.purge_external || false }}
      CHUNK_INDEX: ${{ matrix.chunk_index }}
      CHUNK_COUNT: 4
    secrets:
      GPG_KEY1: ${{ secrets.GPG_KEY3 }}
      GPG_KEY2: ${{ secrets.GPG_KEY4 }}
      ACCESS_TOKEN: ${{ secrets.ACCESS_TOKEN }}
      KEY_UPLOAD: ${{ secrets.KEY_UPLOAD }}
      HOST_UPLOAD: ${{ secrets.HOST_UPLOAD }}
      HOST_UPLOAD_USER: ${{ secrets.HOST_UPLOAD_USER }}
      HOST_UPLOAD_PORT: ${{ secrets.HOST_UPLOAD_PORT }}
      KNOWN_HOSTS_ARMBIAN_UPLOAD: ${{ secrets.KNOWN_HOSTS_ARMBIAN_UPLOAD }}

  Copying:
    needs: external
    runs-on: repository
    steps:

      - name: Delete empty folders in INCOMING_PATH
        run: |

          sudo find "${{ env.INCOMING_PATH }}" -type d -empty -delete

      - name: Display STORAGE_PATH tree structure
        run: |

          tree ${{ env.INCOMING_PATH }} || find ${{ env.INCOMING_PATH }} -print | sed -e 's;[^/]*/;|____;g;s;____|; |;g'

      - name: Generate statistical report for .deb files in INCOMING_PATH
        run: |
          echo '## Incoming .deb Files Report' >> $GITHUB_STEP_SUMMARY
          echo '' >> $GITHUB_STEP_SUMMARY
          echo '| Folder | File Count | Total Size |' >> $GITHUB_STEP_SUMMARY
          echo '|:-------|-----------:|----------:|' >> $GITHUB_STEP_SUMMARY

          for folder_path in "${{ env.INCOMING_PATH }}"/*/; do
            folder=$(basename "$folder_path")
            if [ -d "$folder_path" ]; then
              file_count=$(find "$folder_path" -type f -name "*.deb" | wc -l)
              if [ "$file_count" -gt 0 ]; then
                total_size_kb=$(du -sk "$folder_path" | cut -f1)
                total_size_mb=$(awk "BEGIN {printf \"%.0f Mb\", $total_size_kb / 1024}")
              else
                total_size_mb="0 Mb"
              fi
              printf "| %-7s | %10d | %13s |\n" "$folder" "$file_count" "$total_size_mb" >> $GITHUB_STEP_SUMMARY
            fi
          done

      - name: Checkout build repository
        uses: actions/checkout@v6

      - name: Copy operations
        run: |

          TARGET="${{ github.event.client_payload.target }}"
          # Default to cron/ if target is not set
          if [ -z "$TARGET" ]; then
            TARGET="cron/"
          fi

          case "$TARGET" in
            "stable/")
              if [ -d "${INCOMING_PATH}/stable" ]; then
                COPY_UBOOT=false \
                DRY_RUN=true \
                SELECT=':edge' \
                SRC_DIR="${{ env.INCOMING_PATH }}"/nightly/debs-beta/ \
                DST_DIR=/tmp/x \
                scripts/copy-kernel-packages.sh 2>&1 | tee -a $GITHUB_STEP_SUMMARY
              else
                echo "## Source folder INCOMING/stable does not exist, skipping" >> $GITHUB_STEP_SUMMARY
              fi
              ;;
            "cron/")
              # move what is inside incoming
              if [ -d "${INCOMING_PATH}/cron" ]; then
                echo "## Fixing STORAGE_PATH permissions" >> $GITHUB_STEP_SUMMARY
                sudo chmod -R g+w ${STORAGE_PATH} 2>&1 | tee -a $GITHUB_STEP_SUMMARY
                echo "## Rsync from INCOMING/cron to STORAGE_PATH" >> $GITHUB_STEP_SUMMARY
                rsync -av --omit-dir-times --no-perms --no-group ${INCOMING_PATH}/cron/ ${STORAGE_PATH} 2>&1 | tee -a $GITHUB_STEP_SUMMARY || echo "Warning: Some files/attrs were not transferred (code 23)" >> $GITHUB_STEP_SUMMARY
                echo "## Removing source INCOMING/cron" >> $GITHUB_STEP_SUMMARY
                rm -rf ${INCOMING_PATH}/cron 2>&1 | tee -a $GITHUB_STEP_SUMMARY
              else
                echo "## Source folder INCOMING/cron does not exist, skipping" >> $GITHUB_STEP_SUMMARY
              fi
              ;;
            "nightly/")
              :
              ;;
            "generic/")
              :
              ;;
            "apps/")
              :
              ;;
            "community/")
              :
              ;;
            *)
              :
              ;;
          esac

