name: Publish Linux VM kernel (+ guest-agent compile check)

# Builds and distributes the Nucleic **Linux VM** guest artifacts (docs/LINUX_VM.md,
# docs/LINUX_VM_SEMANTIC_AGENT.md) — the pieces the macOS-host base build bakes into the guest image:
#
#   • nucleic-linux-agent   — static-C control agent (vsock 2035: ping/exec)
#   • nucleic-a11y-agent    — Rust AT-SPI semantic agent (vsock 2036: ax_*)
#   • pre-unwrapped kernel  — the Ubuntu arm64 kernel unwrapped from EFI-zboot to a raw Image, so the
#                             base build needs no host-side zstd (see scripts/publish-linux-vm-kernel.sh)
#
# DISTRIBUTION NOTE: the two agents are no longer distributed from here. They are built for both
# arches, packaged as debs and published to the hosted apt repo by naros.yml, and baked into the VM
# rootfs from that same pool (os/mkimage/profiles/vm*.naros-pkgs) — apt is the single source of truth.
# What remains below for the agents is a NATIVE arm64 compile check (the cross build in naros.yml uses
# zig/musl; this catches breakage under a stock native toolchain) plus a workflow artifact for local
# debugging. Only the kernel job still publishes to GHCR.
#
# Auto-publishes on push to main/dev/canary (tagged "latest"), same as nucleic-sandbox. Can also be
# run manually from the Actions tab with a custom tag. After the FIRST publish, set each GHCR package
# to Public (GitHub → Packages) so it can be pulled anonymously while the repo stays private, exactly
# like nucleic-kernel / nucleic-sandbox.

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "GHCR tag for the published kernel artifact (the agents are not published from here)"
        required: true
        default: "latest"
      publish:
        description: "Push the kernel to GHCR (else just build + upload workflow artifacts)"
        type: boolean
        default: true
  push:
    branches: [main, dev, canary]
    paths:
      - "guest/nucleic-linux-agent/**"
      - "guest/nucleic-a11y-agent/**"
      - "scripts/publish-linux-vm-kernel.sh"
      - ".github/workflows/linux-vm-agents.yml"

jobs:
  agents:
    # NOT a publish job — see the DISTRIBUTION NOTE above. The agents ship as debs from naros.yml.
    name: Guest agents — native arm64 compile check (no publish)
    runs-on: ubuntu-24.04-arm # native arm64 — the guest binaries are arm64
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Toolchain (C static + Rust)
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends build-essential
      - uses: dtolnay/rust-toolchain@stable

      - name: Build nucleic-linux-agent (static C)
        run: bash guest/nucleic-linux-agent/build.sh

      - name: Build nucleic-a11y-agent (Rust)
        run: bash guest/nucleic-a11y-agent/build.sh

      - name: Sanity-check the binaries are arm64 ELF
        run: |
          file guest/nucleic-linux-agent/build/nucleic-linux-agent
          file guest/nucleic-a11y-agent/build/nucleic-a11y-agent

      - name: Upload agent binaries (local debugging only — not a distribution channel)
        uses: actions/upload-artifact@v4
        with:
          name: nucleic-linux-vm-agents-arm64
          path: |
            guest/nucleic-linux-agent/build/nucleic-linux-agent
            guest/nucleic-a11y-agent/build/nucleic-a11y-agent
          if-no-files-found: error

      # NOTE: the agents are no longer pushed to GHCR. They ship as debs from the narOS apt repo
      # (naros.yml → os/packages → os/repo/r2-sync.sh) and are baked into the rootfs from that pool.
      # This job is now a native-arm64 COMPILE CHECK only — publishing an `oras push …:latest`
      # alongside the deb gave the same agent two independently-moving sources, which is precisely
      # the drift this was collapsed to remove.

  kernel:
    name: Pre-unwrapped Ubuntu arm64 kernel → GHCR
    # The kernel unwrap is arch-agnostic (it downloads the arm64 vmlinuz and decompresses it), so any
    # runner works; it needs zstd + ar + curl + python3.
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: Tools
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends zstd binutils curl python3
      - name: Unwrap the pinned Ubuntu kernel → raw Image
        run: OUT="$PWD/vmlinux-arm64" bash scripts/publish-linux-vm-kernel.sh resolute 26.04
      - name: Upload workflow artifact
        uses: actions/upload-artifact@v4
        with:
          name: nucleic-linux-vm-kernel-arm64
          path: vmlinux-arm64
          if-no-files-found: error
      - name: Resolve GHCR owner
        id: ref
        run: echo "owner=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
      - uses: oras-project/setup-oras@v1
        if: ${{ github.event_name == 'push' || inputs.publish }}
      - name: Log in to GHCR
        if: ${{ github.event_name == 'push' || inputs.publish }}
        run: oras login ghcr.io -u '${{ github.actor }}' -p '${{ secrets.GITHUB_TOKEN }}'
      - name: Push kernel as an OCI artifact
        if: ${{ github.event_name == 'push' || inputs.publish }}
        run: |
          oras push "ghcr.io/${{ steps.ref.outputs.owner }}/nucleic-linux-vm-kernel:26.04-${{ inputs.tag || 'latest' }}" \
            --artifact-type application/vnd.nucleic.kernel \
            vmlinux-arm64:application/octet-stream
