# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-05-05; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.live.builder
# SPDX-Security-Contact: security@coresecret.eu

# Version Master V8.13.408.2025.11.13

# Gitea Workflow: Shell-Script Linting
#
# This workflow scans all '*.sh', '*.zsh', '*.chroot' and all files with Shebang (#!) for:
# 1. Windows CRLF line endings
# 2. unauthorized control characters (C0 control characters except \t, \n)
# 3. non-ASCII (ambiguous UTF) characters
#
# Findings are collected and at the end of the run with file, line number,
# and the respective character in the Runner output.

name: 🛡️ Shell Script Linting

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

jobs:
  shell-script-linter:
    name: 🛡️ Shell Script Linting
    runs-on: ubuntu-latest

    defaults:
      run:
        shell: bash
        working-directory: ${{ github.workspace }}

    steps:
      - name: 🕑 Waiting random time to desynchronize parallel workflows.
        run: |
          set -euo pipefail
          var_wait=$(( RANDOM % 33 ))
          printf "🕑 Waiting %s seconds to desynchronize parallel workflows...\n" "${var_wait}"
          sleep "${var_wait}"

      - name: ⚙️ Preparing SSH Setup, SSH Deploy Key, Known Hosts, .config.
        run: |
          set +x
          set -euo pipefail
          rm -rf ~/.ssh && mkdir -m0700 ~/.ssh

          ### Private Key
          echo "${{ secrets.SSH_MSW_DEPLOY_CORESECRET_DEV }}" >| ~/.ssh/id_ed25519
          chmod 0600 ~/.ssh/id_ed25519

          ### Scan git.coresecret.dev to fill ~/.ssh/known_hosts
          ssh-keyscan -p 42842 git.coresecret.dev >| ~/.ssh/known_hosts
          chmod 0600 ~/.ssh/known_hosts

          ### Generate SSH Config for git.coresecret.dev Custom-Port
          cat <<EOF >| ~/.ssh/config
          Host git.coresecret.dev
            BatchMode yes
            ConnectTimeout 5
            ControlMaster auto
            ControlPath ~/.ssh/cm-%r@%h:%p
            ControlPersist 5m
            HostName git.coresecret.dev
            IdentityFile ~/.ssh/id_ed25519
            Port 42842
            ServerAliveCountMax 3
            ServerAliveInterval 10
            StrictHostKeyChecking yes
            User git
            UserKnownHostsFile ~/.ssh/known_hosts
          EOF
          chmod 0600 ~/.ssh/config

      ### https://github.com/actions/checkout/issues/1843
      - name: 🔧 Using manual clone via SSH to circumvent Gitea SHA-256 object issues.
        env:
          ### GITHUB_REF_NAME contains the branch name from the push event.
          GITHUB_REF_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          git clone --branch "${GITHUB_REF_NAME}" ssh://git@git.coresecret.dev:42842/msw/CISS.debian.live.builder.git .

      - name: ⚙️ Importing the 'CI PGP DEPLOY ONLY' key.
        run: |
          set -euo pipefail
          ### GPG-Home relative to the Runner Workspace to avoid changing global files.
          export GNUPGHOME="$(PWD)/.gnupg"
          mkdir -m 0700 "${GNUPGHOME}"
          echo "${{ secrets.PGP_MSW_DEPLOY_CORESECRET_DEV }}" >| ci-bot.sec.asc
          gpg --batch --import ci-bot.sec.asc
          ### Trust the key automatically
          KEY_ID=$(gpg --list-keys --with-colons | awk -F: '/^pub:/ {print $5}')
          echo "trust-model always" >| "${GNUPGHOME}/gpg.conf"

      - name: ⚙️ Configuring Git for signed CI/DEPLOY commits.
        run: |
          set -euo pipefail
          export GNUPGHOME="$(PWD)/.gnupg"
          git config user.name "Marc S. Weidner BOT"
          git config user.email "msw+bot@coresecret.dev"
          git config commit.gpgsign true
          git config gpg.program gpg
          git config gpg.format openpgp