          # Always sync external
          if [ -d "${INCOMING_PATH}/external/debs" ]; then
              echo "## Copy external debs "
              rsync -av \
              --include='*/' \
              --include='*.deb' \
              --exclude='*' \
              --omit-dir-times --no-perms --no-group \
              "${INCOMING_PATH}/external/debs/" "${STORAGE_PATH}/debs/" \
              2>&1 | tee -a "$GITHUB_STEP_SUMMARY" || \
              echo "Warning: Some files/attrs were not transferred (code 23)" >> "$GITHUB_STEP_SUMMARY"
          fi
          if [ -d "${INCOMING_PATH}/external/debs-beta" ]; then
              echo "## Copy external debs-beta "
              rsync -av \
              --include='*/' \
              --include='*.deb' \
              --exclude='*' \
              --omit-dir-times --no-perms --no-group \
              "${INCOMING_PATH}/external/debs-beta/" "${STORAGE_PATH}/debs-beta/" \
              2>&1 | tee -a "$GITHUB_STEP_SUMMARY" || \
              echo "Warning: Some files/attrs were not transferred (code 23)" >> "$GITHUB_STEP_SUMMARY"
          fi

  prepare-repos:
    name: "Prepare repositories"
    needs: Copying
    runs-on: repository
    steps:
      - name: Checkout build repository
        uses: actions/checkout@v6
        with:
          repository: armbian/build
          path: build
          clean: false

      - name: Checkout armbian.github.io repository
        uses: actions/checkout@v6
        with:
          repository: armbian/armbian.github.io
          path: armbian-github-io
          clean: false

      - name: Copy example.deb to repository subfolders
        run: |

          # Get all supported releases from build config
          ALL_RELEASES=($(grep -rw build/config/distributions/*/support -ve 'eos' | cut -d"/" -f4))
          echo "Found ${#ALL_RELEASES[@]} releases: ${ALL_RELEASES[*]}" | tee -a $GITHUB_STEP_SUMMARY


          sudo cp build/tools/repository/example.deb "${{ env.STORAGE_PATH }}/debs/$RELEASE/"
          sudo cp build/tools/repository/example.deb "${{ env.STORAGE_PATH }}/debs-beta/$RELEASE/"

          # Copy example.deb to all subfolders for debs
          for RELEASE in "${ALL_RELEASES[@]}"; do
            echo "Copying example.deb for debs/$RELEASE and subfolders" | tee -a $GITHUB_STEP_SUMMARY
            mkdir -p "${{ env.STORAGE_PATH }}/debs/extra/$RELEASE-utils"
            mkdir -p "${{ env.STORAGE_PATH }}/debs/extra/$RELEASE-desktop"
            sudo cp build/tools/repository/example.deb "${{ env.STORAGE_PATH }}/debs/extra/$RELEASE-utils/"
            sudo cp build/tools/repository/example.deb "${{ env.STORAGE_PATH }}/debs/extra/$RELEASE-desktop/"
          done

