name: setup-ci
description: Prepare common tools and environment shared by CI jobs.
outputs:
  bazel-output-base:
    description: Filesystem path used for Bazel's output base.
    value: ${{ steps.configure_ci_build_paths.outputs.bazel-output-base }}
  cargo-target-dir:
    description: Filesystem path used for Cargo's target directory.
    value: ${{ steps.configure_ci_build_paths.outputs.cargo-target-dir }}

runs:
  using: composite
  steps:
    # setup-ci expects either this step or the Unix fallback below to define
    # CI_BUILD_ROOT. Windows uses a Dev Drive because Cargo and Bazel
    # spend significant time reading and writing build/cache trees.
    - name: Configure Dev Drive (Windows)
      if: runner.os == 'Windows'
      shell: pwsh
      run: ./.github/scripts/setup-dev-drive.ps1

    - name: Enable segment heap (Windows)
      if: runner.os == 'Windows'
      shell: pwsh
      run: reg.exe add 'HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Segment Heap' /v Enabled /t REG_DWORD /d 1 /f

    - name: Configure CI build root (Unix)
      if: runner.os != 'Windows'
      shell: bash
      run: echo "CI_BUILD_ROOT=$HOME/.cache/codex-ci" >> "$GITHUB_ENV"

    - name: Enable unprivileged user namespaces (Linux)
      if: runner.os == 'Linux'
      shell: bash
      run: |
        sudo sysctl -w kernel.unprivileged_userns_clone=1
        if sudo sysctl -a 2>/dev/null | grep -q '^kernel.apparmor_restrict_unprivileged_userns'; then
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
        fi

    - name: Configure CI build paths
      id: configure_ci_build_paths
      shell: bash
      run: |
        set -euo pipefail
        # setup-bazel passes output_base explicitly, so keep both it and the
        # user root under the shared build root. Keep these directory names tiny
        # on every platform so Windows Bazel paths do not overflow argv or
        # confuse test MANIFEST handling.
        bazel_output_base="$CI_BUILD_ROOT/o"
        bazel_output_user_root="$CI_BUILD_ROOT/b"
        bazel_repository_cache="$CI_BUILD_ROOT/bazel-repository-cache"
        bazel_repo_contents_cache="$CI_BUILD_ROOT/bazel-repo-contents-cache-$GITHUB_RUN_ID-$GITHUB_JOB"
        cargo_target_dir="$CI_BUILD_ROOT/cargo-target"
        tmp="$CI_BUILD_ROOT/tmp"

        build_dirs=(
          "$bazel_output_base"
          "$bazel_output_user_root"
          "$bazel_repository_cache"
          "$bazel_repo_contents_cache"
          "$cargo_target_dir"
          "$tmp"
        )
        mkdir -p "${build_dirs[@]}"
        echo "bazel-output-base=$bazel_output_base" >> "$GITHUB_OUTPUT"
        echo "cargo-target-dir=$cargo_target_dir" >> "$GITHUB_OUTPUT"

        {
          echo "CODEX_REPO_ROOT=$GITHUB_WORKSPACE"
          echo "BAZEL_OUTPUT_BASE=$bazel_output_base"
          echo "BAZEL_OUTPUT_USER_ROOT=$bazel_output_user_root"
          echo "BAZEL_REPOSITORY_CACHE=$bazel_repository_cache"
          echo "BAZEL_REPO_CONTENTS_CACHE=$bazel_repo_contents_cache"
          echo "CARGO_TARGET_DIR=$cargo_target_dir"
          echo "TEMP=$tmp"
          echo "TMP=$tmp"
        } >> "$GITHUB_ENV"

    - name: Prefer the Git CLI for Cargo git dependencies
      shell: bash
      run: echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"

    - name: Configure curl retries for DotSlash
      shell: bash
      run: mkdir -p "$RUNNER_TEMP/dotslash-curl" && echo retry-all-errors > "$RUNNER_TEMP/dotslash-curl/.curlrc"

    - name: Install DotSlash
      if: runner.os != 'Windows' || runner.arch != 'ARM64'
      uses: meta/install-dotslash@1e4e7b3e07eaca387acb98f1d4720e0bee8dbb6a # v2
      env:
        CURL_HOME: ${{ runner.temp }}/dotslash-curl

    - name: Install native DotSlash (Windows ARM64)
      if: runner.os == 'Windows' && runner.arch == 'ARM64'
      shell: bash
      run: |
        set -euo pipefail
        # DotSlash selects resource architecture from its own executable.
        destination="$RUNNER_TEMP/install-dotslash-arm64/bin"
        archive="$RUNNER_TEMP/dotslash-windows-arm64.v0.5.9.tar.gz"
        mkdir -p "$destination"
        curl --location --silent --show-error --fail --retry 5 --retry-all-errors \
          https://github.com/facebook/dotslash/releases/download/v0.5.9/dotslash-windows-arm64.v0.5.9.tar.gz \
          --output "$archive"
        echo "43d49d3472808738993ccf95a36dda8cc2869996d9a397bb02bde1e39b16146b  $archive" | sha256sum --check
        tar xzf "$archive" -O --force-local > "$destination/dotslash.exe"
        echo "$destination" >> "$GITHUB_PATH"
        "$destination/dotslash.exe" --version

    - name: Install just
      uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21
      with:
        tool: just@1.51.0

    # Some integration tests spawn DotSlash from a stable system path rather
    # than inheriting the action-local PATH entry.
    - name: Make DotSlash available in PATH (Unix)
      if: runner.os != 'Windows'
      shell: bash
      run: |
        if [[ -w /usr/local/bin ]]; then
          cp "$(which dotslash)" /usr/local/bin
        else
          sudo cp "$(which dotslash)" /usr/local/bin
        fi

    - name: Make DotSlash available in PATH (Windows)
      if: runner.os == 'Windows'
      shell: pwsh
      run: Copy-Item (Get-Command dotslash).Source -Destination "$env:LOCALAPPDATA\Microsoft\WindowsApps\dotslash.exe"

    - name: Enable Git long paths (Windows)
      if: runner.os == 'Windows'
      shell: pwsh
      run: git config --global core.longpaths true