      - name: ⚙️ Convert APT sources to HTTPS.
        run: |
          set -euo pipefail
          sed -i 's|http://\(archive\.ubuntu\.com\|security\.ubuntu\.com\)|https://\1|g' /etc/apt/sources.list
          sed -i 's|http://\(archive\.ubuntu\.com\|security\.ubuntu\.com\)|https://\1|g' /etc/apt/sources.list.d/*.list || true

      - name: 🔧 Install dependencies.
        run: |
          ### Install grep with Perl-regex support, falls noch nicht vorhanden
          apt-get update  -qq
          apt-get upgrade -y
          apt-get install -y grep

      - name: 🔍 Lint shell scripts
        run: |
          # -------------------------------
          # STEP 1: Find target files.
          #
          # We capture:
          # - All files '*.sh', '*.zsh', '*.chroot'
          # - All files whose first line begins with "#!" (shebang)
          # -------------------------------
          mapfile -t files_to_check < <(
            find . \
              -path './.git' -prune -o \
              -type f \( \
                -iname '*.sh' -o \
                -iname '*.zsh' -o \
                -iname '*.chroot' -o \
                -exec grep -Iq '^#!' {} \; \
              \) -print
          )

          # -------------------------------
          # STEP 2: Regex definitions
          #
          # - CRLF_REGEX           Carriage Return (\r) for Windows CRLF
          # - CTRL_REGEX           C0 control characters except Tab (\x09) and Newline (\x0A)
          #   - Range:             [\x00-\x08\x0B-\x0C\x0E-\x1F\x7F]
          # - NON_ASCII_REGEX      All bytes -> 0x7F, except emoji characters in defined ranges
          #
          # Emoji ranges that we exclude:
          # - \x{1F300}-\x{1F5FF}  Misc Symbols & Pictographs
          # - \x{1F600}-\x{1F64F}  Emoticons
          # - \x{1F680}-\x{1F6FF}  Transport & Map Symbols
          # - \x{1F900}-\x{1F9FF}  Supplemental Symbols & Pictographs
          # - \x{2600}-\x{26FF}    Miscellaneous Symbols
          # - \x{2700}-\x{27BF}    Dingbats
          # -------------------------------

          CRLF_REGEX=$'\r'
          CTRL_REGEX='[\x00-\x08\x0B-\x0C\x0E-\x1F\x7F]'
          NON_ASCII_REGEX='(?![\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}])[^\x00-\x7F]'

          # -------------------------------
          # STEP 3: Accumulator for findings
          # -------------------------------
          findings=""

          # -------------------------------
          # STEP 4: Perform all checks for each file
          # -------------------------------
          for file in "${files_to_check[@]}"; do
            #
            # 4.1: CRLF detection
            #      grep -nP returns "lineno:<line with CR>"
            # -------------------------------
            while IFS=: read -r lineno _rest; do
              findings+="${file}: CRLF-found at line ${lineno}: <CR>"$'\n'
            done < <(grep -nP "${CRLF_REGEX}" "${file}" || true)

            #
            # 4.2: Unallowed control characters
            #      grep -nP -o returns "lineno:<matched-char>"
            # -------------------------------
            while IFS=: read -r lineno char; do
              findings+="${file}: control-char at line ${lineno}: ${char}"$'\n'
            done < <(grep -nP -o "${CTRL_REGEX}" "${file}" || true)

            #
            # 4.3: Non-ASCII characters with emoji exception
            #      grep -nP -o returns "lineno:<matched-char>"
            # -------------------------------
            while IFS=: read -r lineno char; do
              findings+="${file}: non-ascii at line ${lineno}: ${char}"$'\n'
            done < <(grep -nP -o "${NON_ASCII_REGEX}" "${file}" || true)
          done

          # -------------------------------
          # STEP 5: Output results
          # -------------------------------
          if [[ -n "${findings}" ]]; then
            echo -e "⚠️ Linting issues detected:\n"
            echo -e "${findings}"
            timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
            VAR_DATE="$(date +%F)"
            PRIVATE_FILE="LINTER_RESULTS.txt"
            touch "${PRIVATE_FILE}"
            cat << EOF >| "${PRIVATE_FILE}"
          # SPDX-Version: 3.0
          # SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
          # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
          # SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
          # SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
          # SPDX-FileType: SOURCE
          # SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
          # SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
          # SPDX-PackageName: CISS.debian.live.builder
          # SPDX-Security-Contact: security@coresecret.eu

