---BEGIN WORKFLOW---
 ame: AzerothAI Validated Patch

on:
  workflow_dispatch:
    inputs:
      patch_file:
        description: Patch file under ops/patches/
        required: true

jobs:
  patch:
    runs-on: azerothai-host
    timeout-minutes: 10

    env:
      PATCH_FILE: ${{ inputs.patch_file }}
      AZEROTH_ACTOR: ${{ gitea.actor }}
      AZEROTH_REPOSITORY: ${{ gitea.repository }}

    steps:
      - name: Verify authorized request
        shell: bash
        run: |
          set -euo pipefail

          [ "$AZEROTH_ACTOR" = "richard" ] || {
            echo "Unauthorized actor: $AZEROTH_ACTOR"
            exit 1
          }

          [ "$AZEROTH_REPOSITORY" = "richard/AzerothAI" ] || {
            echo "Wrong repository: $AZEROTH_REPOSITORY"
            exit 1
          }

          base="${PATCH_FILE#ops/patches/}"

          [ "$base" != "$PATCH_FILE" ] || {
            echo "Patch must be under ops/patches/"
            exit 1
          }

          [[ "$base" != */* ]] || {
            echo "Nested patch paths are not allowed"
            exit 1
          }

          [[ "$base" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*\.patch$ ]] || {
            echo "Invalid patch filename"
            exit 1
          }

      - name: Check out patch source
        uses: actions/checkout@v4

      - name: Apply validated patch
        shell: bash
        run: |
          set -euo pipefail

          [ -f "$PATCH_FILE" ] || {
            echo "Patch file not found: $PATCH_FILE"
            exit 1
          }

          sha="$(sha256sum "$PATCH_FILE" | awk '{print $1}')"
          payload="$(base64 -w0 "$PATCH_FILE")"

          sudo -n /usr/local/bin/azerothai-ops "apply-patch:${sha}:${payload}"
---END WORKFLOW---