name: Git Repository Backup (Pre-scan)

on:
  workflow_dispatch:
    inputs:
      branches:
        description: 'Comma-separated list of sourceRepo/branch entries to mirror (e.g., dev_Net8.git/Develop_Net8,dev.git/develop). If empty, all entries from branch_list file will be mirrored.'
        required: false
        default: ''
  schedule:
    - cron: '0 17 * * *' # UTC 17:00 == KST 02:00

jobs:
  backup:
    runs-on: [internal]
    timeout-minutes: 500
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up SSH
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
        run: |
          mkdir -p ~/.ssh
          echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          ssh-keyscan -p 22 172.16.10.191 >> ~/.ssh/known_hosts

      - name: Refresh source mirror repositories (git fetch --mirror)
        run: |
          set -euo pipefail
          echo "Refreshing mirror repos on 172.16.10.191 ..."
          ssh engdev@172.16.10.191 'set -euo pipefail; shopt -s nullglob; for repo in *.git; do [ -d "${repo}" ] || continue; echo "Updating ${repo}"; (cd "${repo}" && git fetch --prune --prune-tags origin "+refs/*:refs/*"); done'

      - name: Backup Branches (pre-scan → decision → execution)
        continue-on-error: true
        env:
          BASE_GITEA_TOKEN: ${{ secrets.BASE_GITEA_TOKEN }}
          BASE_GITEA_URL: ${{ vars.BASE_GITEA_URL }} # e.g., https://gitea.example.com
          BASE_GITEA_USER: ${{ vars.BASE_GITEA_USER }} # The user who owns the token
          INPUT_BRANCHES: ${{ github.event.inputs.branches }}
          NOTIFY_WEBHOOK: ${{ vars.NOTIFY_WEBHOOK }} # Optional chat webhook
          SYNC_TAGS: ${{ vars.SYNC_TAGS }} # Optional, "false" to skip tag sync
          TARGET_SEED_DEPTH: ${{ vars.TARGET_SEED_DEPTH }} # Optional, fallback seed depth (default 50)
        run: |
          set -euo pipefail

          CENTER_ORG="center_dev"
          AUTH_HEADER="Authorization: token ${BASE_GITEA_TOKEN}"
          SOURCE_SSH_HOST="engdev@172.16.10.191"
          ROOT_DIR="$(pwd)"
          NOTIFY_WEBHOOK="${NOTIFY_WEBHOOK:-}"
          SYNC_TAGS="${SYNC_TAGS:-true}"
          TARGET_SEED_DEPTH="${TARGET_SEED_DEPTH:-50}"
          if ! [[ "${TARGET_SEED_DEPTH}" =~ ^[0-9]+$ ]] || (( TARGET_SEED_DEPTH <= 0 )); then
            echo "::warning::TARGET_SEED_DEPTH(${TARGET_SEED_DEPTH}) is invalid; resetting to 50"
            TARGET_SEED_DEPTH=50
          fi
          CACHE_BASE="${ROOT_DIR}/.cache_sources"
          mkdir -p "${CACHE_BASE}"
          TOTAL_SUCCESS=0
          TOTAL_SKIP=0
          TOTAL_ERROR=0
          TS_KST=$(TZ=Asia/Seoul date '+%Y%m%d_%H%M%S')
          REPORT_DIR="${ROOT_DIR}/backup_reports"
          mkdir -p "${REPORT_DIR}"
          DECISIONS_LOG="${REPORT_DIR}/decisions_${TS_KST}.log"
          TIMINGS_LOG="${REPORT_DIR}/timings_${TS_KST}.log"
          REPORT_MD="${REPORT_DIR}/report_${TS_KST}.md"
          echo "REPORT_TS=${TS_KST}" >> "${GITHUB_ENV}"
          echo "REPORT_DIR=${REPORT_DIR}" >> "${GITHUB_ENV}"
          echo "SOURCE_SSH_HOST=${SOURCE_SSH_HOST}" >> "${GITHUB_ENV}"
          : > "${DECISIONS_LOG}"
          : > "${TIMINGS_LOG}"

