eagle0/ci/github_actions/fetch_lfs.sh

#!/bin/bash
# Fetch LFS files from the private Gitea LFS repository with retry.
#
# The primary endpoint is committed in .lfsconfig. CI supplies Gitea
# credentials through GITEA_LFS_USERNAME and GITEA_LFS_TOKEN. GitHub LFS
# remains a temporary fallback while the Gitea migration is verified.
#
# Usage:
#   ./ci/github_actions/fetch_lfs.sh                          # full pull
#   ./ci/github_actions/fetch_lfs.sh --include="path/to/*"    # selective pull

set -euo pipefail

COMMON_PATHS="/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
export PATH="${COMMON_PATHS}:${PATH}"

MAX_ATTEMPTS=5
RETRY_DELAY=15
GITEA_LFS_URL="https://gitea.eagle0.net/admin/eagle0-lfs.git/info/lfs"
GITEA_CREDENTIAL_FILE=""

cleanup() {
    if [ -n "$GITEA_CREDENTIAL_FILE" ]; then
        rm -f -- "$GITEA_CREDENTIAL_FILE"
    fi
}
trap cleanup EXIT

if [ -n "${GITHUB_PATH:-}" ]; then
    for path in /opt/homebrew/bin /usr/local/bin; do
        if [ -d "$path" ]; then
            echo "$path" >> "$GITHUB_PATH"
        fi
    done
fi

if ! git lfs version >/dev/null 2>&1; then
    if ! command -v brew >/dev/null 2>&1; then
        echo "ERROR: git-lfs is unavailable, and Homebrew is not on PATH"
        exit 1
    fi

    echo "Installing git-lfs with Homebrew"
    brew install git-lfs
fi

echo "Using git-lfs at $(command -v git-lfs)"
git lfs version

git lfs install --local --force

echo "LFS objects before pull:"
git lfs ls-files | wc -l

GITEA_LFS_PULL=()
FALLBACK_GITHUB_LFS_PULL=()
GITEA_CREDENTIAL_CONFIG=()
GITEA_LFS_STORAGE_CONFIG=()

if [ "${GITEA_LFS_VERIFY_FRESH:-}" = "true" ]; then
    if [ -z "${RUNNER_TEMP:-}" ]; then
        echo "ERROR: RUNNER_TEMP must be set for fresh Gitea LFS verification"
        exit 1
    fi

    MAX_ATTEMPTS=1
    GITEA_LFS_STORAGE=$(mktemp -d "$RUNNER_TEMP/gitea-lfs-verification.XXXXXX")
    GITEA_LFS_STORAGE_CONFIG=(-c "lfs.storage=$GITEA_LFS_STORAGE")
    echo "Using empty temporary Git LFS storage for verification"
fi

if [ -n "${GITEA_LFS_USERNAME:-}" ]; then
    if [ -z "${GITEA_LFS_TOKEN:-}" ]; then
        echo "ERROR: GITEA_LFS_TOKEN must be set when GITEA_LFS_USERNAME is set"
        exit 1
    fi
elif [ -n "${GITEA_LFS_TOKEN:-}" ]; then
    echo "ERROR: GITEA_LFS_USERNAME must be set when GITEA_LFS_TOKEN is set"
    exit 1
fi

if [ -n "${GITEA_LFS_USERNAME:-}" ]; then
    GITEA_CREDENTIAL_FILE=$(mktemp "${RUNNER_TEMP:-/tmp}/gitea-lfs-credentials.XXXXXX")
    chmod 600 "$GITEA_CREDENTIAL_FILE"
    git credential-store --file="$GITEA_CREDENTIAL_FILE" store <<EOF
protocol=https
host=gitea.eagle0.net
username=$GITEA_LFS_USERNAME
password=$GITEA_LFS_TOKEN
EOF
    GITEA_CREDENTIAL_CONFIG=(
        -c "credential.helper="
        -c "credential.helper=store --file=$GITEA_CREDENTIAL_FILE"
    )
    GITEA_LFS_PULL=(
        git
        "${GITEA_CREDENTIAL_CONFIG[@]}"
        -c "lfs.url=$GITEA_LFS_URL"
        "${GITEA_LFS_STORAGE_CONFIG[@]}"
        lfs
        pull
    )
elif [ "${GITHUB_ACTIONS:-}" = "true" ]; then
    echo "Gitea LFS credentials are unavailable; skipping directly to the temporary GitHub fallback"
else
    # Local callers can use their configured Git credential helper.
    GITEA_LFS_PULL=(
        git
        -c "lfs.url=$GITEA_LFS_URL"
        "${GITEA_LFS_STORAGE_CONFIG[@]}"
        lfs
        pull
    )
fi

if [ -n "${GITHUB_TOKEN:-}" ]; then
    GITHUB_BASIC_AUTH=$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')
    FALLBACK_GITHUB_LFS_PULL=(
        git
        -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $GITHUB_BASIC_AUTH"
        -c "lfs.url=https://github.com/nolen777/eagle0.git/info/lfs"
        lfs
        pull
    )
fi

if [ "${#GITEA_LFS_PULL[@]}" -gt 0 ]; then
    for i in $(seq 1 $MAX_ATTEMPTS); do
        if "${GITEA_LFS_PULL[@]}" "$@"; then
            echo "LFS objects after Gitea pull:"
            git lfs ls-files | wc -l
            exit 0
        fi
        if [ "$i" -lt "$MAX_ATTEMPTS" ]; then
            echo "Gitea LFS pull attempt $i/$MAX_ATTEMPTS failed, retrying in ${RETRY_DELAY}s..."
            sleep "$RETRY_DELAY"
        fi
    done
fi

if [ "${GITEA_LFS_VERIFY_FRESH:-}" = "true" ]; then
    echo "Last Git LFS error log:"
    if ! git lfs logs last; then
        echo "No Git LFS error log was available"
    fi
fi

if [ "${GITEA_LFS_VERIFY_FRESH:-}" = "true" ]; then
    echo "Fresh Gitea LFS verification failed; GitHub fallback is disabled"
    exit 1
fi

if [ "${#FALLBACK_GITHUB_LFS_PULL[@]}" -gt 0 ]; then
    echo "Trying temporary GitHub LFS fallback"
    if "${FALLBACK_GITHUB_LFS_PULL[@]}" "$@"; then
        echo "LFS objects after GitHub fallback pull:"
        git lfs ls-files | wc -l
        exit 0
    fi
fi

echo "LFS pull failed"
exit 1