reset-database.yml

# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
---
name: Reset Database

on:
  workflow_dispatch: {}

concurrency:
  group: reset-database
  cancel-in-progress: false

permissions: {}

jobs:
  reset-db:
    name: 🗑️ Reset DB
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      # Authentication: uses a deploy key (SSH) for direct push to main.
      # The deploy key must be added as a bypass actor in the branch
      # protection ruleset. See https://github.com/microsoft/sbi/issues/6

      - name: ✅ Require default branch for manual runs
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: |
          if [ "${GITHUB_REF}" != "refs/heads/${DEFAULT_BRANCH}" ]; then
            echo "::error::Run workflow_dispatch from ${DEFAULT_BRANCH} only."
            exit 1
          fi

      - name: ⤵️ Checkout (with LFS)
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ssh-key: ${{ secrets.NIGHTLY_WRITE_BOT_KEY }}
          lfs: true
          fetch-depth: 0

      - name: 🚧 Setup Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          cache: true

      - name: 🚧 Setup Task
        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0

      - name: 🔀 Download dependencies
        run: go mod download

      - name: 🏗️ Build
        run: task build

      - name: 🗑️ Clear database entries
        run: |
          ./bin/linux-amd64/sbi reset-db \
            --database azure_linux_images.db \
            -v

      - name: 📝 Commit & push reset outputs
        if: success()
        run: |
          git config user.name 'github-actions[bot]'
          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'

          # Source the shared allowlist from the trusted triggering commit
          # so earlier tooling cannot taint the file list.
          git restore --source='${{ github.sha }}' -- .github/reset-db-allowed-files.sh
          source .github/reset-db-allowed-files.sh

          is_allowed_file() {
            local candidate="$1"
            local allowed_file

            for allowed_file in "${RESET_DB_ALLOWED_FILES[@]}"; do
              if [ "$candidate" = "$allowed_file" ]; then
                return 0
              fi
            done

            return 1
          }

          # Validate expected artifacts exist
          MISSING=()
          for f in "${RESET_DB_ALLOWED_FILES[@]}"; do
            [ -f "$f" ] || MISSING+=("$f")
          done
          if [ ${#MISSING[@]} -gt 0 ]; then
            echo "::error::Missing expected reset artifacts:"
            printf '  - %s\n' "${MISSING[@]}"
            exit 1
          fi

          # Validate the full working tree so unexpected files cannot be
          # hidden by selectively staging only the allowlisted outputs.
          UNEXPECTED=()
          while IFS= read -r -d '' file; do
            if ! is_allowed_file "$file"; then
              UNEXPECTED+=("$file")
            fi
          done < <(git diff --name-only -z)
          while IFS= read -r -d '' file; do
            if ! is_allowed_file "$file"; then
              UNEXPECTED+=("$file")
            fi
          done < <(git ls-files --others --exclude-standard -z)
          if [ ${#UNEXPECTED[@]} -gt 0 ]; then
            echo "::error::Reset-db produced unexpected file changes:"
            printf '  - %s\n' "${UNEXPECTED[@]}"
            exit 1
          fi

          git add -f "${RESET_DB_ALLOWED_FILES[@]}"
          if [ -z "$(git diff --cached --name-only)" ]; then
            echo 'No changes to commit.'
            exit 0
          fi

          # Final staged-file validation
          while IFS= read -r -d '' file; do
            if ! is_allowed_file "$file"; then
              echo "::error::Unexpected file staged: $file"
              exit 1
            fi
          done < <(git diff --cached --name-only -z)

          CHANGED_FILES=$(git diff --cached --name-only | tr '\n' ' ')
          echo "Changed files: $CHANGED_FILES"
          git commit -m "chore: reset database entries [skip ci]"
          git pull --rebase origin main
          git push