          notify_status() {
            local status="$1" repo="$2" branch="$3" mode="$4" start_epoch="$5" reason="${6:-}" details="${7:-}"
            local ts end_epoch duration text payload
            case "${status}" in
              success) ((++TOTAL_SUCCESS)) ;;
              skip) ((++TOTAL_SKIP)) ;;
              error) ((++TOTAL_ERROR)) ;;
            esac
            [[ -z "${NOTIFY_WEBHOOK}" ]] && return
            ts=$(TZ=Asia/Seoul date '+%Y-%m-%d %H:%M:%S %Z')
            case "${status}" in
              start)
                text="센터Git ${repo} 백업을 ${ts}에 시작합니다. (branch: ${branch}, mode: ${mode})"
                ;;
              skip)
                end_epoch=$(date +%s)
                duration=$((end_epoch - start_epoch))
                text="센터Git ${repo} 백업을 건너뜁니다. (branch: ${branch} -> main, mode: ${mode}, duration: ${duration}s, 시각: ${ts})"
                ;;
              success)
                end_epoch=$(date +%s)
                duration=$((end_epoch - start_epoch))
                text="센터Git ${repo} 백업을 완료했습니다. (branch: ${branch} -> main, mode: ${mode}, duration: ${duration}s, 완료시각: ${ts})"
                ;;
              error)
                end_epoch=$(date +%s)
                duration=$((end_epoch - start_epoch))
                text="센터Git ${repo} 백업이 실패했습니다. (branch: ${branch}, mode: ${mode}, duration: ${duration}s, 이유: ${reason}, 시각: ${ts})"
                ;;
              *)
                text="센터Git ${repo} 상태: ${status} (${ts})"
                ;;
            esac
            if [[ -n "${details}" ]]; then
              text="${text} (heads: ${details})"
            fi
            payload=${text//\"/\\\"}
            curl -sS -i -X POST \
              -H "Content-Type: application/json" \
              -d "{\"username\":\"Gitea\",\"icon_url\":\"https://gitea.hmac.kr/assets/img/logo.svg\",\"text\":\"${payload}\"}" \
              "${NOTIFY_WEBHOOK}" >/dev/null || echo "::warning::Notification failed for ${repo} (${status})"
          }

          set_default_branch_main() {
            local repo_name="$1"
            local response http_status body attempt max_api_retry
            max_api_retry=3
            attempt=1
            while (( attempt<=max_api_retry )); do
              response=$(curl -s -w "\n%{http_code}" -X PATCH -H "Content-Type: application/json" -H "${AUTH_HEADER}" -d "{\"default_branch\":\"main\"}" "${BASE_GITEA_URL}/api/v1/repos/${CENTER_ORG}/${repo_name}") || response=$'\n000'
              http_status=$(echo "${response}" | tail -n1)
              body=$(echo "${response}" | sed '$d')
              if [[ "${http_status}" == "000" || "${http_status}" =~ ^5 || "${http_status}" == "429" ]]; then
                echo "::warning::Retrying default branch set (HTTP ${http_status}) for ${repo_name} (${attempt}/3)..."
                sleep 5
                ((attempt++))
                continue
              fi
              break
            done

            if [[ "${http_status}" != "200" ]]; then
              echo "::warning::Failed to set default branch to 'main' for ${CENTER_ORG}/${repo_name} (status ${http_status})"
              if [[ -n "${body}" ]]; then
                echo "${body}"
              fi
            else
              echo "Default branch set to 'main' for ${CENTER_ORG}/${repo_name}"
            fi
          }

          append_decision_row() {
            local note="$1"
            printf "%s|%s|%s|%s|%s|%s|%s|%s\n" "${source_repo}" "${branch_name}" "${alias_name}" "${repo_name}" "${source_commit}" "${target_commit}" "${decision}" "${note}" >> "${DECISIONS_LOG}"
          }

          append_timing_row() {
            local status="$1" note="$2"
            local end_ts="${exec_end_epoch:-$(date +%s)}"
            local dec_ts="${decision_epoch:-$start_epoch}"
            local exec_start_ts="${exec_start_epoch:-}"
            local total_dur=$(( end_ts - start_epoch ))
            local exec_dur=0
            if [[ -n "${exec_start_ts}" ]]; then
              exec_dur=$(( end_ts - exec_start_ts ))
            fi
            printf "%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s\n" \
              "${source_repo}" "${branch_name}" "${alias_name}" "${repo_name}" \
              "${source_commit}" "${target_commit}" "${decision}" "${status}" \
              "${start_epoch}" "${dec_ts}" "${exec_start_ts}" "${end_ts}" \
              "${total_dur}" "${exec_dur}" "${note}" >> "${TIMINGS_LOG}"
          }

          map_repo_name() {
            local branch_name="$1" alias_name="$2" resolved
            resolved="${branch_name}"
            if [[ "${branch_name}" == "Develop_Net8" ]]; then
              resolved="base"
            elif [[ "${branch_name}" == "Develop_Net8_"* ]]; then
              resolved="${branch_name#Develop_Net8_}"
            elif [[ "${branch_name}" == "Develop_"* ]]; then
              resolved="${branch_name#Develop_}"
            elif [[ "${branch_name}" == "develop_"* ]]; then
              resolved="${branch_name#develop_}"
            fi
            if [[ -n "${alias_name}" ]]; then
              resolved="${alias_name}"
            fi
            echo "${resolved}"
          }

          declare -A SOURCE_HEADS
          declare -A ENTRY_SOURCE
          declare -A ENTRY_BRANCH
          declare -A ENTRY_ALIAS
          declare -A ENTRY_REPO
          declare -A SOURCE_REPOS
          declare -A SOURCE_CACHE_PATH
          declare -a ENTRY_KEYS=()

          add_entry() {
            local entry_raw="$1" entry alias_name source_repo branch_name repo_name idx
            entry="${entry_raw%%#*}"
            entry="$(echo "$entry" | xargs)"
            [[ -z "${entry}" ]] && return

            alias_name=""
            if [[ "${entry}" == *","* ]]; then
              IFS=',' read -r entry alias_name <<< "${entry}"
              entry="$(echo "$entry" | xargs)"
              alias_name="$(echo "$alias_name" | xargs)"
            fi

            if [[ "${entry}" != */* ]]; then
              echo "::warning::Entry '${entry}' is missing sourceRepo/branch format. Skipping."
              return
            fi

            source_repo="${entry%%/*}"
            branch_name="${entry#*/}"
            if [[ -z "${source_repo}" || -z "${branch_name}" ]]; then
              echo "::warning::Invalid entry '${entry}'. Skipping."
              return
            fi

            repo_name="$(map_repo_name "${branch_name}" "${alias_name}")"
            idx="${#ENTRY_KEYS[@]}"
            ENTRY_KEYS+=("${idx}")
            ENTRY_SOURCE["${idx}"]="${source_repo}"
            ENTRY_BRANCH["${idx}"]="${branch_name}"
            ENTRY_ALIAS["${idx}"]="${alias_name}"
            ENTRY_REPO["${idx}"]="${repo_name}"
            SOURCE_REPOS["${source_repo}"]=1
          }

          if [[ -n "${INPUT_BRANCHES}" ]]; then
            echo "Processing manually specified branches (pre-scan mode): ${INPUT_BRANCHES}"
            IFS=',' read -r -a branches_to_process <<< "${INPUT_BRANCHES}"
            for branch in "${branches_to_process[@]}"; do
              add_entry "${branch}"
            done
          else
            echo "Processing branch_list in pre-scan mode."
            while IFS= read -r branch_line || [[ -n "${branch_line}" ]]; do
              add_entry "${branch_line}"
            done < branch_list
          fi

          if (( ${#ENTRY_KEYS[@]} == 0 )); then
            echo "::error::No valid branch entries to process."
            exit 1
          fi

          prepare_cache() {
            local source_repo="$1" cache_dir="${CACHE_BASE}/${source_repo//\//_}.git"
            if [[ ! -d "${cache_dir}" ]]; then
              echo "Initializing local cache for ${source_repo} at ${cache_dir}"
              if ! git clone --mirror "${SOURCE_SSH_HOST}:${source_repo}" "${cache_dir}"; then
                echo "::warning::Failed to clone cache for ${source_repo} (${SOURCE_SSH_HOST}:${source_repo})"
                return 1
              fi
            else
              echo "Refreshing cache for ${source_repo}"
              if ! git -C "${cache_dir}" fetch --prune --prune-tags origin "+refs/*:refs/*"; then
                echo "::warning::Failed to refresh cache for ${source_repo} (${SOURCE_SSH_HOST}:${source_repo})"
                return 1
              fi
            fi
            SOURCE_CACHE_PATH["${source_repo}"]="${cache_dir}"
          }

