name: Desktop release cache tag-scope proof

# Dispatch from a cache-proof-* tag at the same trusted-main SHA warmed by all
# four canaries. Every job restores only and requires an exact cache hit.
on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  macos:
    name: Prove macOS ${{ matrix.target }} cache visibility
    if: github.repository == 'block/buzz'
    runs-on: macos-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
            features: mesh-llm
          - target: x86_64-apple-darwin
            features: default
    steps:
      - name: Require cache proof tag
        run: '[[ "$GITHUB_REF" == refs/tags/cache-proof-* ]] || { echo "::error::Expected cache-proof-* tag; got $GITHUB_REF"; exit 1; }'
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
      - name: Patch proof dependency graph
        run: |
          cd desktop && node scripts/set-version-from-tag.mjs "0.0.0-cache-proof"
          cd src-tauri && cargo update --workspace
      - name: Resolve native toolchain identity
        id: native_toolchain
        run: echo "id=$(scripts/desktop-native-toolchain-id.sh macos)" >> "$GITHUB_OUTPUT"
      - name: Compute exact release cache key
        id: rust_cache_key
        env:
          CACHE_TARGET: ${{ matrix.target }}
          CACHE_FEATURES: ${{ matrix.features }}
          NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
        run: |
          KEY=$(scripts/desktop-release-cache-key.py --platform "$RUNNER_OS" --target "$CACHE_TARGET" --features "$CACHE_FEATURES" --native-inputs "$NATIVE_TOOLCHAIN_ID")
          echo "key=$KEY" >> "$GITHUB_OUTPUT"
      - name: Restore exact default-branch cache from tag
        id: rust_cache
        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
            desktop/src-tauri/target
            !desktop/src-tauri/target/**/release/bundle
          key: ${{ steps.rust_cache_key.outputs.key }}
      - name: Require exact cache hit
        env:
          CACHE_HIT: ${{ steps.rust_cache.outputs.cache-hit }}
          CACHE_KEY: ${{ steps.rust_cache.outputs.cache-primary-key }}
          EXPECTED_KEY: ${{ steps.rust_cache_key.outputs.key }}
        run: '[[ "$CACHE_HIT" == true && "$CACHE_KEY" == "$EXPECTED_KEY" ]] || { echo "::error::Exact tag cache miss (hit=$CACHE_HIT restored=$CACHE_KEY expected=$EXPECTED_KEY)"; exit 1; }'

  linux:
    name: Prove Linux cache visibility
    if: github.repository == 'block/buzz'
    runs-on: ubuntu-latest
    container: ubuntu:24.04@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90
    timeout-minutes: 15
    defaults:
      run:
        shell: bash
    steps:
      - name: Require cache proof tag and install release native tools
        run: |
          [[ "$GITHUB_REF" == refs/tags/cache-proof-* ]] || { echo "::error::Expected cache-proof-* tag; got $GITHUB_REF"; exit 1; }
          apt-get update
          apt-get install -y --no-install-recommends build-essential ca-certificates curl git libasound2-dev libayatana-appindicator3-dev libgtk-3-dev librsvg2-dev libssl-dev libwebkit2gtk-4.1-dev libxdo-dev patchelf pkg-config
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
      - name: Patch proof dependency graph
        run: |
          cd desktop && node scripts/set-version-from-tag.mjs "0.0.0-cache-proof"
          cd src-tauri && cargo update --workspace
      - name: Resolve native toolchain identity
        id: native_toolchain
        run: echo "id=$(scripts/desktop-native-toolchain-id.sh linux)" >> "$GITHUB_OUTPUT"
      - name: Compute exact release cache key
        id: rust_cache_key
        env:
          NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
        run: |
          KEY=$(scripts/desktop-release-cache-key.py --platform "$RUNNER_OS" --target x86_64-unknown-linux-gnu --features mesh-llm --native-inputs "$NATIVE_TOOLCHAIN_ID")
          echo "key=$KEY" >> "$GITHUB_OUTPUT"
      - name: Restore exact default-branch cache from tag
        id: rust_cache
        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
            desktop/src-tauri/target
            !desktop/src-tauri/target/**/release/bundle
          key: ${{ steps.rust_cache_key.outputs.key }}
      - name: Require exact cache hit
        env:
          CACHE_HIT: ${{ steps.rust_cache.outputs.cache-hit }}
          CACHE_KEY: ${{ steps.rust_cache.outputs.cache-primary-key }}
          EXPECTED_KEY: ${{ steps.rust_cache_key.outputs.key }}
        run: '[[ "$CACHE_HIT" == true && "$CACHE_KEY" == "$EXPECTED_KEY" ]] || { echo "::error::Exact tag cache miss (hit=$CACHE_HIT restored=$CACHE_KEY expected=$EXPECTED_KEY)"; exit 1; }'

  windows:
    name: Prove Windows cache visibility
    if: github.repository == 'block/buzz'
    runs-on: windows-latest
    timeout-minutes: 15
    steps:
      - name: Require cache proof tag
        shell: bash
        run: '[[ "$GITHUB_REF" == refs/tags/cache-proof-* ]] || { echo "::error::Expected cache-proof-* tag; got $GITHUB_REF"; exit 1; }'
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Patch proof dependency graph
        shell: bash
        run: |
          cd desktop && node scripts/set-version-from-tag.mjs "0.0.0-cache-proof"
          cd src-tauri && cargo update --workspace
      - name: Resolve native toolchain identity
        id: native_toolchain
        shell: bash
        run: echo "id=$(scripts/desktop-native-toolchain-id.sh windows)" >> "$GITHUB_OUTPUT"
      - name: Compute exact release cache key
        id: rust_cache_key
        shell: bash
        env:
          NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
        run: |
          KEY=$(scripts/desktop-release-cache-key.py --platform "$RUNNER_OS" --target x86_64-pc-windows-msvc --features default --native-inputs "$NATIVE_TOOLCHAIN_ID")
          echo "key=$KEY" >> "$GITHUB_OUTPUT"
      - name: Restore exact default-branch cache from tag
        id: rust_cache
        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
            desktop/src-tauri/target
            !desktop/src-tauri/target/**/release/bundle
          key: ${{ steps.rust_cache_key.outputs.key }}
      - name: Require exact cache hit
        shell: bash
        env:
          CACHE_HIT: ${{ steps.rust_cache.outputs.cache-hit }}
          CACHE_KEY: ${{ steps.rust_cache.outputs.cache-primary-key }}
          EXPECTED_KEY: ${{ steps.rust_cache_key.outputs.key }}
        run: '[[ "$CACHE_HIT" == true && "$CACHE_KEY" == "$EXPECTED_KEY" ]] || { echo "::error::Exact tag cache miss (hit=$CACHE_HIT restored=$CACHE_KEY expected=$EXPECTED_KEY)"; exit 1; }'