          # Copy example.deb to all subfolders for debs-beta
          for RELEASE in "${ALL_RELEASES[@]}"; do
            echo "Copying example.deb for debs-beta/$RELEASE and subfolders" | tee -a $GITHUB_STEP_SUMMARY
            mkdir -p "${{ env.STORAGE_PATH }}/debs-beta/extra/$RELEASE-utils"
            mkdir -p "${{ env.STORAGE_PATH }}/debs-beta/extra/$RELEASE-desktop"
            sudo cp build/tools/repository/example.deb "${{ env.STORAGE_PATH }}/debs-beta/extra/$RELEASE-utils/"
            sudo cp build/tools/repository/example.deb "${{ env.STORAGE_PATH }}/debs-beta/extra/$RELEASE-desktop/"
          done

  fix-permissions:
    name: "Fix permissions"
    needs: prepare-repos
    runs-on: repository
    strategy:
      matrix:
        repository:
          - name: debs
    steps:
      - name: "Set group write permissions for ${{ matrix.repository.name }}"
        shell: bash
        run: |
          set -e
          set -o pipefail

          REPO_PATH="${{ env.PUBLISHING_PATH }}-${{ matrix.repository.name }}"
          SHARED_GROUP="${SHARED_GROUP:-gha-runners}"

          # Validate path to prevent accidental operations
          case "$REPO_PATH" in
            *"/publishing/repository"*)
              # Path is valid
              ;;
            *)
              echo "::error::Invalid repository path: $REPO_PATH"
              echo "::error::Path must be under /publishing/repository"
              exit 1
              ;;
          esac

          echo "### Setting permissions for ${{ matrix.repository.name }}" | tee -a "$GITHUB_STEP_SUMMARY"
          echo ""
          echo "Repository path: $REPO_PATH" | tee -a "$GITHUB_STEP_SUMMARY"

          # Check if the specified group exists
          if getent group "$SHARED_GROUP" >/dev/null 2>&1; then
            echo "Shared group: $SHARED_GROUP" | tee -a "$GITHUB_STEP_SUMMARY"
          else
            echo "⚠ Shared group '$SHARED_GROUP' does not exist, skipping group-specific operations" | tee -a "$GITHUB_STEP_SUMMARY"
            SHARED_GROUP=""
          fi
          echo ""

          if [ -d "$REPO_PATH" ]; then
            echo "Setting cooperative umask (002) for this job..." | tee -a "$GITHUB_STEP_SUMMARY"
            umask 002

            if [ -n "$SHARED_GROUP" ]; then
              echo "Ensuring group ownership is $SHARED_GROUP (recursive)..." | tee -a "$GITHUB_STEP_SUMMARY"
              sudo chgrp -R "$SHARED_GROUP" "$REPO_PATH" || true
            fi

            echo "Setting directories to group-writable and setgid (2775)..." | tee -a "$GITHUB_STEP_SUMMARY"
            sudo find "$REPO_PATH" -type d -print0 \
              | xargs -0 -r -P 8 sudo chmod -- 2775 2>/dev/null || true

            echo "Ensuring files are group-writable (g+w)..." | tee -a "$GITHUB_STEP_SUMMARY"
            sudo find "$REPO_PATH" -type f ! -perm -g+w -print0 \
              | xargs -0 -r -P 8 sudo chmod -- g+w 2>/dev/null || true

            if [ -n "$SHARED_GROUP" ] && command -v setfacl >/dev/null 2>&1; then
              echo "Setting default ACLs so new files/dirs keep group rwX (recommended)..." | tee -a "$GITHUB_STEP_SUMMARY"
              sudo setfacl -R  -m "g:${SHARED_GROUP}:rwX" "$REPO_PATH" || true
              sudo setfacl -R -d -m "g:${SHARED_GROUP}:rwX" "$REPO_PATH" || true
              echo "✓ ACLs applied" | tee -a "$GITHUB_STEP_SUMMARY"
            elif [ -z "$SHARED_GROUP" ]; then
              echo "⚠ No valid shared group, skipping ACLs" | tee -a "$GITHUB_STEP_SUMMARY"
            else
              echo "⚠ setfacl not available; skipping ACLs" | tee -a "$GITHUB_STEP_SUMMARY"
            fi

            echo "Checking for sticky bit directories (can block deleting others' files)..." | tee -a "$GITHUB_STEP_SUMMARY"
            STICKY_DIRS="$(sudo find "$REPO_PATH" -type d -perm -1000 -print | head -n 20 || true)"
            if [ -n "$STICKY_DIRS" ]; then
              echo "⚠ Sticky-bit dirs found (sample):" | tee -a "$GITHUB_STEP_SUMMARY"
              echo "$STICKY_DIRS" | sed 's/^/  - /' | tee -a "$GITHUB_STEP_SUMMARY"
              echo "  If you want shared deletion, remove sticky bit: sudo chmod -t <dir>" | tee -a "$GITHUB_STEP_SUMMARY"
            else
              echo "✓ No sticky-bit dirs detected" | tee -a "$GITHUB_STEP_SUMMARY"
            fi

            echo "" | tee -a "$GITHUB_STEP_SUMMARY"
            echo "✓ Permissions updated (dirs 2775, files g+w, setgid enabled, umask 002 set)" | tee -a "$GITHUB_STEP_SUMMARY"
          else
            echo "Repository path does not exist yet: $REPO_PATH" | tee -a "$GITHUB_STEP_SUMMARY"
          fi

          echo "" | tee -a "$GITHUB_STEP_SUMMARY"

  prepare-beta:
    name: "Prepare beta repository"
    needs: fix-permissions
    runs-on: repository
    steps:
      - name: "Remove and recreate beta repository"
        shell: bash
        run: |
          set -e
          set -o pipefail

          BETA_REPO_PATH="${{ env.PUBLISHING_PATH }}-debs-beta"

          # Validate path to prevent accidental deletion
          # Ensure it's under the expected publishing path
          case "$BETA_REPO_PATH" in
            *"/publishing/repository"*)
              # Path is valid - contains expected parent path
              ;;
            *)
              echo "::error::Invalid beta repository path: $BETA_REPO_PATH"
              echo "::error::Path must be under /publishing/repository"
              exit 1
              ;;
          esac

          echo "### Preparing beta repository" | tee -a "$GITHUB_STEP_SUMMARY"
          echo ""
          echo "Target path: $BETA_REPO_PATH" | tee -a "$GITHUB_STEP_SUMMARY"
          echo ""

          # Remove existing beta repository to start fresh
          if [ -d "$BETA_REPO_PATH" ]; then
            echo "Removing existing beta repository: $BETA_REPO_PATH" | tee -a "$GITHUB_STEP_SUMMARY"

            # Additional safety check: ensure it's a symlink or directory, not a file
            if [ -L "$BETA_REPO_PATH" ] || [ -d "$BETA_REPO_PATH" ]; then
              # Use rm with one trailing slash to prevent accidental matches
              # The trailing slash ensures we only delete if it's a directory/symlink to directory
              sudo rm -rf "${BETA_REPO_PATH}/"
            else
              echo "::error::Path exists but is not a directory or symlink: $BETA_REPO_PATH"
              exit 1
            fi
          else
            echo "Beta repository does not exist yet: $BETA_REPO_PATH" | tee -a "$GITHUB_STEP_SUMMARY"
          fi

          # Create fresh beta repository directory
          echo "Creating fresh beta repository directory" | tee -a "$GITHUB_STEP_SUMMARY"
          sudo mkdir -p "$BETA_REPO_PATH"

          # Verify directory was created
          if [ ! -d "$BETA_REPO_PATH" ]; then
            echo "::error::Failed to create beta repository directory: $BETA_REPO_PATH"
            exit 1
          fi

          echo "" | tee -a "$GITHUB_STEP_SUMMARY"
          echo "✓ Beta repository prepared" | tee -a "$GITHUB_STEP_SUMMARY"

  update-repository:
    needs: prepare-beta
    name: "Update ${{ matrix.repository.name }}"
    runs-on: repository
    strategy:
      matrix:
        repository:
          - name: debs
          - name: debs-beta
    steps:

