name: toolchain
description: Go and the pinned deno of internal/versions/versions.json, with the job's cache and temp directories

runs:
  using: composite
  steps:
    - name: cache
      if: runner.environment == 'github-hosted'
      uses: actions/cache@v4
      with:
        path: |
          ~/.cache/socialweb-ci/go-build
          ~/.cache/socialweb-ci/go-mod
          ~/.cache/socialweb-ci/deno
        key: ci-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', 'deno.lock') }}
        restore-keys: |
          ci-${{ runner.os }}-${{ runner.arch }}-

    - name: Go
      uses: actions/setup-go@v7
      with:
        go-version-file: go.mod
        cache: false

    - name: deno
      shell: bash
      run: |
        set -euo pipefail
        test -n "${HOME:-}"
        test "$(id -u)" != 0
        state="$RUNNER_TEMP/ci"
        export CI_STATE="$state"
        export TMPDIR="$state/tmp"
        export GOCACHE="$HOME/.cache/socialweb-ci/go-build" GOMODCACHE="$HOME/.cache/socialweb-ci/go-mod" DENO_DIR="$HOME/.cache/socialweb-ci/deno"
        mkdir -p "$TMPDIR" "$GOCACHE" "$GOMODCACHE" "$DENO_DIR"
        platform="$(go env GOOS)/$(go env GOARCH)"
        deno_url="$(jq -er --arg p "$platform" '.assets.deno.fetch[$p].url' internal/versions/versions.json)"
        deno_sha="$(jq -er --arg p "$platform" '.assets.deno.fetch[$p].sha256' internal/versions/versions.json)"
        export DENO_BIN="$CI_STATE/deno/$deno_sha/deno"
        if [ ! -x "$DENO_BIN" ]; then
          curl -fsSL --max-time 120 -o "$TMPDIR/deno.zip" "$deno_url"
          echo "$deno_sha  $TMPDIR/deno.zip" | sha256sum -c --quiet -
          mkdir -p "$(dirname "$DENO_BIN")"
          unzip -q -o "$TMPDIR/deno.zip" deno -d "$(dirname "$DENO_BIN")"
        fi
        export PATH="$(dirname "$DENO_BIN"):$PATH"
        echo "OUT=$CI_STATE/out/$GITHUB_SHA" >>"$GITHUB_ENV"
        for v in CI_STATE TMPDIR GOCACHE GOMODCACHE DENO_DIR DENO_BIN; do
          echo "$v=${!v}" >>"$GITHUB_ENV"
        done
        echo "$(dirname "$DENO_BIN")" >>"$GITHUB_PATH"
        go version && deno --version | head -1

    - name: user namespaces
      shell: bash
      run: |
        set -euo pipefail
        sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 2>/dev/null || true
        unshare --user --map-root-user true
        unshare -rn true