update-sing-box.yml

name: 自动更新 sing-box eBPF 内核

# 定时跟踪 CHIZI-0618/sing-box 的 testing-ref1nd 分支。
# 上游变化时只构建 Android arm64，直接更新模块内核并触发本仓库 CI。

on:
  schedule:
    - cron: '*/10 * * * *'
  workflow_dispatch:
    inputs:
      force:
        description: 即使上游提交未变化也重新构建
        required: false
        type: boolean
        default: false

permissions:
  contents: read

concurrency:
  group: update-sing-box
  cancel-in-progress: true

env:
  UPSTREAM_REPOSITORY: CHIZI-0618/sing-box
  UPSTREAM_BRANCH: testing-ref1nd
  DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
  MARKER_FILE: .github/upstream/sing-box-testing-ref1nd.sha
  TARGET_FILE: src/module/bin/sing-box
  GO_VERSION: 1.25.12
  NDK_VERSION: r25c
  BUILD_TAGS: with_gvisor,with_quic,with_dhcp,with_utls,with_clash_api,with_tailscale,badlinkname,tfogo_checklinkname0,with_provider,with_ebpf

jobs:
  check:
    name: 检查上游提交
    runs-on: ubuntu-latest
    outputs:
      changed: ${{ steps.compare.outputs.changed }}
      upstream_sha: ${{ steps.compare.outputs.upstream_sha }}
      short_sha: ${{ steps.compare.outputs.short_sha }}
    steps:
      - name: 拉取当前仓库
        uses: actions/checkout@v7
        with:
          ref: ${{ env.DEFAULT_BRANCH }}
          persist-credentials: false

      - name: 比较上游提交
        id: compare
        env:
          GH_TOKEN: ${{ github.token }}
          FORCE_UPDATE: ${{ inputs.force || false }}
        shell: bash
        run: |
          set -euo pipefail

          upstream_sha="$(gh api "repos/${UPSTREAM_REPOSITORY}/commits/${UPSTREAM_BRANCH}" --jq '.sha')"
          current_sha=""
          if [[ -f "$MARKER_FILE" ]]; then
            current_sha="$(tr -d '[:space:]' < "$MARKER_FILE")"
          fi

          changed=false
          if [[ "$FORCE_UPDATE" == "true" || "$upstream_sha" != "$current_sha" ]]; then
            changed=true
          fi

          echo "changed=$changed" >> "$GITHUB_OUTPUT"
          echo "upstream_sha=$upstream_sha" >> "$GITHUB_OUTPUT"
          echo "short_sha=${upstream_sha:0:8}" >> "$GITHUB_OUTPUT"

          {
            echo "### sing-box 上游检查"
            echo "- 当前记录：\`${current_sha:-未记录}\`"
            echo "- 上游提交：\`$upstream_sha\`"
            echo "- 需要更新：\`$changed\`"
          } >> "$GITHUB_STEP_SUMMARY"

  build:
    name: 构建 Android arm64 eBPF 内核
    needs: check
    if: needs.check.outputs.changed == 'true'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: 拉取上游源码
        uses: actions/checkout@v7
        with:
          repository: ${{ env.UPSTREAM_REPOSITORY }}
          ref: ${{ needs.check.outputs.upstream_sha }}
          fetch-depth: 0
          persist-credentials: false

      - name: 配置 Go
        uses: actions/setup-go@v7
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: 配置 Android NDK
        id: setup-ndk
        uses: nttld/setup-ndk@v1
        with:
          ndk-version: ${{ env.NDK_VERSION }}

      - name: 构建内核
        env:
          TAGS: ${{ env.BUILD_TAGS }}
          CGO_ENABLED: '1'
          GOOS: android
          GOARCH: arm64
          CC: ${{ steps.setup-ndk.outputs.ndk-path }}/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android33-clang
          BPF_CLANG: ${{ steps.setup-ndk.outputs.ndk-path }}/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android33-clang
        run: make build

      - name: 检查构建产物
        run: |
          set -euo pipefail
          test -s sing-box
          file sing-box | grep -q 'ARM aarch64'
          chmod 0755 sing-box
          sha256sum sing-box

      - name: 上传构建产物
        uses: actions/upload-artifact@v7
        with:
          name: sing-box-android-arm64-${{ needs.check.outputs.short_sha }}
          path: sing-box
          if-no-files-found: error
          retention-days: 1

  update:
    name: 更新模块并直接提交
    needs:
      - check
      - build
    if: needs.check.outputs.changed == 'true'
    runs-on: ubuntu-latest
    permissions:
      actions: write
      contents: write
    steps:
      - name: 拉取当前仓库
        uses: actions/checkout@v7
        with:
          ref: ${{ env.DEFAULT_BRANCH }}
          fetch-depth: 0

      - name: 下载构建产物
        uses: actions/download-artifact@v8
        with:
          name: sing-box-android-arm64-${{ needs.check.outputs.short_sha }}
          path: .artifacts/sing-box

      - name: 替换内核并提交
        id: commit
        env:
          UPSTREAM_SHA: ${{ needs.check.outputs.upstream_sha }}
          SHORT_SHA: ${{ needs.check.outputs.short_sha }}
        shell: bash
        run: |
          set -euo pipefail

          git pull --ff-only origin "$DEFAULT_BRANCH"
          install -m 0755 .artifacts/sing-box/sing-box "$TARGET_FILE"
          mkdir -p "$(dirname "$MARKER_FILE")"
          printf '%s\n' "$UPSTREAM_SHA" > "$MARKER_FILE"

          git add -- "$TARGET_FILE" "$MARKER_FILE"
          if git diff --cached --quiet; then
            echo "updated=false" >> "$GITHUB_OUTPUT"
            echo "构建产物与仓库内容一致，无需提交。" >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          git diff --cached --check
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git commit \
            -m "chore(core): 更新 sing-box eBPF 内核至 ${SHORT_SHA}" \
            -m "上游提交: https://github.com/${UPSTREAM_REPOSITORY}/commit/${UPSTREAM_SHA}"
          git push origin "HEAD:${DEFAULT_BRANCH}"

          echo "updated=true" >> "$GITHUB_OUTPUT"
          echo "commit_sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: 触发模块持续集成
        if: steps.commit.outputs.updated == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh workflow run ci.yml --ref "$DEFAULT_BRANCH"

      - name: 写入更新摘要
        if: steps.commit.outputs.updated == 'true'
        env:
          COMMIT_SHA: ${{ steps.commit.outputs.commit_sha }}
          UPSTREAM_SHA: ${{ needs.check.outputs.upstream_sha }}
        run: |
          {
            echo "### sing-box 内核已更新"
            echo "- 上游提交：[$UPSTREAM_SHA](https://github.com/${UPSTREAM_REPOSITORY}/commit/$UPSTREAM_SHA)"
            echo "- 本仓库提交：[$COMMIT_SHA](${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/commit/$COMMIT_SHA)"
            echo "- 后续操作：已触发模块持续集成"
          } >> "$GITHUB_STEP_SUMMARY"