      - name: Fix workspace ownership
        if: always()
        run: |
          sudo chown -R "$(id -u)":"$(id -g)" "$GITHUB_WORKSPACE" || true

      - name: Runner clean
        uses: armbian/actions/runner-clean@main

      - name: Import GPG key
        uses: crazy-max/ghaction-import-gpg@v7
        with:
          gpg_private_key: ${{ secrets.GPG_KEY3 }}

      - name: Import GPG key
        uses: crazy-max/ghaction-import-gpg@v7
        with:
          gpg_private_key: ${{ secrets.GPG_KEY4 }}

      - name: Checkout build repository
        uses: actions/checkout@v6
        with:
          repository: armbian/build
          fetch-depth: 1
          ref: singlemode
          clean: false

      - name: "Update repository ${{ matrix.repository.name }}"
        shell: bash
        run: |
          set -e
          set -o pipefail

          STORAGE_PATH="${{ env.STORAGE_PATH }}"
          PUBLISH_PATH="${{ env.PUBLISHING_PATH }}"
          REPO_NAME="${{ matrix.repository.name }}"

          # Validate paths to prevent accidental operations
          case "$STORAGE_PATH" in
            *"/armbian/openssh-server/storage"*)
              # Path is valid
              ;;
            *)
              echo "::error::Invalid storage path: $STORAGE_PATH"
              echo "::error::Path must be under /armbian/openssh-server/storage"
              exit 1
              ;;
          esac

          case "$PUBLISH_PATH" in
            *"/publishing/repository"*)
              # Path is valid
              ;;
            *)
              echo "::error::Invalid publishing path: $PUBLISH_PATH"
              echo "::error::Path must be under /publishing/repository"
              exit 1
              ;;
          esac

          INPUT_DIR="${STORAGE_PATH}/${REPO_NAME}"
          OUTPUT_DIR="${PUBLISH_PATH}-${REPO_NAME}"

          echo "### Checking for .deb files in $REPO_NAME" | tee -a "$GITHUB_STEP_SUMMARY"
          echo ""
          echo "Input directory: $INPUT_DIR" | tee -a "$GITHUB_STEP_SUMMARY"
          echo ""

          # Validate input directory exists
          if [ ! -d "$INPUT_DIR" ]; then
            echo "::notice::Input directory does not exist: $INPUT_DIR"
            exit 0
          fi

          # Count .deb files in incoming directory
          DEB_COUNT=$(find "$INPUT_DIR" -type f -name "*.deb" 2>/dev/null | wc -l)
          echo "Found ${DEB_COUNT} .deb files" | tee -a "$GITHUB_STEP_SUMMARY"
          echo ""

          # Only run repo.sh if there are files to process
          if [ "${DEB_COUNT}" -gt 0 ]; then
            echo "Running sequential repository update..." | tee -a "$GITHUB_STEP_SUMMARY"
            tools/repository/repo.sh \
              -c update \
              -k \
              -i "$INPUT_DIR" \
              -o "$OUTPUT_DIR"
          else
            echo "::notice::No .deb files found, skipping repository update"
          fi

  cleanup:
    name: "Clean input"
    needs: update-repository
    runs-on: repository
    strategy:
      matrix:
        repository:
          - name: debs
          - name: debs-beta
    steps:
      - name: "Cleanup for ${{ matrix.repository.name }}"
        shell: bash
        run: |
          set -e
          set -o pipefail

          # Check if cleanup is enabled via environment variable
          if [ "${CLEANUP_INPUT}" != "true" ]; then
            echo "### Cleanup disabled" | tee -a "$GITHUB_STEP_SUMMARY"
            echo "CLEANUP_INPUT is set to: ${CLEANUP_INPUT}" | tee -a "$GITHUB_STEP_SUMMARY"
            echo "Set CLEANUP_INPUT to 'true' to enable cleanup" | tee -a "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          INPUT_DIR="${{ env.STORAGE_PATH }}/${{ matrix.repository.name }}"

