From b92374239f64b0e10abd5cfbb1ec66ec05bd5359 Mon Sep 17 00:00:00 2001
From: mlugg <mlugg@mlugg.co.uk>
Date: Fri, 13 Sep 2024 10:43:05 +0100
Subject: [PATCH] Add workflow to check mirrors are functional

This Actions workflow will run twice every day. It checks ziglang.org
for the latest `master` build, downloads it from ziglang.org and runs it
through sha512sum, and does the same for each mirror. If the download
from the mirror fails, or the sha512sum output differs, it sends me
personally a notification via an external webhook.
---
 .github/workflows/check-mirrors.yaml | 25 +++++++++++++++++++++++++
 check-mirrors.sh                     | 28 ++++++++++++++++++++++++++++
 main.js                              |  7 ++-----
 mirrors.json                         |  5 +++++
 4 files changed, 60 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/check-mirrors.yaml
 create mode 100755 check-mirrors.sh
 create mode 100644 mirrors.json

diff --git a/.github/workflows/check-mirrors.yaml b/.github/workflows/check-mirrors.yaml
new file mode 100644
index 0000000..a76e4c4
--- /dev/null
+++ b/.github/workflows/check-mirrors.yaml
@@ -0,0 +1,25 @@
+{
+  "name": "check-mirrors",
+  "on": {
+    "schedule": [
+      { "cron": "0 6,18 * * *" },
+    ],
+    "workflow_dispatch": null,
+  },
+  "jobs": {
+    "check-mirrors": {
+      "runs-on": "ubuntu-latest",
+      "steps": [
+        { "uses": "actions/checkout@v4" },
+        {
+          "name": "Check mirrors",
+          "env": {
+            "PUSHOVER_USER": "${{ secrets.PUSHOVER_USER }}",
+            "PUSHOVER_TOKEN": "${{ secrets.PUSHOVER_TOKEN }}",
+          },
+          "run": "sh check-mirrors.sh",
+        },
+      ],
+    },
+  },
+}
diff --git a/check-mirrors.sh b/check-mirrors.sh
new file mode 100755
index 0000000..3ad7c1b
--- /dev/null
+++ b/check-mirrors.sh
@@ -0,0 +1,28 @@
+#!/bin/sh
+
+temp_path="$(mktemp)"
+
+zig_version="$(curl -sSL 'https://ziglang.org/download/index.json' | jq -r '.master.version')"
+filename="zig-linux-x86_64-$zig_version.tar.xz"
+
+curl -L "https://ziglang.org/builds/$filename" >"$temp_path"
+correct_sum="$(sha512sum "$temp_path")"
+
+jq '.[] | .[0] + " " + .[1]' -r <mirrors.json | while read -r mirror_url mirror_name; do
+	curl -L "$mirror_url/$filename" >"$temp_path"
+	download_status="$?"
+	mirror_sum="$(sha512sum "$temp_path")"
+
+	if [ "$download_status" -eq 0 ]; then
+		if [ "$mirror_sum" = "$correct_sum" ]; then
+			continue
+		fi
+	fi
+
+	curl -s \
+		-F user="$PUSHOVER_USER" -F token="$PUSHOVER_TOKEN" \
+		-F message="Zig download mirror '$mirror_name' is down" \
+		https://api.pushover.net/1/messages.json
+done
+
+rm "$temp_path"
diff --git a/main.js b/main.js
index 0af8fa7..48bc891 100644
--- a/main.js
+++ b/main.js
@@ -15,11 +15,8 @@ const CANONICAL = 'https://ziglang.org/builds';
 
 // The list of mirrors we attempt to fetch from. These need not be trusted, as
 // we always verify the minisign signature.
-const MIRRORS = [
-  'https://pkg.machengine.org/zig', // slimsag <stephen@hexops.com>
-  'https://zigmirror.hryx.net/zig', // hryx <codroid@gmail.com>
-  'https://zig.linus.dev/zig',      // linusg <mail@linusgroh.de>
-];
+// This is an array of URLs.
+const MIRRORS = require('./mirrors.json').map((x) => x[0]);
 
 async function downloadFromMirror(mirror, tarball_name, tarball_ext) {
   const tarball_path = await tc.downloadTool(`${mirror}/${tarball_name}${tarball_ext}?source=github-actions`);
diff --git a/mirrors.json b/mirrors.json
new file mode 100644
index 0000000..bee01a7
--- /dev/null
+++ b/mirrors.json
@@ -0,0 +1,5 @@
+[
+	[ "https://pkg.machengine.org/zig", "slimsag <stephen@hexops.com>" ],
+	[ "https://zigmirror.hryx.net/zig", "hryx <codroid@gmail.com>"     ],
+	[ "https://zig.linus.dev/zig",      "linusg <mail@linusgroh.de>"   ]
+]