          echo "Preparing per-source caches..."
          for source_repo in "${!SOURCE_REPOS[@]}"; do
            prepare_cache "${source_repo}" || echo "::warning::Cache unavailable for ${source_repo}; will fallback to direct fetch"
          done

          echo "Step 1) 소스 브랜치 해시 스캔"
          for source_repo in "${!SOURCE_REPOS[@]}"; do
            cache_dir="${SOURCE_CACHE_PATH[${source_repo}]:-}"
            source_repo_url="${SOURCE_SSH_HOST}:${source_repo}"
            if [[ -n "${cache_dir}" && -d "${cache_dir}" ]]; then
              echo " - using cache: ${cache_dir}"
              if ! remote_output=$(git -C "${cache_dir}" for-each-ref --format='%(objectname)\t%(refname)' 'refs/heads/*'); then
                echo "::warning::Failed to read heads from cache ${cache_dir}; falling back to remote ${source_repo_url}."
                remote_output=$(git ls-remote --heads "${source_repo_url}") || {
                  echo "::warning::Failed to ls-remote ${source_repo_url}. Entries for this repo may fail."
                  continue
                }
              fi
            else
              echo " - ${source_repo_url}"
              if ! remote_output=$(git ls-remote --heads "${source_repo_url}"); then
                echo "::warning::Failed to ls-remote ${source_repo_url}. Entries for this repo may fail."
                continue
              fi
            fi
            if [[ -z "${remote_output}" ]]; then
              echo "::warning::No branches found for ${source_repo_url}"
              continue
            fi
            while IFS=$'\t' read -r commit ref || [[ -n "${commit}" ]]; do
              [[ -z "${commit}" || -z "${ref}" ]] && continue
              branch="${ref#refs/heads/}"
              SOURCE_HEADS["${source_repo}|${branch}"]="${commit}"
            done <<< "${remote_output}"
          done
                continue
              fi
            fi
            while IFS=$'\t' read -r commit ref || [[ -n "${commit}" ]]; do
              [[ -z "${commit}" || -z "${ref}" ]] && continue
              branch="${ref#refs/heads/}"
              SOURCE_HEADS["${source_repo}|${branch}"]="${commit}"
              echo -e "${source_repo}\t${branch}\t${commit}" >> "${SOURCE_HEADS_FILE}"
            done <<< "${remote_output}"
          done

          echo "Step 2) 타겟 해시 스캔 및 실행 계획 수립"
          GITEA_HOSTNAME=$(echo "${BASE_GITEA_URL}" | sed -e 's~^https*://~~' -e 's~/$~~')

          for idx in "${ENTRY_KEYS[@]}"; do
            source_repo="${ENTRY_SOURCE[${idx}]}"
            branch_name="${ENTRY_BRANCH[${idx}]}"
            alias_name="${ENTRY_ALIAS[${idx}]}"
            repo_name="${ENTRY_REPO[${idx}]}"
            start_epoch=$(date +%s)
            backup_mode="미정"
            note=""
            target_commit=""
            heads_detail="src=unknown tgt=unknown"
            decision_epoch=""
            exec_start_epoch=""
            exec_end_epoch=""

            source_commit="${SOURCE_HEADS[${source_repo}|${branch_name}]:-}"
            if [[ -z "${source_commit}" ]]; then
              decision="사전 스캔 실패"
              decision_epoch=$(date +%s)
              note="source branch 없음/조회 실패 (repo=${source_repo}, branch=${branch_name})"
              append_decision_row "${note}"
              heads_detail="src=none tgt=unknown"
              notify_status "error" "${repo_name}" "${branch_name}" "사전 스캔 실패" "${start_epoch}" "${note}" "${heads_detail}"
              append_timing_row "error" "${note}"
              echo "Skipping ${branch_name} (${repo_name}) - ${note}"
              continue
            fi