          # Validate path to prevent accidental deletion
          # Ensure it's under the expected storage path
          case "$INPUT_DIR" in
            *"/armbian/openssh-server/storage"*)
              # Path is valid - contains expected parent path
              ;;
            *)
              echo "::error::Invalid input directory path: $INPUT_DIR"
              echo "::error::Path must be under /armbian/openssh-server/storage"
              exit 1
              ;;
          esac

          echo "### Cleanup for ${{ matrix.repository.name }}" | tee -a "$GITHUB_STEP_SUMMARY"
          echo ""
          echo "Input directory: $INPUT_DIR" | tee -a "$GITHUB_STEP_SUMMARY"
          echo ""

          # Check if directory exists
          if [ ! -d "${INPUT_DIR}" ]; then
            echo "::warning::Directory ${INPUT_DIR} does not exist"
            exit 0
          fi

          # Additional safety check: ensure it's actually a directory, not a file
          if [ -f "${INPUT_DIR}" ]; then
            echo "::error::Path exists but is a file, not a directory: $INPUT_DIR"
            exit 1
          fi

          # Count .deb files before deletion (use sudo since files are owned by different user)
          # Search recursively in subdirectories
          DEB_COUNT=$(sudo find "${INPUT_DIR}" -type f -name "*.deb" 2>/dev/null | wc -l)
          echo "Found ${DEB_COUNT} .deb files to delete" | tee -a "$GITHUB_STEP_SUMMARY"
          echo ""

          if [ "${DEB_COUNT}" -eq 0 ]; then
            echo "No files to delete" | tee -a "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          # Delete all .deb files recursively (use sudo since files are owned by different user)
          # Use -print0 and xargs for safer handling of filenames with spaces
          echo "Deleting .deb files..." | tee -a "$GITHUB_STEP_SUMMARY"
          sudo find "${INPUT_DIR}" -type f -name "*.deb" -print0 \
            | xargs -0 -r sudo rm -fv

          # Verify deletion
          REMAINING=$(sudo find "${INPUT_DIR}" -type f -name "*.deb" 2>/dev/null | wc -l)
          echo ""
          echo "✓ Deleted ${DEB_COUNT} .deb files" | tee -a "$GITHUB_STEP_SUMMARY"
          echo "Remaining files: ${REMAINING}" | tee -a "$GITHUB_STEP_SUMMARY"

          # Warn if deletion failed (files remain)
          if [ "${REMAINING}" -gt 0 ]; then
            echo "::warning::Some files could not be deleted. ${REMAINING} files remaining."
            exit 1
          fi

  Redirect:
    name: "Switch redirector to primary mirrors"
    # Full redirecor config is updated with cron eventually
    needs: cleanup
    runs-on: ubuntu-latest
    steps:
      - name: Install SSH key + known_hosts (task two)
        uses: shimataro/ssh-key-action@v2
        with:
          key: ${{ secrets.KEY_REDI_TASK_TWO }}
          known_hosts: ${{ secrets.KNOWN_HOSTS_REDI }}
          name: redi_task_two

      - name: Reload redirector
        shell: bash
        env:
          REDI_HOST: "redi@${{ secrets.HOST_REDI }}"   # e.g. user@host
          REDI_PORT: 22   # optional
        run: |
          set -euo pipefail
          PORT="${REDI_PORT:-22}"
          : "${REDI_HOST:?Set vars.REDI_HOST (e.g. user@host)}"
          ssh \
            -i ~/.ssh/redi_task_two \
            -p "$PORT" \
            -o BatchMode=yes \
            -o IdentitiesOnly=yes \
            -o StrictHostKeyChecking=yes \
            -o UserKnownHostsFile=~/.ssh/known_hosts \
            "$REDI_HOST" </dev/null

  Prepare:
    name: "Upload to servers"
    needs: Redirect
    outputs:
      matrix: ${{steps.json.outputs.JSON_CONTENT}}
    runs-on: ubuntu-latest
    steps:

      - name: Get primary mirrors from database
        id: json
        shell: bash
        run: |
          set -e
          set -o pipefail

          # Validate that required secrets are available
          if [[ -z "${{ secrets.NETBOX_API }}" || "${{ secrets.NETBOX_API }}" == "" ]]; then
            echo "::error::NETBOX_API secret is not set or is empty"
            exit 1
          fi

          if [[ -z "${{ secrets.NETBOX_TOKEN }}" || "${{ secrets.NETBOX_TOKEN }}" == "" ]]; then
            echo "::error::NETBOX_TOKEN secret is not set or is empty"
            exit 1
          fi

          # Validate API URL format to prevent SSRF
          NETBOX_API="${{ secrets.NETBOX_API }}"
          if [[ ! "$NETBOX_API" =~ ^https?:// ]]; then
            echo "::error::NETBOX_API must start with http:// or https://"
            exit 1
          fi

          echo "### Fetching mirror list from NetBox" | tee -a "$GITHUB_STEP_SUMMARY"
          echo ""

          # Build query with proper filtering
          API_URL="${NETBOX_API}/virtualization/virtual-machines/?limit=500&name__empty=false&device_role=Mirror&tag=push&status=active"

          # Fetch data with timeout and security options
          echo "Querying: $API_URL" | tee -a "$GITHUB_STEP_SUMMARY"

          response=$(curl -fsSL \
            --max-time 30 \
            --connect-timeout 10 \
            -H "Authorization: Token ${{ secrets.NETBOX_TOKEN }}" \
            -H "Accept: application/json" \
            "$API_URL" 2>&1)

          curl_exit_code=$?

          if [[ $curl_exit_code -ne 0 ]]; then
            echo "::error::Failed to fetch data from NetBox API (curl exit code: $curl_exit_code)"
            echo "::error::Response: $response"
            exit 1
          fi

          # Validate JSON response
          if ! echo "$response" | jq empty 2>/dev/null; then
            echo "::error::Invalid JSON response from NetBox API"
            echo "::error::Response: $response"
            exit 1
          fi

          # Extract mirror names and build enriched JSON with server configuration
          # This avoids repeated NetBox API calls in downstream matrix jobs
          mirror_json=$(echo "$response" | jq -r '.results[] | {
            name: .name,
            path: .custom_fields.path,
            port: .custom_fields.port,
            username: .custom_fields.username
          } | select(.path != null and .port != null and .username != null)' | jq -s '.' 2>/dev/null)

          if [[ -z "$mirror_json" || "$mirror_json" == "null" || "$mirror_json" == "[]" ]]; then
            echo "::warning::No mirrors found in NetBox API response"
            echo 'JSON_CONTENT<<EOF' >> $GITHUB_OUTPUT
            echo '[]' >> $GITHUB_OUTPUT
            echo 'EOF' >> $GITHUB_OUTPUT
          else
            # Count mirrors
            mirror_count=$(echo "$mirror_json" | jq 'length')
            echo "Found $mirror_count active mirrors" | tee -a "$GITHUB_STEP_SUMMARY"

            # Validate JSON structure
            if ! echo "$mirror_json" | jq empty 2>/dev/null; then
              echo "::error::Failed to format mirror list as JSON"
              exit 1
            fi

            # Output to GitHub Actions
            echo "JSON_CONTENT<<EOF" >> $GITHUB_OUTPUT
            echo "$mirror_json" >> $GITHUB_OUTPUT
            echo 'EOF' >> $GITHUB_OUTPUT

            # List mirrors in summary
            echo "" | tee -a "$GITHUB_STEP_SUMMARY"
            echo "Mirror servers:" | tee -a "$GITHUB_STEP_SUMMARY"
            echo "$mirror_json" | jq -r '.[].name' | sed 's/^/  - /' | tee -a "$GITHUB_STEP_SUMMARY"
          fi

