post.js

// Post (cleanup) entry for the wireguard-quick-action GitHub Action.
//
// Wired via `runs.post` in action.yml with `post-if: always()`, so this runs
// at the END OF THE JOB on success, failure, and cancellation.
//
// This file is THIN: the real teardown logic lives in ./wg-down.sh, which
// itself guards for the missing-config case and treats `wg-quick down`
// failures as non-fatal. This wrapper only:
//
//   1. Ensures ./wg-down.sh is executable.
//   2. Spawns it.
//   3. Swallows ANY error so the post step can never mask a real upstream
//      job failure.
//
// Uses only Node.js built-in modules.

'use strict';

const fs = require('fs');
const os = require('os');
const path = require('path');
const { execFileSync } = require('child_process');

const SCRIPT = path.join(__dirname, 'wg-down.sh');

const log = (msg) => process.stdout.write(`[wireguard-quick-action:post] ${msg}${os.EOL}`);

try {
    // Defensive chmod in case the exec bit didn't survive checkout.
    try {
        fs.chmodSync(SCRIPT, 0o755);
    } catch (err) {
        log(`chmod +x ${SCRIPT} failed (ignored): ${err.message}`);
    }

    // Recover the config path saved by main.js via GITHUB_STATE. The runner
    // exposes saved state as STATE_<key> env vars in the post step. Fall back
    // to the default if the up step never ran (state will be unset).
    const configPath = process.env.STATE_wg_config_path || './wg0.conf';

    execFileSync('bash', [SCRIPT], {
        stdio: 'inherit',
        env: { ...process.env, WG_CONFIG_PATH: configPath },
    });
    log('teardown finished.');
} catch (err) {
    // Swallow: teardown is best-effort and must never fail the job.
    const msg = err && err.message ? err.message : String(err);
    log(`teardown error (ignored): ${msg}`);
}