            GITEA_REMOTE="https://${BASE_GITEA_USER}:${BASE_GITEA_TOKEN}@${GITEA_HOSTNAME}/${CENTER_ORG}/${repo_name}.git"
            repo_exists=false
            just_created=false
            max_api_retry=3
            attempt=1
            while (( attempt<=max_api_retry )); do
              http_status=$(curl -s -o /dev/null -w "%{http_code}" -H "${AUTH_HEADER}" "${BASE_GITEA_URL}/api/v1/repos/${CENTER_ORG}/${repo_name}") || http_status="000"
              if [[ "${http_status}" == "000" || "${http_status}" =~ ^5 || "${http_status}" == "429" ]]; then
                echo "::warning::Repo check HTTP ${http_status} for ${repo_name} (${attempt}/3); retrying in 5s..."
                sleep 5
                ((attempt++))
                continue
              fi
              break
            done

            if [[ "${http_status}" == "200" ]]; then
              repo_exists=true
            elif [[ "${http_status}" == "404" ]]; then
              repo_exists=false
            else
              decision="사전 조회 실패"
              decision_epoch=$(date +%s)
              note="repo 조회 실패 (HTTP ${http_status})"
              echo "::warning::${note}"
              heads_detail="src=${source_commit} tgt=unknown"
              notify_status "error" "${repo_name}" "${branch_name}" "사전 조회 실패" "${start_epoch}" "${note}" "${heads_detail}"
              append_decision_row "${note}"
              append_timing_row "error" "${note}"
              continue
            fi

            target_commit=""
            if ${repo_exists}; then
              target_main_ref=$(git ls-remote "${GITEA_REMOTE}" "refs/heads/main" || true)
              target_commit=$(echo "${target_main_ref}" | awk '{print $1}')
            fi
            heads_detail="src=${source_commit} tgt=${target_commit:-none}"
            exists_text=$(${repo_exists} && echo "true" || echo "false")
            echo -e "${repo_name}\tmain\t${target_commit:-}\t${exists_text}" >> "${TARGET_HEADS_FILE}"

            decision=""
            if ! ${repo_exists}; then
              decision="신규 백업"
              note="타겟 저장소 없음"
            elif [[ -z "${target_commit}" ]]; then
              decision="신규 백업"
              note="타겟 main 없음"
            elif [[ "${source_commit}" == "${target_commit}" ]]; then
              decision="동일 커밋 - 건너뜀"
              note="동일 커밋"
            else
              decision="증분 백업"
              note="커밋 상이"
            fi

            decision_epoch=$(date +%s)
            append_decision_row "${note}"

            if [[ "${decision}" == "동일 커밋 - 건너뜀" ]]; then
              notify_status "skip" "${repo_name}" "${branch_name}" "${decision}" "${start_epoch}" "" "${heads_detail}"
              echo "Pre-scan marked ${branch_name} (${repo_name}) as skip (same commit)."
              append_timing_row "skip" "${note}"
              continue
            fi

            if [[ "${decision}" == "신규 백업" ]]; then
              backup_mode="신규 백업"
              echo "Repository 'center_dev/${repo_name}' does not exist or main is missing. Will create/push."
              attempt=1
              create_status=""
              if ! ${repo_exists}; then
                while (( attempt<=max_api_retry )); do
                  create_status=$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Content-Type: application/json" -H "${AUTH_HEADER}" -d "{\"name\":\"${repo_name}\",\"private\":true,\"default_branch\":\"main\"}" "${BASE_GITEA_URL}/api/v1/orgs/${CENTER_ORG}/repos") || create_status="000"
                  if [[ "${create_status}" == "000" || "${create_status}" =~ ^5 || "${create_status}" == "429" ]]; then
                    echo "::warning::Repo create HTTP ${create_status} for ${repo_name} (${attempt}/3); retrying in 5s..."
                    sleep 5
                    ((attempt++))
                    continue
                  fi
                  break
                done
                if [[ "${create_status}" != "201" ]]; then
                  echo "::error::Failed to create repository. HTTP ${create_status}"
                  notify_status "error" "${repo_name}" "${branch_name}" "${backup_mode}" "${start_epoch}" "repo 생성 실패 (HTTP ${create_status})" "${heads_detail}"
                  exec_end_epoch=$(date +%s)
                  append_timing_row "error" "repo 생성 실패 (HTTP ${create_status})"
                  continue
                fi
                echo "Repository created successfully."
                repo_exists=true
                just_created=true
              fi
            else
              backup_mode="증분 백업"
              just_created=false
            fi

            notify_status "start" "${repo_name}" "${branch_name}" "${backup_mode}" "${start_epoch}" "" "${heads_detail}"

            exec_start_epoch=$(date +%s)
            shallow_exclude_args=()
            if ${repo_exists} && [[ -n "${target_commit:-}" ]]; then
              shallow_exclude_args=(--shallow-exclude="${target_commit}")
            fi

            CLONE_DIR=$(mktemp -d)
            echo "Working directory: ${CLONE_DIR}"
            if ${just_created}; then
              echo "Target repo newly created; cloning source branch for initial push..."
              SOURCE_FETCH_REMOTE="${SOURCE_CACHE_PATH[${source_repo}]:-${SOURCE_SSH_HOST}:${source_repo}}"
              if ! git clone --bare --no-tags --single-branch --branch "${branch_name}" "${SOURCE_FETCH_REMOTE}" "${CLONE_DIR}"; then
                echo "::error::Failed to clone source repository ${SOURCE_FETCH_REMOTE}"
                notify_status "error" "${repo_name}" "${branch_name}" "${backup_mode}" "${start_epoch}" "source clone 실패" "${heads_detail}"
                exec_end_epoch=$(date +%s)
                append_timing_row "error" "source clone 실패"
                rm -rf "${CLONE_DIR}"
                continue
              fi
              cd "${CLONE_DIR}"
              git remote rename origin source
              git remote add origin "${GITEA_REMOTE}"
            else
              cd "${CLONE_DIR}"
              if ! git init --bare; then
                echo "::error::Failed to init bare repository"
                notify_status "error" "${repo_name}" "${branch_name}" "${backup_mode}" "${start_epoch}" "bare init 실패" "${heads_detail}"
                exec_end_epoch=$(date +%s)
                append_timing_row "error" "bare init 실패"
                cd "${ROOT_DIR}"
                rm -rf "${CLONE_DIR}"
                continue
              fi
              git remote add origin "${GITEA_REMOTE}"
              SOURCE_FETCH_REMOTE="${SOURCE_CACHE_PATH[${source_repo}]:-${SOURCE_SSH_HOST}:${source_repo}}"
              git remote add source "${SOURCE_FETCH_REMOTE}"
            fi

            FETCH_REMOTE="${SOURCE_FETCH_REMOTE:-${SOURCE_SSH_HOST}:${source_repo}}"
            prep_elapsed=$(( $(date +%s) - start_epoch ))
            echo "Prep completed in ${prep_elapsed}s. Fetching latest branch '${branch_name}' from source ${FETCH_REMOTE} ..."
            FETCH_LOG="${CLONE_DIR}/fetch_shallow.log"
            if ! git fetch --no-tags "${shallow_exclude_args[@]}" source "+refs/heads/${branch_name}:refs/heads/${branch_name}" 2> >(tee "${FETCH_LOG}" >&2); then
              if [[ "${#shallow_exclude_args[@]}" -gt 0 ]]; then
                echo "::warning::shallow-exclude fetch failed (likely unsupported). Log: ${FETCH_LOG}"
                if [[ -s "${FETCH_LOG}" ]]; then
                  echo "[shallow-exclude stderr tail]"
                  tail -n 40 "${FETCH_LOG}"
                fi
                echo "[fallback] Seeding target main depth=${TARGET_SEED_DEPTH} then retrying full fetch without shallow-exclude"
                SEED_LOG="${CLONE_DIR}/fetch_seed.log"
                git fetch --no-tags --depth="${TARGET_SEED_DEPTH}" origin "refs/heads/main:refs/heads/main" 2> >(tee "${SEED_LOG}" >&2) || echo "::warning::Seeding from target main skipped (fetch failed or branch missing)"
                backup_mode="증분 백업 (폴백: shallow-exclude 미지원)"
                FULL_FETCH_LOG="${CLONE_DIR}/fetch_full.log"
                if ! git fetch --no-tags source "+refs/heads/${branch_name}:refs/heads/${branch_name}" 2> >(tee "${FULL_FETCH_LOG}" >&2); then
                  if [[ -s "${SEED_LOG:-}" ]]; then
                    echo "[seed stderr tail]"
                    tail -n 40 "${SEED_LOG}"
                  fi
                  if [[ -s "${FULL_FETCH_LOG}" ]]; then
                    echo "[fallback fetch stderr tail]"
                    tail -n 40 "${FULL_FETCH_LOG}"
                  fi
                  echo "::error::Failed to fetch branch '${branch_name}' from source repo (fallback without shallow-exclude)"
                  notify_status "error" "${repo_name}" "${branch_name}" "${backup_mode}" "${start_epoch}" "source fetch 오류(폴백)" "${heads_detail}"
                  exec_end_epoch=$(date +%s)
                  append_timing_row "error" "source fetch 오류(폴백)"
                  cd "${ROOT_DIR}"
                  rm -rf "${CLONE_DIR}"
                  continue
                fi
              else
                echo "::error::Failed to fetch branch '${branch_name}' from source repo"
                notify_status "error" "${repo_name}" "${branch_name}" "${backup_mode}" "${start_epoch}" "source fetch 오류" "${heads_detail}"
                exec_end_epoch=$(date +%s)
                append_timing_row "error" "source fetch 오류"
                cd "${ROOT_DIR}"
                rm -rf "${CLONE_DIR}"
                continue
              fi
            fi

            if [[ "${SYNC_TAGS}" == "true" ]]; then
              echo "Fetching tags from source..."
              if ! git fetch --prune --prune-tags --no-tags source "refs/tags/*:refs/tags/*"; then
                echo "::error::Failed to fetch tags from source repo"
                notify_status "error" "${repo_name}" "${branch_name}" "${backup_mode}" "${start_epoch}" "tag fetch 오류" "${heads_detail}"
                exec_end_epoch=$(date +%s)
                append_timing_row "error" "tag fetch 오류"
                cd "${ROOT_DIR}"
                rm -rf "${CLONE_DIR}"
                continue
              fi
            fi

            echo "Pushing '${branch_name}' to Gitea repository '${repo_name}'..."
            if ! git push --progress --force origin "refs/heads/${branch_name}:refs/heads/main"; then
              echo "::error::Failed to push branch '${branch_name}' to target repository"
              notify_status "error" "${repo_name}" "${branch_name}" "${backup_mode}" "${start_epoch}" "push 오류 (-> main)" "${heads_detail}"
              exec_end_epoch=$(date +%s)
              append_timing_row "error" "push 오류 (-> main)"
              cd "${ROOT_DIR}"
              rm -rf "${CLONE_DIR}"
              continue
            fi
            if [[ "${SYNC_TAGS}" == "true" ]]; then
              echo "Pushing tags to Gitea repository '${repo_name}'..."
              if ! git push --force --prune origin "refs/tags/*:refs/tags/*"; then
                echo "::warning::Failed to push tags to target repository"
                notify_status "error" "${repo_name}" "${branch_name}" "${backup_mode}" "${start_epoch}" "tag push 오류" "${heads_detail}"
                exec_end_epoch=$(date +%s)
                append_timing_row "error" "tag push 오류"
              fi
            fi

            cd "${ROOT_DIR}"
            rm -rf "${CLONE_DIR}"
            
            echo "Successfully mirrored ${branch_name} to center_dev/${repo_name}"
            set_default_branch_main "${repo_name}"
            final_heads_detail="src=${source_commit} tgt=${source_commit}"
            exec_end_epoch=$(date +%s)
            append_timing_row "success" "${backup_mode}"
            notify_status "success" "${repo_name}" "${branch_name}" "${backup_mode}" "${start_epoch}" "" "${final_heads_detail}"
            echo "================================================="
            echo ""
          done

          TOTAL_PROCESSED=$((TOTAL_SUCCESS + TOTAL_SKIP + TOTAL_ERROR))
          SUMMARY_TS=$(TZ=Asia/Seoul date '+%Y-%m-%d %H:%M:%S %Z')
          SUMMARY_TEXT="브랜치 동기화 완료: 총 ${TOTAL_PROCESSED}개 (성공 ${TOTAL_SUCCESS}, 동일로 건너뜀 ${TOTAL_SKIP}, 오류 ${TOTAL_ERROR}) - ${SUMMARY_TS}"
          echo "${SUMMARY_TEXT}"
          echo "보고서(마크다운)는 이후 스텝에서 생성됩니다."
          echo "${TOTAL_ERROR}" > "${REPORT_DIR}/exit_code"
          if [[ -n "${NOTIFY_WEBHOOK}" ]]; then
            SUMMARY_PAYLOAD=${SUMMARY_TEXT//\"/\\\"}
            curl -sS -i -X POST \
              -H "Content-Type: application/json" \
              -d "{\"username\":\"Gitea\",\"icon_url\":\"https://gitea.hmac.kr/assets/img/logo.svg\",\"text\":\"${SUMMARY_PAYLOAD}\"}" \
              "${NOTIFY_WEBHOOK}" >/dev/null || echo "::warning::Summary notification failed"
          fi

          if (( TOTAL_ERROR > 0 )); then
            echo "::warning::One or more branches failed (${TOTAL_ERROR})."
            exit 1
          fi