  Sync:
    name: "F"
    runs-on: repository-sync
    needs: Prepare
    outputs:
      matrix: ${{needs.Prepare.outputs.matrix}}
    if: ${{ needs.Prepare.outputs.matrix != '[]' && needs.Prepare.outputs.matrix != '' }}
    timeout-minutes: 90
    strategy:
      max-parallel: 8
      fail-fast: false
      matrix:

        node: ${{fromJson(needs.Prepare.outputs.matrix)}}

    steps:

      - name: Fix workspace ownership
        run: |
          sudo chown -R "$(id -u)":"$(id -g)" "$GITHUB_WORKSPACE" || true

      - name: Checkout
        uses: actions/checkout@v6

      - name: Install SSH key
        uses: shimataro/ssh-key-action@v2
        with:
          key: ${{ secrets.KEY_UPLOAD }}
          known_hosts: ${{ secrets.KNOWN_HOSTS_ARMBIAN_UPLOAD }}
          if_key_exists: replace

      - name: Sync packages
        shell: bash
        run: |
          set -e
          set -o pipefail

          # Export environment variables for the script
          export MATRIX_NODE_NAME="${{ matrix.node.name }}"
          export MATRIX_NODE_PATH="${{ matrix.node.path }}"
          export MATRIX_NODE_PORT="${{ matrix.node.port }}"
          export MATRIX_NODE_USERNAME="${{ matrix.node.username }}"
          export NETBOX_API="${{ secrets.NETBOX_API }}"
          export NETBOX_TOKEN="${{ secrets.NETBOX_TOKEN }}"
          export PUBLISHING_PATH="${{ env.PUBLISHING_PATH }}"
          export DRY_RUN_SYNC="${{ env.DRY_RUN_SYNC }}"

          # Run sync script for files
          scripts/sync-repository.sh files

  Index:
    name: "I"
    runs-on: repository-sync
    needs: Sync
    if: ${{ needs.Sync.outputs.matrix != '[]' && needs.Sync.outputs.matrix != '' }}
    timeout-minutes: 60
    strategy:
      max-parallel: 8
      fail-fast: false
      matrix:

        node: ${{fromJson(needs.Sync.outputs.matrix)}}

    steps:

      - name: Fix workspace ownership
        run: |
          sudo chown -R "$(id -u)":"$(id -g)" "$GITHUB_WORKSPACE" || true

      - name: Checkout
        uses: actions/checkout@v6

      - name: Install SSH key
        uses: shimataro/ssh-key-action@v2
        with:
          key: ${{ secrets.KEY_UPLOAD }}
          known_hosts: ${{ secrets.KNOWN_HOSTS_ARMBIAN_UPLOAD }}
          if_key_exists: replace

      - name: Sync indices
        shell: bash
        run: |
          set -e
          set -o pipefail

          # Export environment variables for the script
          export MATRIX_NODE_NAME="${{ matrix.node.name }}"
          export MATRIX_NODE_PATH="${{ matrix.node.path }}"
          export MATRIX_NODE_PORT="${{ matrix.node.port }}"
          export MATRIX_NODE_USERNAME="${{ matrix.node.username }}"
          export NETBOX_API="${{ secrets.NETBOX_API }}"
          export NETBOX_TOKEN="${{ secrets.NETBOX_TOKEN }}"
          export PUBLISHING_PATH="${{ env.PUBLISHING_PATH }}"
          export DRY_RUN_SYNC="${{ env.DRY_RUN_SYNC }}"

          # Run sync script for index
          scripts/sync-repository.sh index

  dispatch:
    name: "Refresh web and redirector index"
    if: ${{ github.repository_owner == 'Armbian' }}
    needs: Index
    runs-on: ubuntu-latest
    steps:

      - name: "Run redirector update action"
        uses: peter-evans/repository-dispatch@v4
        with:
          token: ${{ secrets.DISPATCH }}
          repository: armbian/armbian.github.io
          event-type: "Infrastructure: Update redirector"