check.yml

name: iCourse Check

on:
  schedule:
    # Every day at 22:00 UTC+8 (14:00 UTC)
    - cron: "0 14 * * *"
  workflow_dispatch:

permissions:
  contents: write

jobs:
  check:
    runs-on: ubuntu-latest
    timeout-minutes: 180

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Cache Python packages
        id: cache-pip
        uses: actions/cache@v4
        with:
          path: ${{ env.pythonLocation }}/lib/python*/site-packages
          key: pip-${{ hashFiles('requirements.txt') }}

      - name: Install Python dependencies
        if: steps.cache-pip.outputs.cache-hit != 'true'
        run: pip install -r requirements.txt

      - name: Install ffmpeg
        run: sudo apt-get install -y ffmpeg

      # Cache ASR models (fixed key — only re-download if model version changes)
      - name: Cache ASR models
        id: cache-models
        uses: actions/cache@v4
        with:
          path: |
            sherpa-onnx-sense-voice-zh-en-ja-ko-yue-2024-07-17/
            silero_vad.onnx
          key: asr-models-sensevoice-2024-07-17

      - name: Download ASR models
        if: steps.cache-models.outputs.cache-hit != 'true'
        run: |
          wget -q https://github.com/k2-fsa/sherpa-onnx/releases/download/asr-models/sherpa-onnx-sense-voice-zh-en-ja-ko-yue-2024-07-17.tar.bz2
          tar xf sherpa-onnx-sense-voice-zh-en-ja-ko-yue-2024-07-17.tar.bz2
          rm sherpa-onnx-sense-voice-zh-en-ja-ko-yue-2024-07-17.tar.bz2
          wget -q https://github.com/k2-fsa/sherpa-onnx/releases/download/asr-models/silero_vad.onnx

      # Decrypt database from repo (handles fork: different secrets = decrypt fails = start fresh)
      - name: Decrypt database
        if: hashFiles('data/icourse.db.enc') != ''
        env:
          DB_KEY: ${{ secrets.STUID }}${{ secrets.UISPSW }}${{ secrets.DASHSCOPE_API_KEY }}${{ secrets.SMTP_PASSWORD }}
        run: |
          if openssl enc -aes-256-cbc -d -pbkdf2 \
            -in data/icourse.db.enc -out data/icourse.db \
            -pass env:DB_KEY 2>/dev/null; then
            echo "Database decrypted successfully."
          else
            echo "::warning::Decryption failed (new fork or changed secrets). Starting with fresh database."
            rm -f data/icourse.db
          fi

      - name: Record database state
        id: db-before
        run: |
          if [ -f data/icourse.db ]; then
            echo "hash=$(md5sum data/icourse.db | cut -d' ' -f1)" >> $GITHUB_OUTPUT
          else
            echo "hash=none" >> $GITHUB_OUTPUT
          fi

      - name: Run
        env:
          StuId: ${{ secrets.STUID }}
          UISPsw: ${{ secrets.UISPSW }}
          COURSE_IDS: ${{ secrets.COURSE_IDS }}
          DASHSCOPE_API_KEY: ${{ secrets.DASHSCOPE_API_KEY }}
          SMTP_EMAIL: ${{ secrets.SMTP_EMAIL }}
          SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
          RECEIVER_EMAIL: ${{ secrets.RECEIVER_EMAIL }}
        run: python main.py

      # Encrypt and commit database only if it changed
      - name: Commit database
        if: always()
        env:
          DB_KEY: ${{ secrets.STUID }}${{ secrets.UISPSW }}${{ secrets.DASHSCOPE_API_KEY }}${{ secrets.SMTP_PASSWORD }}
        run: |
          if [ ! -f data/icourse.db ]; then
            echo "No database file, skipping."
            exit 0
          fi

          AFTER=$(md5sum data/icourse.db | cut -d' ' -f1)
          if [ "$AFTER" = "${{ steps.db-before.outputs.hash }}" ]; then
            echo "Database unchanged, skipping commit."
            exit 0
          fi

          openssl enc -aes-256-cbc -salt -pbkdf2 \
            -in data/icourse.db -out data/icourse.db.enc \
            -pass env:DB_KEY

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add data/icourse.db.enc
          git commit -m "chore: update encrypted database"
          git push