blocklist-generate.yml

# #
#   @usage              https://github.com/Aetherinox/csf-firewall
#   @type               github workflow
#   @updated            09.28.25
#   @usage              generates a list of ipsets which can then be used within host files, config server firewall, and various other apps
#
#   
#   @secrets            secrets.SELF_TOKEN                                          self github personal access token (fine-grained)
#                       secrets.SELF_TOKEN_CL                                       self github personal access token (classic)
#                       secrets.NPM_TOKEN                                           self npmjs access token
#                       secrets.PYPI_API_TOKEN                                      self Pypi API token (production site) - https://pypi.org/
#                       secrets.PYPI_API_TEST_TOKEN                                 self Pypi API token (test site) - https://test.pypi.org/
#                       secrets.SELF_DOCKERHUB_TOKEN                                self Dockerhub token
#                       secrets.CODECOV_TOKEN                                       codecov upload token for nodejs projects
#                       secrets.API_GEOLITE2_KEY                                    maxmind API token
#                       secrets.CF_ACCOUNT_ID                                       cloudflare account id
#                       secrets.CF_ACCOUNT_TOKEN                                    cloudflare account token
#                       secrets.ARTIFACTS_DOMAIN                                    github artifacts domain name
#                       secrets.ARTIFACTS_PORT                                      github artifacts port
#                       secrets.ARTIFACTS_GITHUB_SSH_PRIVATE_KEY                    github artifacts server ssh private key
#                       secrets.ORG_TOKEN                                           org github personal access token (fine-grained)
#                       secrets.ORG_TOKEN_CL                                        org github personal access token (classic)
#                       secrets.ORG_DOCKERHUB_TOKEN                                 org dockerhub secret
#                       secrets.ORG_GITEA_TOKEN                                     org gitea personal access token (classic) with package:write permission
#                       secrets.BOT_GPG_KEY_ASC                                     bot gpg private key (armored) | BEGIN PGP PRIVATE KEY BLOCK
#                       secrets.BOT_GPG_KEY_B64                                     bot gpg private key (binary) converted to base64
#                       secrets.BOT_GPG_PASSPHRASE                                  bot gpg private key passphrase
#                       secrets.DISCORD_WEBHOOK_CHAN_GITHUB_RELEASES                discord webhook to report release notifications from github to discord
#                       secrets.DISCORD_WEBHOOK_CHAN_GITHUB_WORKFLOWS               discord webhook to report workflow notifications from github to discord
#                       secrets.DISCORD_WEBHOOK_CHAN_GITHUB_UPDATES                 discord webhook to report activity notifications from github to discord
#   
#   @local              these workflows can be tested locally through the use of `act`
#                           https://github.com/nektos/act
#                       Extract act to folder
#                       Add system env var with path to act.exe
#                       Run the commands:
#                           git pull https://github.com/username/repo
#                           act -W .github/workflows/blocklist-generate.yml -P ubuntu-latest=catthehacker/ubuntu:full-22.04
#                           act -W .github/workflows/blocklist-generate.yml -s TOKEN_CL=XXXXXXXXXX --pull=false
#   
#   📄 bl-master.sh               generate master ipset | URLs: VARARG
#   📄 bl-plain.sh                generate ipset from online plain-text url / page | URLs: VARARG
#   📄 bl-json.sh                 generate ipset from json formatted web url. requires url and jq query | URLs: SINGLE
#   📄 bl-htmlip.sh               generate ipset by fetching HTML in web url, pulls only ips with grep rule (cant be changed) | URLs: SINGLE
#   📄 bl-html.sh                 generate ipset by fetching HTML in web url, does not run its own grep, must be specified in command | URLs: VARARG
#   📄 bl-block.sh                generate ipset by fetching locally specified file in /blocks/ repo folder
#   📄 bl-format.sh               generate ipset by from an existing list of IPs. does not generate ips itself. only validates a list provided
#   📄 bl-spf.sh                  generate ipset by fetching _spf ips from domain
#   
#   local test requires the same structure as the github workflow
#       📁 .github
#           📁 blocks
#               📁 bruteforce
#                   📄 01.ipset
#               📁 privacy
#                   📄 01.ipset
#           📁 scripts
#               📄 bl-master.sh
#               📄 bl-plain.sh
#               📄 bl-json.sh
#               📄 bl-htmlip.sh
#               📄 bl-html.sh
#               📄 bl-block.sh
#               📄 bl-format.sh
#               📄 bl-spf.sh
#           📁 workflows
#               📄 blocklist-generate.yml
# #

name: '🧱 Blocklist › Generate'
run-name: '🧱 Blocklist › Generate'

# #
#   triggers
# #

on:

    # #
    #   Trigger › Workflow Dispatch
    # #

    workflow_dispatch:
      inputs:

        # #
        #   true:     runs all actions, even ones not scheduled
        #   false:    only scheduled tasks will run
        # #
  
        RUN_ALL_ACTIONS:
            description:  '📑 Run All Actions'
            required:     true
            default:      false
            type:         boolean

# #
#   environment variables
# #

env:
    ASSIGN_USER:                    Aetherinox
    BOT_NAME_1:                     BinaryServ
    BOT_NAME_DEPENDABOT:            dependabot[bot]
    BOT_NAME_RENOVATE:              renovate[bot]
    GPG_KEY_BASE64:                 ${{ secrets.ADMINSERV_GPG_KEY_B64 }}
    GPG_KEY_PASSPHRASE:             ${{ secrets.ADMINSERV_GPG_PASSPHRASE }}
  
# #
#   jobs
# #

jobs:

    # #
    #   Job › Setup
    # #

    blocklist-setup:
        name: >-
          📦 Setup
        runs-on: ubuntu-latest
      # runs-on: apollo-x64
        timeout-minutes: 60
        steps:

            # #
            #   Job › Checkout
            # #

            - name: >-
                  ☑️ Checkout
              uses: actions/checkout@v4
              with:
                  fetch-depth: 0

            # #
            #   Job › Job Information
            # #

            - name: >-
                  🔄 Load Job
              uses: qoomon/actions--context@v4
              id: 'context'

            # #
            #   Job › Start
            # #

            - name: >-
                  ✅ Start
              run: |
                  echo "‎"
                  echo "―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――"
                  echo " Starting Job ${{ steps.context.outputs.job_name }}"
                  echo "―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――"

                  YEAR="$(date +'%Y')"
                  echo "YEAR=${YEAR}" >> $GITHUB_ENV

                  NOW="$(date +'%m-%d-%Y %H:%M:%S')"                                                #  02-25-2025 12:49:48
                  echo "NOW=${NOW}" >> $GITHUB_ENV

                  NOW_SHORT="$(date +'%m-%d-%Y')"                                                   #  02-25-2025
                  echo "NOW_SHORT=${NOW_SHORT}" >> $GITHUB_ENV

                  NOW_LONG="$(date +'%m-%d-%Y %H:%M')"                                              #  02-25-2025 12:49
                  echo "NOW_LONG=${NOW_LONG}" >> $GITHUB_ENV

                  NOW_DOCKER="$(date +'%Y%m%d')"                                                    #  20250225
                  echo "NOW_DOCKER=${NOW_DOCKER}" >> $GITHUB_ENV

                  NOW_DOCKER_TS="$(date -u +'%FT%T.%3NZ')"                                          #  2025-02-25T12:50:11.569Z
                  echo "NOW_DOCKER_TS=${NOW_DOCKER_TS}" >> $GITHUB_ENV

                  SHA1="$(git rev-parse HEAD)"                                                      #  71fad013cfce9116ec62779e4a7e627fe4c33627
                  echo "SHA1=${SHA1}" >> $GITHUB_ENV

                  SHA1_GH="$(echo ${GITHUB_SHA})"                                                   #  71fad013cfce9116ec62779e4a7e627fe4c33627
                  echo "SHA1_GH=${SHA1_GH}" >> $GITHUB_ENV

                  PKG_VER_1DIGIT="$(echo ${{ env.IMAGE_VERSION }} | cut -d '.' -f1-1)"              #  15.52.35 > 15
                  echo "PKG_VER_1DIGIT=${PKG_VER_1DIGIT}" >> $GITHUB_ENV

                  PKG_VER_2DIGIT="$(echo ${{ env.IMAGE_VERSION }} | cut -d '.' -f1-2)"              #  15.52.35 > 15.52
                  echo "PKG_VER_2DIGIT=${PKG_VER_2DIGIT}" >> $GITHUB_ENV

                  echo "―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――"
                  echo "‎"
                  echo "‎"
                  sudo apt -qq update
                  sudo apt -qq install tree
                  echo "‎"
                  echo "‎"
                  echo "―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――"
                  echo "‎"
                  echo "‎"
                  echo " Runner .............. ${{ runner.name }}"
                  echo " Workflow ............ ${{ github.workflow }} (#${{ github.workflow_ref }})"
                  echo " Run Number .......... ${{ github.run_number }}"
                  echo " Ref ................. ${{ github.ref }}"
                  echo " Ref Name ............ ${{ github.ref_name }}"
                  echo " Event Name .......... ${{ github.event_name }}"
                  echo " Repo ................ ${{ github.repository }}"
                  echo " Repo Owner .......... ${{ github.repository_owner }}"
                  echo " Run ID .............. https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
                  echo " Triggered By ........ ${{ github.actor }}"
                  echo " SHA 1 (GITHUB_SHA) .. ${GITHUB_SHA}"
                  echo " SHA 2 (github.sha) .. ${{ github.sha }}"
                  echo " SHA 3 (env.SHA1) .... ${SHA1}"
                  echo " SHA 4 (env.SHA1_GH) . ${SHA1_GH}"
                  echo " Workspace ........... ${{ github.workspace }}"
                  echo " PWD ................. ${PWD}"
                  echo " Job Name ............ ${{ steps.context.outputs.job_name }}"
                  echo " Job ID .............. ${{ steps.context.outputs.job_id }}"
                  echo " Job URL ............. ${{ steps.context.outputs.job_url }}"
                  echo " Run ID .............. ${{ steps.context.outputs.run_id }}"
                  echo " Run Attempt ......... ${{ steps.context.outputs.run_attempt }}"
                  echo " Run Number .......... ${{ steps.context.outputs.run_number }}"
                  echo " Run URL ............. ${{ steps.context.outputs.run_url }}"
                  echo " Run Env ............. ${{ steps.context.outputs.environment }}"
                  echo " Run Env URL ......... ${{ steps.context.outputs.environment_url }}"
                  echo " Run Deployment ...... ${{ steps.context.outputs.deployment_id }}"
                  echo " Run Deployment URL .. ${{ steps.context.outputs.deployment_url }}"
                  echo " Run Deployment ...... ${{ steps.context.outputs.deployment_id }}"
                  echo " Run Runner Name ..... ${{ steps.context.outputs.runner_name }}"
                  echo " Run Runner ID ....... ${{ steps.context.outputs.runner_id }}"
                  echo " Year ................ ${YEAR}"
                  echo " Now ................. ${NOW}"
                  echo " Now (Short) ......... ${NOW_SHORT}"
                  echo " Now (Long) .......... ${NOW_LONG}"
                  echo " Now (Docker) ........ ${NOW_DOCKER}"
                  echo " Now (Docker TS) ..... ${NOW_DOCKER_TS}"
                  echo "‎"
                  echo "‎"
                  echo "―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――"
                  echo "‎"
                  echo "‎"
                  tree -I node_modules -I .git -I ./
                  echo "‎"
                  echo "‎"
                  echo "―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――"
                  echo "‎"
                  echo "‎"

            # #
            #   Generate › Install Packages
            # #

            - name: "🧱 Install Packages"
              run: |
                  sudo apt-get install -y ipcalc ed html2text whois uuid-runtime autoconf

            # #
            #   Generate › Cache Packages
            # #

            - name: "🧱 Cache Packages"
              uses: awalsh128/cache-apt-pkgs-action@latest
              with:
                  packages: ipcalc ed html2text whois uuid-runtime
                  version: 1.0

    # #
    #   Job › Blocklist › Master
    # #

    blocklist-generate:
        name: >-
          📋 Generate › Blocklist
        runs-on: ubuntu-latest
      # runs-on: apollo-x64
        timeout-minutes: 60
        needs: [ blocklist-setup ]
        outputs:
            artifact-name: ${{ steps.generate_artifact_zip.outputs.artifact-name }}
            artifact-path: ${{ steps.generate_artifact_zip.outputs.artifact-path }}
        steps:

            # #
            #   Generate › Checkout
            # #

            - name: '☑️ Checkout'
              uses: actions/checkout@v4
              with:
                  fetch-depth: 0

            # #
            #   Generate › Job Information
            # #

            - name: >-
                  🔄 Load Job
              uses: qoomon/actions--context@v4
              id: 'context'

            # #
            #   Generate › Start
            # #

            - name: >-
                  ✅ Start
              run: |
                  echo "‎"
                  echo "―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――"
                  echo " Starting Job ${{ steps.context.outputs.job_name }}"
                  echo "―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――"

                  YEAR="$(date +'%Y')"
                  echo "YEAR=${YEAR}" >> $GITHUB_ENV

                  NOW="$(date +'%m-%d-%Y %H:%M:%S')"                                                #  02-25-2025 12:49:48
                  echo "NOW=${NOW}" >> $GITHUB_ENV

                  NOW_SHORT="$(date +'%m-%d-%Y')"                                                   #  02-25-2025
                  echo "NOW_SHORT=${NOW_SHORT}" >> $GITHUB_ENV

                  NOW_LONG="$(date +'%m-%d-%Y %H:%M')"                                              #  02-25-2025 12:49
                  echo "NOW_LONG=${NOW_LONG}" >> $GITHUB_ENV

                  NOW_DOCKER="$(date +'%Y%m%d')"                                                    #  20250225
                  echo "NOW_DOCKER=${NOW_DOCKER}" >> $GITHUB_ENV

                  NOW_DOCKER_TS="$(date -u +'%FT%T.%3NZ')"                                          #  2025-02-25T12:50:11.569Z
                  echo "NOW_DOCKER_TS=${NOW_DOCKER_TS}" >> $GITHUB_ENV

                  SHA1="$(git rev-parse HEAD)"                                                      #  71fad013cfce9116ec62779e4a7e627fe4c33627
                  echo "SHA1=${SHA1}" >> $GITHUB_ENV

                  SHA1_GH="$(echo ${GITHUB_SHA})"                                                   #  71fad013cfce9116ec62779e4a7e627fe4c33627
                  echo "SHA1_GH=${SHA1_GH}" >> $GITHUB_ENV

                  PKG_VER_1DIGIT="$(echo ${{ env.IMAGE_VERSION }} | cut -d '.' -f1-1)"              #  15.52.35 > 15
                  echo "PKG_VER_1DIGIT=${PKG_VER_1DIGIT}" >> $GITHUB_ENV

                  PKG_VER_2DIGIT="$(echo ${{ env.IMAGE_VERSION }} | cut -d '.' -f1-2)"              #  15.52.35 > 15.52
                  echo "PKG_VER_2DIGIT=${PKG_VER_2DIGIT}" >> $GITHUB_ENV

                  echo "―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――"
                  echo "‎"
                  echo "‎"
                  sudo apt -qq update
                  sudo apt -qq install tree
                  echo "‎"
                  echo "‎"
                  echo "―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――"
                  echo "‎"
                  echo "‎"
                  echo " Runner .............. ${{ runner.name }}"
                  echo " Workflow ............ ${{ github.workflow }} (#${{ github.workflow_ref }})"
                  echo " Run Number .......... ${{ github.run_number }}"
                  echo " Ref ................. ${{ github.ref }}"
                  echo " Ref Name ............ ${{ github.ref_name }}"
                  echo " Event Name .......... ${{ github.event_name }}"
                  echo " Repo ................ ${{ github.repository }}"
                  echo " Repo Owner .......... ${{ github.repository_owner }}"
                  echo " Run ID .............. https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
                  echo " Triggered By ........ ${{ github.actor }}"
                  echo " SHA 1 (GITHUB_SHA) .. ${GITHUB_SHA}"
                  echo " SHA 2 (github.sha) .. ${{ github.sha }}"
                  echo " SHA 3 (env.SHA1) .... ${SHA1}"
                  echo " SHA 4 (env.SHA1_GH) . ${SHA1_GH}"
                  echo " Workspace ........... ${{ github.workspace }}"
                  echo " PWD ................. ${PWD}"
                  echo " Job Name ............ ${{ steps.context.outputs.job_name }}"
                  echo " Job ID .............. ${{ steps.context.outputs.job_id }}"
                  echo " Job URL ............. ${{ steps.context.outputs.job_url }}"
                  echo " Run ID .............. ${{ steps.context.outputs.run_id }}"
                  echo " Run Attempt ......... ${{ steps.context.outputs.run_attempt }}"
                  echo " Run Number .......... ${{ steps.context.outputs.run_number }}"
                  echo " Run URL ............. ${{ steps.context.outputs.run_url }}"
                  echo " Run Env ............. ${{ steps.context.outputs.environment }}"
                  echo " Run Env URL ......... ${{ steps.context.outputs.environment_url }}"
                  echo " Run Deployment ...... ${{ steps.context.outputs.deployment_id }}"
                  echo " Run Deployment URL .. ${{ steps.context.outputs.deployment_url }}"
                  echo " Run Deployment ...... ${{ steps.context.outputs.deployment_id }}"
                  echo " Run Runner Name ..... ${{ steps.context.outputs.runner_name }}"
                  echo " Run Runner ID ....... ${{ steps.context.outputs.runner_id }}"
                  echo " Year ................ ${YEAR}"
                  echo " Now ................. ${NOW}"
                  echo " Now (Short) ......... ${NOW_SHORT}"
                  echo " Now (Long) .......... ${NOW_LONG}"
                  echo " Now (Docker) ........ ${NOW_DOCKER}"
                  echo " Now (Docker TS) ..... ${NOW_DOCKER_TS}"
                  echo "‎"
                  echo "‎"
                  echo "―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――"
                  echo "‎"
                  echo "‎"
                  tree -I node_modules -I .git -I ./
                  echo "‎"
                  echo "‎"
                  echo "―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――"
                  echo "‎"
                  echo "‎"

            # #
            #   Generate › Configure
            #
            #   this step installs packages we need to manage ipsets.
            #       - iprange
            #         this package allows us to convert ip ranges into a CIDR formatted ip
            #         10.10.0.1-10.10.0.9  =>   10.10.0.1
            #                                   10.10.0.2/31
            #                                   10.10.0.4/30
            #                                   10.10.0.8/31
            #       https://github.com/firehol/iprange
            # #

            - name: '⚙️ Configure'
              id: task_blocklist_generate_configure
              run: |
                  git clone https://github.com/firehol/iprange.git ./.temp/iprange
                  cd .temp/iprange
                  ./autogen.sh
                  ./configure --disable-man
                  sudo make && make install

            # #
            #   Generate › Set Template Permissions
            # #

            - name: "☑️ Set Permissions"
              id: task_blocklist_generate_perms
              run: |
                  #   Set Permissions
                  chmod +x ".github/scripts/bl-master.sh"
                  chmod +x ".github/scripts/bl-format.sh"
                  chmod +x ".github/scripts/bl-htmlip.sh"
                  chmod +x ".github/scripts/bl-html.sh"
                  chmod +x ".github/scripts/bl-block.sh"
                  chmod +x ".github/scripts/bl-json.sh"
                  chmod +x ".github/scripts/bl-plain.sh"
                  chmod +x ".github/scripts/bl-spf.sh"
                  chmod +x ".github/scripts/bl-whois.sh"
                  chmod +x ".github/scripts/bt-transmission.sh"
                  chmod +x ".github/scripts/update-readme.sh"
                  chmod +x ".github/scripts/tool-range-iprange.sh"

            # #
            #   Generate › Set Env Variables
            # #

            - name: "📦 Set Env Variables"
              id: task_commit_pre
              run: |
                  useragent="${{ vars.API_USERAGENT }}"
                  echo "USERAGENT=$(echo $useragent)" >> $GITHUB_ENV

            # #
            #   Generate › Master
            # #

            - name: "🧱 Generate › Master"
              id: task_blocklist_generate_master
              run: |
                  run_master=".github/scripts/bl-master.sh blocklists/master.ipset ${{ secrets.API_01_FILE_01 }} ${{ secrets.API_01_FILE_02 }} ${{ secrets.API_01_FILE_03 }} ${{ secrets.API_01_FILE_04 }} ${{ secrets.API_01_FILE_05 }} ${{ secrets.API_01_FILE_06 }} ${{ secrets.API_01_FILE_07 }} ${{ secrets.API_01_FILE_08 }} ${{ secrets.API_01_FILE_09 }}"
                  eval "./$run_master"

                  run_highrisk=".github/scripts/bl-block.sh blocklists/highrisk.ipset highrisk"
                  eval "./$run_highrisk"

            # #
            #   Generate › Privacy
            # #

            - name: "🧱 Generate › Privacy"
              id: task_blocklist_generate_privacy
              run: |

                  #   Privacy › General
                  run_general=".github/scripts/bl-block.sh blocklists/privacy/privacy_general.ipset privacy"
                  eval "./$run_general"

                  #   Privacy › Google
                  run_google=".github/scripts/bl-json.sh blocklists/privacy/privacy_google.ipset https://developers.google.com/search/apis/ipranges/googlebot.json '.prefixes | .[] |.ipv4Prefix//empty,.ipv6Prefix//empty'"
                  eval "./$run_google"

                  #   Privacy › Cloudfront
                  run_cloudfront=".github/scripts/bl-json.sh blocklists/privacy/privacy_cloudfront.ipset https://d7uri8nf7uskq.cloudfront.net/tools/list-cloudfront-ips 'map(.[]) | sort | .[]'"
                  eval "./$run_cloudfront"

                  #   Privacy › Bing
                  run_bing=".github/scripts/bl-json.sh blocklists/privacy/privacy_bing.ipset https://bing.com/toolbox/bingbot.json '.prefixes | .[] |.ipv4Prefix//empty,.ipv6Prefix//empty'"
                  eval "./$run_bing"
                
                  #   Privacy › Fastly
                  run_fastly=".github/scripts/bl-json.sh blocklists/privacy/privacy_fastly.ipset https://api.fastly.com/public-ip-list 'map(.[]) | .[]'"
                  eval "./$run_fastly"

                  #   Privacy › Amazon AWS
                  run_amz_aws=".github/scripts/bl-json.sh blocklists/privacy/privacy_amazon_aws.ipset https://ip-ranges.amazonaws.com/ip-ranges.json '.prefixes[] | select(.service==\"AMAZON\") | .ip_prefix'"
                  eval "./$run_amz_aws"

                  #   Privacy › Amazon EC2
                  run_amz_ec2=".github/scripts/bl-json.sh blocklists/privacy/privacy_amazon_ec2.ipset https://ip-ranges.amazonaws.com/ip-ranges.json '.prefixes[] | select(.service==\"EC2\") | .ip_prefix'"
                  eval "./$run_amz_ec2"

                  #   Privacy › Facebook
                  run_facebook=".github/scripts/bl-whois.sh blocklists/privacy/privacy_facebook.ipset AS32934"
                  eval "./$run_facebook"

                  #   Privacy › Ahrefs
                  curl -sSL -A "${{ env.USERAGENT }}" https://api.ahrefs.com/v3/public/crawler-ips | jq -r '.ips[].ip_address | select( . != null )' | $GITHUB_WORKSPACE/.github/scripts/bl-format.sh blocklists/privacy/privacy_ahrefs.ipset

                  #   Privacy › DuckDuckGo
                  curl -sSL -A "${{ env.USERAGENT }}" https://raw.githubusercontent.com/duckduckgo/duckduckgo-help-pages/master/_docs/results/duckduckbot.md | grep "^\- " | awk '{gsub("-",""); print}' | awk '{gsub(/ /,""); print}' | $GITHUB_WORKSPACE/.github/scripts/bl-format.sh blocklists/privacy/privacy_duckduckgo.ipset

                  #   Privacy › Telegram
                  curl -sSL -A "${{ env.USERAGENT }}" https://core.telegram.org/resources/cidr.txt | $GITHUB_WORKSPACE/.github/scripts/bl-format.sh blocklists/privacy/privacy_telegram.ipset

                  #   Privacy › Uptime Robot
                  curl -sSL -A "${{ env.USERAGENT }}" https://uptimerobot.com/inc/files/ips/IPv4andIPv6.txt | $GITHUB_WORKSPACE/.github/scripts/bl-format.sh blocklists/privacy/privacy_uptimerobot.ipset

                  #   Privacy › Pingdom
                  PINGDOM_IPv4=$(curl -sSL -A "${{ env.USERAGENT }}" https://my.pingdom.com/probes/ipv4)
                  PINGDOM_IPv6=$(curl -sSL -A "${{ env.USERAGENT }}" https://my.pingdom.com/probes/ipv6)
                  PINGDOM_LIST="${PINGDOM_IPv4} ${PINGDOM_IPv6}"
                  echo "$PINGDOM_LIST" | $GITHUB_WORKSPACE/.github/scripts/bl-format.sh blocklists/privacy/privacy_pingdom.ipset

                  #   Privacy › Stripe › API
                  curl -sSL -A "${{ env.USERAGENT }}" https://stripe.com/files/ips/ips_api.txt | $GITHUB_WORKSPACE/.github/scripts/bl-format.sh blocklists/privacy/privacy_stripe_api.ipset

                  #   Privacy › Stripe › Webhooks
                  curl -sSL -A "${{ env.USERAGENT }}" https://stripe.com/files/ips/ips_webhooks.txt | $GITHUB_WORKSPACE/.github/scripts/bl-format.sh blocklists/privacy/privacy_stripe_webhooks.ipset

                  #   Privacy › Stripe › Armada Gator
                  curl -sSL -A "${{ env.USERAGENT }}" https://stripe.com/files/ips/ips_armada_gator.txt | $GITHUB_WORKSPACE/.github/scripts/bl-format.sh blocklists/privacy/privacy_stripe_armada_gator.ipset

                  #   Privacy › RSS API
                  curl -sSL -A "${{ env.USERAGENT }}" https://rssapi.net/ips.txt | $GITHUB_WORKSPACE/.github/scripts/bl-format.sh blocklists/privacy/privacy_rssapi.ipset

                  #   Privacy › WebPageTest
                  curl -sSL -A "${{ env.USERAGENT }}" https://www.webpagetest.org/addresses.php?f=json | jq -r '.data[].addresses[] | select( . != null )' | $GITHUB_WORKSPACE/.github/scripts/bl-format.sh blocklists/privacy/privacy_webpagetest.ipset

                  #   Privacy › Bunny CDN
                  BUNNYCDN_IPv4=$(curl -sSL -A "${{ env.USERAGENT }}" https://api.bunny.net/system/edgeserverlist/plain)
                  BUNNYCDN_IPv6=$(curl -sSL -A "${{ env.USERAGENT }}" https://api.bunny.net/system/edgeserverlist/ipv6 | jq -r '.[] | select( . != null )')
                  BUNNYCDN_LIST="${BUNNYCDN_IPv4} ${BUNNYCDN_IPv6}"
                  echo "$BUNNYCDN_LIST" | $GITHUB_WORKSPACE/.github/scripts/bl-format.sh blocklists/privacy/privacy_bunnycdn.ipset

                  #   Privacy › Cloudflare CDN
                  CLOUDFLARE_IPv4=$(curl -sSL -A "${{ env.USERAGENT }}" https://www.cloudflare.com/ips-v4)
                  CLOUDFLARE_IPv6=$(curl -sSL -A "${{ env.USERAGENT }}" https://www.cloudflare.com/ips-v6)
                  CLOUDFLARE_LIST="${CLOUDFLARE_IPv4} ${CLOUDFLARE_IPv6}"
                  echo "$CLOUDFLARE_LIST" | $GITHUB_WORKSPACE/.github/scripts/bl-format.sh blocklists/privacy/privacy_cloudflarecdn.ipset

                  #   Privacy › AppleBot
                  curl -sSL -A "${{ env.USERAGENT }}" https://search.developer.apple.com/applebot.json | jq -r '.prefixes | .[] |.ipv4Prefix//empty,.ipv6Prefix//empty' | $GITHUB_WORKSPACE/.github/scripts/bl-format.sh blocklists/privacy/privacy_applebot.ipset

                  # Privacy › Blizzard
                  run_blizzard=".github/scripts/tool-range-iprange.sh blocklists/privacy/privacy_blizzard.ipset http://list.iblocklist.com/?list=ercbntshuthyykfkmhxc 'at&t'"
                  eval "./$run_blizzard"

                  # Privacy › Activision
                  run_activision=".github/scripts/tool-range-iprange.sh blocklists/privacy/privacy_activision.ipset http://list.iblocklist.com/?list=gfnxlhxsijzrcuxwzebb"
                  eval "./$run_activision"

                  # Privacy › Electronic Arts & IGN
                  run_ea_ign=".github/scripts/tool-range-iprange.sh blocklists/privacy/privacy_electronicarts_ign.ipset http://list.iblocklist.com/?list=ejqebpcdmffinaetsvxj"
                  eval "./$run_ea_ign"

                  # Privacy › Nintendo
                  run_nintendo=".github/scripts/tool-range-iprange.sh blocklists/privacy/privacy_nintendo.ipset http://list.iblocklist.com/?list=pevkykuhgaegqyayzbnr"
                  eval "./$run_nintendo"

                  # Privacy › Pandora
                  run_pandora=".github/scripts/tool-range-iprange.sh blocklists/privacy/privacy_pandora.ipset http://list.iblocklist.com/?list=aevzidimyvwybzkletsg"
                  eval "./$run_pandora"

                  # Privacy › Sony Entertainment
                  run_sony=".github/scripts/tool-range-iprange.sh blocklists/privacy/privacy_sony.ipset http://list.iblocklist.com/?list=tukpvrvlubsputmkmiwg"
                  eval "./$run_sony"

                  # Privacy › Punkbuster
                  run_punkbuster=".github/scripts/tool-range-iprange.sh blocklists/privacy/privacy_punkbuster.ipset http://list.iblocklist.com/?list=zvwwndvzulqcltsicwdg"
                  eval "./$run_punkbuster"

                  # Privacy › Riot Games
                  run_riot_games=".github/scripts/tool-range-iprange.sh blocklists/privacy/privacy_riot_games.ipset http://list.iblocklist.com/?list=sdlvfabdjvrdttfjotcy"
                  eval "./$run_riot_games"

                  # Privacy › Pirate Bay
                  run_piratebay=".github/scripts/tool-range-iprange.sh blocklists/privacy/privacy_piratebay.ipset http://list.iblocklist.com/?list=nzldzlpkgrcncdomnttb"
                  eval "./$run_piratebay"

                  # Privacy › Steam
                  run_steam=".github/scripts/tool-range-iprange.sh blocklists/privacy/privacy_steam.ipset http://list.iblocklist.com/?list=cnxkgiklecdaihzukrud"
                  eval "./$run_steam"

                  # Privacy › Unisoft
                  run_ubisoft=".github/scripts/tool-range-iprange.sh blocklists/privacy/privacy_ubisoft.ipset http://list.iblocklist.com/?list=etmcrglomupyxtaebzht"
                  eval "./$run_ubisoft"

                  # Privacy › Xfire
                  run_xfire=".github/scripts/tool-range-iprange.sh blocklists/privacy/privacy_xfire.ipset http://list.iblocklist.com/?list=ppqqnyihmcrryraaqsjo"
                  eval "./$run_xfire"

            # #
            #   Generate › Spam
            # #

            - name: '🧱 Generate › Spam'
              id: task_blocklist_generate_spam
              run: |
                  run_spamhaus=".github/scripts/bl-plain.sh blocklists/spam/spam_spamhaus.ipset ${{ secrets.API_03_SPAM_SPAMHAUS_URL }}"
                  eval "./$run_spamhaus"

            # #
            #   Generate › Spam › Forums
            #
            #   only updated once per day (at 1am UTC)
            # #

            - name: '🧱 Generate › Spam › Forums (1/day)'
              id: task_blocklist_spam_generate_forums
              if: github.event_name == 'schedule' || ( github.event_name == 'workflow_dispatch' && inputs.RUN_ALL_ACTIONS == true )
              run: |
                  hour=$(date +'%H')
                  if [ "$hour" = "00" ]; then
                      chmod +x ".github/scripts/bl-plain.sh"
                      run_forums=".github/scripts/bl-plain.sh blocklists/spam/spam_forums.ipset https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/stopforumspam_7d.ipset"
                      eval "./$run_forums"
                  else
                      echo "Skipping daily-only task; not midnight"
                  fi

            # #
            #   Generate › Internet Service Provider
            #
            #   @resources      https://ftp.arin.net/info/asn.txt
            #                   https://networksdb.io
            #                   https://rapidapi.com
            #                   https://ip.guide/
            #                   https://2ip.io
            #                   https://ip2location.com
            #                   https://ipqualityscore.com
            #                   https://ipinfo.io
            #                   https://radb.net
            #                   https://bgpview.io
            #   @info           script on another server is responsible for ensuring this workflow list is kept up to date with the correct ASN.
            #                   we use numerous resources to compare ASNs to see which ones are active and which ones have been migrated.
            # #

            - name: '🧱 Generate › ISP'
              id: task_blocklist_generate_isp
              run: |
                  # ISP › AOL
                  run_isp_aol=".github/scripts/bl-block.sh blocklists/isp/isp_aol.ipset isp/aol.ipset"
                  eval "./$run_isp_aol"

                  # ISP › ATT
                  run_isp_att=".github/scripts/bl-whois.sh blocklists/isp/isp_att.ipset AS7018"
                  eval "./$run_isp_att"

                  # ISP › Cablevision | Later merged with Suddenlink
                  run_isp_cablevision=".github/scripts/bl-whois.sh blocklists/isp/isp_cablevision.ipset AS6128 AS13490 AS19720"
                  eval "./$run_isp_cablevision"

                  # ISP › Suddenlink / Altice / Optiumum
                  run_isp_suddenlink_optimum=".github/scripts/bl-json.sh blocklists/isp/isp_suddenlink_altice_optimum.ipset https://ip.guide/AS19108 '.routes | .v4//empty,.v6//empty | .[]'"
                  eval "./$run_isp_suddenlink_optimum"

                  # ISP › Frontier Communications | https://networksdb.io/ip-addresses-of/cox-communications-inc
                  run_isp_frontier=".github/scripts/bl-whois.sh blocklists/isp/isp_frontier_communications.ipset AS3593 AS5650 AS7011 AS26127 AS30064 AS32587"
                  eval "./$run_isp_frontier"

                  # ISP › Charter & Spectrum (Previously Time Warner Cable)
                  run_isp_charter_spectrum=".github/scripts/bl-whois.sh blocklists/isp/isp_charter_spectrum_timewarnercable.ipset AS7843 AS11351 AS12271 AS20001 AS20115 AS3456 AS63365"
                  eval "./$run_isp_charter_spectrum"

                  # ISP › Comcast
                  run_isp_comcast=".github/scripts/bl-whois.sh blocklists/isp/isp_comcast.ipset AS7922 AS7015 AS36732 AS36196 AS33651 AS33650 AS33542 AS33491 AS33490 AS33489 AS33351 AS33287 AS23266 AS23253 AS22909 AS22258 AS21508 AS20214 AS16748 AS14668 AS14042 AS13385 AS13367 AS11025"
                  eval "./$run_isp_comcast"

                  # ISP › Embarq
                  run_isp_embarq=".github/scripts/bl-whois.sh blocklists/isp/isp_embarq.ipset AS22186 AS32855 AS2379 AS3447 AS4212 AS5778 AS6222 AS6367 AS11398 AS11530 AS13787 AS14905 AS14910 AS14921 AS16718 AS17402 AS18494 AS22186 AS32855"
                  eval "./$run_isp_embarq"

                  # ISP › Qwest
                  run_isp_qwest=".github/scripts/bl-whois.sh blocklists/isp/isp_qwest.ipset AS3908 AS3909 AS3910 AS3951 AS4015 AS4911 AS6225 AS6226 AS6227 AS394190"
                  eval "./$run_isp_qwest"

                  # ISP › Sprint
                  run_isp_sprint=".github/scripts/bl-whois.sh blocklists/isp/isp_sprint.ipset AS1239 AS150389 AS1789 AS1790 AS1791 AS1792 AS1793 AS1794 AS1795 AS197226 AS2014 AS2050 AS2053 AS206963 AS21288 AS2938 AS2942 AS2959 AS2981 AS3647 AS3648 AS3649 AS3650 AS3651 AS3652"
                  eval "./$run_isp_sprint"

                  # ISP › Verizon | https://networksdb.io/search/org/verizon
                  run_isp_verizon=".github/scripts/bl-whois.sh blocklists/isp/isp_verizon.ipset AS701 AS702 AS1321 AS2125 AS7021 AS8385 AS6066 AS6167 AS9055 AS12367 AS22521"
                  eval "./$run_isp_verizon"

                  # ISP › Cox Communications | https://networksdb.io/ip-addresses-of/cox-communications-inc
                  run_isp_cox=".github/scripts/bl-whois.sh blocklists/isp/isp_cox_communications.ipset AS31771 AS22773 AS13432 AS6298 AS12064 AS13493 AS15218 AS22318 AS25904 AS26204"
                  eval "./$run_isp_cox"

                  # ISP › SpaceX Starlink
                  run_isp_starlink=".github/scripts/bl-whois.sh blocklists/isp/isp_spacex_starlink.ipset AS14593 AS397763 AS27277 AS142475"
                  eval "./$run_isp_starlink"

            # #
            #   Generate › Geographical › Geolite2 › Setup
            #   
            #   this step should only be ran once per day (at 1am UTC).
            #   The vars defined below are used for caching. The current day of the year + year are calculated, this allows
            #   the same cached files to be used in a 24 hour period. When the day of the year changes, a new set of geo files will
            #   be updated.
            #   
            #   CACHE VARS:           year_week       outputs the current week of the year, and year
            #                                         51_2024
            #   
            #                         year_day        outputs the current day of the year, and year
            #                                         308_2024
            # #

            - name: '🧱 Geographical › GeoLite2 (Setup)'
              id: task_blocklist_geographical_generate_setup
              if: github.event_name == 'schedule' || ( github.event_name == 'workflow_dispatch' && inputs.RUN_ALL_ACTIONS == true )
              run: |
                  hour=$(date +'%H')
                  if [ "$hour" = "00" ]; then
                      echo "year_week=$(date +'%U_%Y')" >> $GITHUB_ENV
                      echo "year_day=$(date +'%j_%Y')" >> $GITHUB_ENV
                  else
                      echo "Skipping daily-only task; not midnight"
                  fi

            # #
            #   Generate › Geographical › Geolite2 › Cache
            #   
            #   uses the same cache in a 24 hour period.
            #   
            #   @output               cache-hit
            #                         only run step if cache hit found
            #                         if: steps.task_blocklist_geographical_generate_cache.outputs.cache-hit == 'true'
            # #

            - name: '🧱 Geographical › GeoLite2 (Cache)'
              id: task_blocklist_geographical_generate_cache
              uses: actions/cache@v4
              if: steps.task_blocklist_geographical_generate_setup.outcome == 'success'
              with:
                  path: .github/.temp
                  key: cache-${{ runner.os }}-geolite2-${{ env.year_week }}

            # #
            #   Generate › Geographical › Geolite2 › Build
            # #

            - name: '🧱 Geographical › GeoLite2 (1/day)'
              id: task_blocklist_geographical_generate_geolite2
              if: steps.task_blocklist_geographical_generate_setup.outcome == 'success'
              run: |
                  chmod +x ".github/scripts/bl-geolite2.sh"
                  run_geolite2=".github/scripts/bl-geolite2.sh -l ${{ secrets.API_GEOLITE2_KEY }}"
                  eval "./$run_geolite2"

            # #
            #   Generate › Transmission
            # #

            - name: '🧱 Generate › Transmission'
              id: task_blocklist_generate_transmission
              run: |
                  run_bt=".github/scripts/bt-transmission.sh"
                  eval "./$run_bt"

            # #
            #   Generate › Verbose › List Tree
            # #

            - name: '🌲 Debug › Verbose Tree Listing'
              run: |
                  echo "―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――"
                  echo " PWD ..................... ${PWD}"
                  echo " GITHUB.WORKSPACE ........ ${{ github.workspace }}"
                  echo -e
                  echo -e
                  tree -I node_modules -I .git -I ./
                  echo "―――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――"

            # #
            #   Generate › SFTP / SSH › Upload Artifact
            # #

            #- name: 'SSH › Zip Artifacts'
            #  id: generate_artifact_zip
            #  run: |
            #      REPO_NAME="${{ github.event.repository.name }}"                         # csf-firewall
            #      BRANCH_NAME="${{ github.ref_name }}"                                    # main
            #      RUN_ID="${{ github.run_id }}"                                           # 17373119899

            #      ARTIFACT_NAME="artifact_${BRANCH_NAME}_${RUN_ID}.zip"                   # artifacts_main_xxxxxx.zip
            #      ARTIFACT_PATH="${REPO_NAME}/${ARTIFACT_NAME}"                           # csf-firewall/artifacts_main_xxxxxx.zip

            #      echo "REPO_NAME=$REPO_NAME" >> $GITHUB_ENV                              # csf-firewall

            #      echo "ARTIFACT_NAME=$ARTIFACT_NAME" >> $GITHUB_ENV                      # artifacts_main_xxxxxx.zip
            #      echo "ARTIFACT_PATH=$ARTIFACT_PATH" >> $GITHUB_ENV                      # csf-firewall/artifacts_main_xxxxxx.zip

            #      echo "artifact-name=$ARTIFACT_NAME" >> $GITHUB_OUTPUT                   # artifacts_main_xxxxxx.zip
            #      echo "artifact-path=$ARTIFACT_PATH" >> $GITHUB_OUTPUT                   # csf-firewall/artifacts_main_xxxxxx.zip

            #      zip -r "$ARTIFACT_NAME" ./*                                             # delete original zip before push

            # #
            #   Generate › SFTP / SSH › Setup SSH Key
            # #

            #- name: 'SSH › Upload Artifacts'
            #  run: |
            #      # Make sure the .ssh folder exists
            #      mkdir -p ~/.ssh
            #      echo "${{ secrets.ARTIFACTS_GITHUB_SSH_PRIVATE_KEY }}" > "$HOME/.ssh/github_sftp_key"
            #      chmod 600 "$HOME/.ssh/github_sftp_key"

            #      # Upload to repo-specific directory
            #      sftp -P ${{ secrets.ARTIFACTS_PORT }} \
            #          -i "$HOME/.ssh/github_sftp_key" \
            #          -o StrictHostKeyChecking=no \
            #      github@${{ secrets.ARTIFACTS_DOMAIN }} <<EOF
            #      mkdir $REPO_NAME
            #      cd $REPO_NAME
            #      put $ARTIFACT_NAME
            #      bye
            #      EOF

            # #
            #   Generate › Artifact › Upload
            # #

            - name: "🎁 Generate › Upload Artifact"
              id: task_blocklist_generate_artifact_upload
              uses: actions/upload-artifact@v4
              with:
                  name: blocklist-latest
                  path: ./
                  retention-days: 1

    # #
    #   Job › Commit
    # #

    blocklist-commit:
        name: >-
          📋 Commit
        runs-on: ubuntu-latest
      # runs-on: apollo-x64
        timeout-minutes: 60
        needs: [ blocklist-setup, blocklist-generate ]
        steps:

            # #
            #   Commit › Checkout
            # #

            - name: '☑️ Commit › Checkout'
              uses: actions/checkout@v4
              with:
                  fetch-depth: 0

            # #
            #   Commit › Artifact › Setup SSH
            # #

            #- name: '🎁 Commit › Setup SSH Artifact'
            #  run: |
            #      mkdir -p ~/.ssh
            #      echo "${{ secrets.ARTIFACTS_GITHUB_SSH_PRIVATE_KEY }}" > "$HOME/.ssh/github_sftp_key"
            #      chmod 600 "$HOME/.ssh/github_sftp_key"

