eagle0/.github/workflows/shardok_profile.yml

name: Shardok Production Profile

on:
  workflow_dispatch:
    inputs:
      duration_seconds:
        description: Profile duration
        required: true
        default: "30"
        type: choice
        options:
          - "30"
          - "60"
          - "120"
      sample_frequency:
        description: CPU samples per second
        required: true
        default: "99"
        type: choice
        options:
          - "49"
          - "99"

concurrency:
  group: shardok-production-profile
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  profile-shardok:
    name: Audit and profile Hetzner Shardok
    runs-on: [self-hosted, macOS, ARM64]
    environment: production
    timeout-minutes: 10
    env:
      PROFILE_DURATION: ${{ inputs.duration_seconds }}
      SAMPLE_FREQUENCY: ${{ inputs.sample_frequency }}
      REMOTE_PROFILE_DIR: /tmp/eagle0-shardok-profile-${{ github.run_id }}-${{ github.run_attempt }}
      REMOTE_PROFILE_ARCHIVE: /tmp/eagle0-shardok-profile-${{ github.run_id }}-${{ github.run_attempt }}.tar.gz
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          persist-credentials: false
          lfs: false

      - name: Configure Hetzner SSH access
        env:
          HETZNER_SSH_KEY: ${{ secrets.HETZNER_SSH_KEY }}
          HETZNER_IP: ${{ secrets.HETZNER_IP }}
        run: |
          set -euo pipefail
          SSH_KEY_PATH="$RUNNER_TEMP/hetzner-profile-key"
          KNOWN_HOSTS_PATH="$RUNNER_TEMP/hetzner-profile-known-hosts"
          printf '%s\n' "$HETZNER_SSH_KEY" > "$SSH_KEY_PATH"
          chmod 600 "$SSH_KEY_PATH"
          ssh-keyscan -H "$HETZNER_IP" > "$KNOWN_HOSTS_PATH" 2>/dev/null

      - name: Audit host and capture profile
        env:
          HETZNER_IP: ${{ secrets.HETZNER_IP }}
        run: |
          set -euo pipefail
          SSH_KEY_PATH="$RUNNER_TEMP/hetzner-profile-key"
          KNOWN_HOSTS_PATH="$RUNNER_TEMP/hetzner-profile-known-hosts"
          ssh \
            -i "$SSH_KEY_PATH" \
            -o StrictHostKeyChecking=yes \
            -o UserKnownHostsFile="$KNOWN_HOSTS_PATH" \
            "deploy@$HETZNER_IP" \
            bash -s -- \
            "$PROFILE_DURATION" \
            "$SAMPLE_FREQUENCY" \
            "$REMOTE_PROFILE_DIR" \
            < scripts/capture_shardok_profile.sh

      - name: Copy profile artifact from Hetzner
        if: always()
        env:
          HETZNER_IP: ${{ secrets.HETZNER_IP }}
        run: |
          set -euo pipefail
          SSH_KEY_PATH="$RUNNER_TEMP/hetzner-profile-key"
          KNOWN_HOSTS_PATH="$RUNNER_TEMP/hetzner-profile-known-hosts"
          LOCAL_PROFILE_ARCHIVE="$RUNNER_TEMP/eagle0-shardok-profile-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}.tar.gz"
          scp \
            -i "$SSH_KEY_PATH" \
            -o StrictHostKeyChecking=yes \
            -o UserKnownHostsFile="$KNOWN_HOSTS_PATH" \
            "deploy@$HETZNER_IP:$REMOTE_PROFILE_ARCHIVE" \
            "$LOCAL_PROFILE_ARCHIVE"

      - name: Upload profile artifact
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: shardok-profile-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/eagle0-shardok-profile-${{ github.run_id }}-${{ github.run_attempt }}.tar.gz
          if-no-files-found: warn
          retention-days: 14
          compression-level: 0

      - name: Clean up profile files and SSH key
        if: always()
        env:
          HETZNER_IP: ${{ secrets.HETZNER_IP }}
        run: |
          SSH_KEY_PATH="$RUNNER_TEMP/hetzner-profile-key"
          KNOWN_HOSTS_PATH="$RUNNER_TEMP/hetzner-profile-known-hosts"
          LOCAL_PROFILE_ARCHIVE="$RUNNER_TEMP/eagle0-shardok-profile-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}.tar.gz"
          if [ -f "$SSH_KEY_PATH" ] && [ -f "$KNOWN_HOSTS_PATH" ]; then
            ssh \
              -i "$SSH_KEY_PATH" \
              -o StrictHostKeyChecking=yes \
              -o UserKnownHostsFile="$KNOWN_HOSTS_PATH" \
              "deploy@$HETZNER_IP" \
              rm -rf -- "$REMOTE_PROFILE_DIR" "$REMOTE_PROFILE_ARCHIVE" || true
          fi
          rm -f "$SSH_KEY_PATH" "$KNOWN_HOSTS_PATH" "$LOCAL_PROFILE_ARCHIVE"