      - name: Build markdown report
        if: always()
        run: |
          set -euo pipefail
          REPORT_DIR="${REPORT_DIR:-${GITHUB_WORKSPACE}/backup_reports}"
          TS="${REPORT_TS:-}"
          if [[ -z "${TS}" ]]; then
            TS=$(ls -t ${REPORT_DIR}/decisions_*.log 2>/dev/null | head -1 | sed -E 's/.*decisions_([0-9_]+)\.log/\1/')
          fi
          DECISIONS_LOG="${REPORT_DIR}/decisions_${TS}.log"
          TIMINGS_LOG="${REPORT_DIR}/timings_${TS}.log"
          REPORT_MD="${REPORT_DIR}/report_${TS}.md"
          SOURCE_SSH_HOST="${SOURCE_SSH_HOST:-}"

          SUMMARY_TS=$(TZ=Asia/Seoul date '+%Y-%m-%d %H:%M:%S %Z')
          total=0; success=0; skip=0; error=0
          if [[ -f "${TIMINGS_LOG}" ]]; then
            while IFS='|' read -r sr br al rr sc tc dc st se de ee xe dt dexe nt; do
              [[ -z "${sr}" ]] && continue
              ((total++))
              case "${st}" in
                success) ((success++)) ;;
                skip) ((skip++)) ;;
                error) ((error++)) ;;
              esac
            done < "${TIMINGS_LOG}"
          fi

          {
            echo "# Git Backup Report"
            echo ""
            echo "- Generated: ${SUMMARY_TS}"
            echo "- Run ID: ${GITHUB_RUN_ID:-local}"
            [[ -n "${SOURCE_SSH_HOST}" ]] && echo "- Source host: ${SOURCE_SSH_HOST}"
            echo "- Total: ${total} (success ${success}, skip ${skip}, error ${error})"
            echo ""
            echo "## Decisions (all)"
            echo "|source_repo|branch|alias|resolved_repo|source_commit|target_commit|decision|note|"
            echo "|---|---|---|---|---|---|---|---|"
            if [[ -f "${DECISIONS_LOG}" ]]; then
              while IFS='|' read -r sr br al rr sc tc dc nt; do
                [[ -z "${sr}" ]] && continue
                printf "|%s|%s|%s|%s|%s|%s|%s|%s|\n" "$sr" "$br" "$al" "$rr" "$sc" "$tc" "$dc" "$nt"
              done < "${DECISIONS_LOG}"
            else
              echo "|(missing)|(missing)|(missing)|(missing)|(missing)|(missing)|(missing)|(missing)|"
            fi
            echo ""
            echo "## Timings (all)"
            echo "|source_repo|branch|alias|resolved_repo|source_commit|target_commit|decision|status|start_epoch|decision_epoch|exec_start_epoch|exec_end_epoch|duration_total(s)|duration_exec(s)|note|"
            echo "|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|"
            if [[ -f "${TIMINGS_LOG}" ]]; then
              while IFS='|' read -r sr br al rr sc tc dc st se de ee xe dt dexe nt; do
                [[ -z "${sr}" ]] && continue
                printf "|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|\n" "$sr" "$br" "$al" "$rr" "$sc" "$tc" "$dc" "$st" "$se" "$de" "$ee" "$xe" "$dt" "$dexe" "$nt"
              done < "${TIMINGS_LOG}"
            else
              echo "|(missing)|(missing)|(missing)|(missing)|(missing)|(missing)|(missing)|(missing)|(missing)|(missing)|(missing)|(missing)|(missing)|(missing)|(missing)|"
            fi
            echo ""
          } > "${REPORT_MD}"
          echo "Report generated at ${REPORT_MD}"

      - name: Upload backup reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: backup_reports_${{ github.run_id }}
          path: backup_reports

      - name: Fail if backup had errors
        if: always()
        run: |
          EXIT_CODE=0
          if [[ -f backup_reports/exit_code ]]; then
            EXIT_CODE=$(cat backup_reports/exit_code)
          fi
          if [[ "${EXIT_CODE}" != "0" ]]; then
            echo "::error::Backup reported ${EXIT_CODE} errors."
            exit 1
          else
            echo "Backup completed without errors."
          fi