-- Third-party actions from github.com. Archives are content-addressed by commit SHA and shared by every
-- account: the code is public and identical for everyone, so it is stored once and never billed (see
-- docs/metering.md). Cold fetches are recorded on the free `ops.action_fetches` meter of the run's account.
CREATE TABLE action_archives (
  key TEXT PRIMARY KEY,               -- "<owner>/<repo>@<commit sha>"
  owner TEXT NOT NULL,
  repo TEXT NOT NULL,
  sha TEXT NOT NULL,
  r2_key TEXT NOT NULL,
  size INTEGER NOT NULL,
  sha256 TEXT NOT NULL,               -- of the stored .tgz; runners verify it before extracting
  created_at INTEGER NOT NULL,
  last_used_at INTEGER NOT NULL
);
CREATE INDEX action_archives_idle ON action_archives(last_used_at);

-- Every action.yml/action.yaml in an archive, so compile never re-reads the tarball.
CREATE TABLE action_manifests (
  archive_key TEXT NOT NULL REFERENCES action_archives(key) ON DELETE CASCADE,
  path TEXT NOT NULL,                 -- directory inside the repository ('' for the root)
  source TEXT NOT NULL,
  PRIMARY KEY (archive_key, path)
);

-- A pinned SHA is only accepted when it is reachable from a branch or tag of the named repository, so a
-- commit that exists only in a fork (GitHub shares objects across a fork network) can't pose as the repo.
CREATE TABLE action_pin_checks (
  key TEXT PRIMARY KEY,               -- "<owner>/<repo>@<commit sha>"
  reachable INTEGER NOT NULL,
  checked_at INTEGER NOT NULL
);

-- 'all': any public github.com action; 'pinned': only full commit SHAs (also for actions they call);
-- 'builtin': only the forge's built-in actions (checkout, cache, upload-artifact, setup-*).
ALTER TABLE repos ADD COLUMN actions_policy TEXT NOT NULL DEFAULT 'all';