            # #
            #   Commit › Artifact › Download
            # #

            #- name: '🎁 Commit › Download Artifact'
            #  run: |
            #      ARTIFACT_PATH="${{ needs.blocklist-generate.outputs.artifact-path }}"     # csf-firewall/artifacts_main_xxxxxx.zip
            #      ARTIFACT_NAME="$(basename "$ARTIFACT_PATH")"                              # artifacts_main_xxxxxx.zip
            #      REPO_NAME="$(dirname "$ARTIFACT_PATH")"                                   # csf-firewall

            #      echo "Downloading $ARTIFACT_PATH"

            #      sftp -P ${{ secrets.ARTIFACTS_PORT }} \
            #          -i "$HOME/.ssh/github_sftp_key" \
            #          -o StrictHostKeyChecking=no \
            #          github@${{ secrets.ARTIFACTS_DOMAIN }} <<EOF
            #      cd $REPO_NAME
            #      get $ARTIFACT_NAME
            #      bye
            #      EOF

            #      unzip -o "$ARTIFACT_NAME"                                                 # unzip -o artifacts_main_xxxxxx.zip
            #      rm -f "$ARTIFACT_NAME"                                                    # rm -f artifacts_main_xxxxxx.zip

            # #
            #   Commit › GPG › Import Key (No Passphrase)
            #   
            #   requires your GPG private key, converted to base64 binary .gpg (not armored .asc)
            #   
            #   this is utilized to generate signed hash digest
            #   
            #       find . -maxdepth 1 \( -name '*.zip' -o -name '*.gz' \) -printf '%P\n' | xargs -r sha1sum | gpg --digest-algo sha256 --clearsign > sha1sum.txt.asc
            #       find . -maxdepth 1 \( -name '*.zip' -o -name '*.gz' \) -printf '%P\n' | xargs -r sha256sum | gpg --digest-algo sha256 --clearsign > sha256
            # #

            - name: '🪪 Commit › GPG › Import Signing Key › W/o Passphrase'
              if: env.GPG_KEY_BASE64 != '' && env.GPG_KEY_PASSPHRASE == ''
              run: |
                  echo "$GPG_KEY_BASE64" | base64 -di | gpg --import

            # #
            #   Commit › GPG › Import Key (With Passphrase)
            #   
            #   requires your GPG private key, converted to base64 binary .gpg (not armored .asc)
            #   
            #   this is utilized to generate signed hash digest
            #   
            #       find . -maxdepth 1 \( -name '*.zip' -o -name '*.gz' \) -printf '%P\n' | xargs -r sha1sum | gpg --digest-algo sha256 --clearsign > sha1sum.txt.asc
            #       find . -maxdepth 1 \( -name '*.zip' -o -name '*.gz' \) -printf '%P\n' | xargs -r sha256sum | gpg --digest-algo sha256 --clearsign > sha256
            # #

            - name: '🪪 Commit › GPG › Import Signing Key › w/ Passphrase'
              if: env.GPG_KEY_BASE64 != '' && env.GPG_KEY_PASSPHRASE != ''
              run: |
                  echo "$GPG_KEY_BASE64" | base64 -di > /tmp/signing-key.gpg
                  echo "$GPG_KEY_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --import /tmp/signing-key.gpg
                  (echo "$GPG_KEY_PASSPHRASE"; echo; echo) | gpg --command-fd 0 --pinentry-mode loopback --change-passphrase $(gpg --list-secret-keys --with-colons 2> /dev/null | grep '^sec:' | cut --delimiter ':' --fields 5 | tail -n 1)

            # #
            #   Commit › Artifact › Download
            # #

            - name: "🎁 Commit › Download Artifact"
              id: task_commit_artifact_download
              uses: actions/download-artifact@v4
              with:
                  name: blocklist-latest
                  path: ./

            # #
            #   Commit › Precommit
            # #

            - name: "📦 Commit › Pre-commit"
              id: task_commit_pre
              run: |
                  now=$(date -u '+%m/%d/%Y %H:%M')
                  commit_label="Sync" >> $GITHUB_ENV
                  commit_message="\`️️🔒 $commit_label 🔒\` \`$now UTC\`" >> $GITHUB_ENV
                  echo "COMMIT_MESSAGE=$(echo $commit_message)" >> $GITHUB_ENV
                  echo "NOW=$(echo $now)" >> $GITHUB_ENV

            # #
            #   Commit › Update README
            # #

            - name: "📄 Commit › Update README"
              id: task_commit_readme_update
              run: |
                  chmod +x ".github/scripts/update-readme.sh"
                  run_readme=".github/scripts/update-readme.sh README.md"
                  eval "./$run_readme"

            # #
            #   Commit › GPG Key
            #   
            #   required in order to do signed commits
            # #

            - name: "📦 Commit › GPG Key"
              id: task_commit_gpg
              uses: crazy-max/ghaction-import-gpg@v6
              with:
                  gpg_private_key: ${{ secrets.ADMINSERV_GPG_KEY_ASC }}
                  passphrase: ${{ secrets.ADMINSERV_GPG_PASSPHRASE }}
                  git_user_signingkey: true
                  git_commit_gpgsign: true

            # #
            #   Commit › Commit
            # #

            - name: "📦 Commit › Execute"
              id: task_commit_execute
              uses: stefanzweifel/git-auto-commit-action@v5
              with:
                  commit_message: ${{ env.COMMIT_MESSAGE }}
                  commit_author: "${{ steps.task_commit_gpg.outputs.name }} <${{ steps.task_commit_gpg.outputs.email }}>"
                  commit_user_name: ${{ steps.task_commit_gpg.outputs.name }}
                  commit_user_email: ${{ steps.task_commit_gpg.outputs.email }}

            # #
            #   Commit › Clean up Artifacts
            #   
            #   Left-behind artifacts cleaned up after 5 days
            # #

        #   - name: '🎁 Commit › Cleanup Old Artifacts'
        #     run: |
        #         ssh -p ${{ secrets.ARTIFACTS_PORT }} \
        #         -i ~/.ssh/github_sftp_key \
        #         -o StrictHostKeyChecking=no \
        #         github@${{ secrets.ARTIFACTS_DOMAIN }} \
        #         "find ~/public_html -name 'artifacts_*.zip' -type f -mtime +5 -delete"