          This file was automatically generated by the DEPLOY BOT on: "${timestamp}"

          ⚠️ The last linter check was NOT successful. ⚠️

          # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=text
          EOF
          else
            echo "✅ No issues found in shell scripts."
            timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
            VAR_DATE="$(date +%F)"
            PRIVATE_FILE="LINTER_RESULTS.txt"
            touch "${PRIVATE_FILE}"
            cat << EOF >| "${PRIVATE_FILE}"
          # SPDX-Version: 3.0
          # SPDX-CreationInfo: ${VAR_DATE}; WEIDNER, Marc S.; <msw@coresecret.dev>
          # SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
          # SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
          # SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
          # SPDX-FileType: SOURCE
          # SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
          # SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
          # SPDX-PackageName: CISS.debian.live.builder
          # SPDX-Security-Contact: security@coresecret.eu

          This file was automatically generated by the DEPLOY BOT on: "${timestamp}"

          ✅ The last linter check was successful. ✅

          # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=text
          EOF
          fi

      - name: 🚧 Stash local changes (including untracked).
        env:
          GIT_SSH_COMMAND: "ssh -p 42842"
        run: |
          set -euo pipefail
          ### Temporarily store any local modifications or untracked files.
          git stash push --include-untracked -m "ci-temp" || echo "✔️ Nothing to stash."

      - name: 🔄 Sync with remote before commit using merge strategy.
        env:
          GIT_SSH_COMMAND: "ssh -p 42842"
        run: |
          set -euo pipefail
          export GNUPGHOME="$(PWD)/.gnupg"

          echo "🔄 Fetching origin/master ..."
          git fetch origin master

          echo "🔁 Merging origin/master into current branch ..."
          git merge --no-edit origin/master || echo "✔️ Already up to date or fast-forward."

          echo "📋 Post-merge status :"
          git status
          git log --oneline -n 5

      - name: 🔧 Restore stashed changes.
        env:
          GIT_SSH_COMMAND: "ssh -p 42842"
        run: |
          set -euo pipefail
          ### Apply previously stashed changes.
          git stash pop || echo "✔️ Nothing to pop."

      - name: 📦 Stage generated files.
        env:
          GIT_SSH_COMMAND: "ssh -p 42842"
        run: |
          set -euo pipefail
          PRIVATE_FILE="LINTER_RESULTS.txt"
          git add "${PRIVATE_FILE}" || echo "✔️ Nothing to add."

      - name: 🔑 Commit and sign changes with CI metadata.
        env:
          GIT_SSH_COMMAND: "ssh -p 42842"
        run: |
          set -euo pipefail
          export GNUPGHOME="$(PWD)/.gnupg"

          if git diff --cached --quiet; then
            echo "✔️ No staged changes to commit."
          else
            echo "📝 Committing changes with GPG signature ..."

            ### CI Metadata
            TIMESTAMP_UTC="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
            HOSTNAME="$(hostname -f || hostname)"
            GIT_SHA="$(git rev-parse --short HEAD)"
            GIT_REF="$(git symbolic-ref --short HEAD || echo detached)"
            WORKFLOW_ID="${GITHUB_WORKFLOW:-linter_char_scripts.yaml}"
            CI_HEADER="X-CI-Metadata: ${GIT_REF}@${GIT_SHA} at ${TIMESTAMP_UTC} on ${HOSTNAME}"

            COMMIT_MSG="DEPLOY BOT   : 🛡️ Shell Script Linting [skip ci]

          ${CI_HEADER}

          Generated at : ${TIMESTAMP_UTC}
          Runner Host  : ${HOSTNAME}
          Workflow ID  : ${WORKFLOW_ID}
          Git Commit   : ${GIT_SHA} HEAD -> ${GIT_REF}
          "

            echo "🔏 Commit message :"
            echo "${COMMIT_MSG}"
            git commit -S -m "${COMMIT_MSG}"
          fi

      - name: 🔁 Push back to repository.
        env:
          GIT_SSH_COMMAND: "ssh -p 42842"
        run: |
          set -euo pipefail
          echo "📤 Pushing changes to ${GITHUB_REF_NAME} ..."
          git push origin HEAD:${GITHUB_REF_NAME}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml
