# Push a tag named taema-vX.Y.Z (X.Y.Z must equal __version__ in taema/src/taema/__init__.py).
# A draft release is opened first; the build jobs test and build the arch-specific
# .xbps on glibc and musl (the musl job avoids Node-based actions, which cannot run
# on musl, by cloning with git and uploading via the gh CLI); the sign job signs an
# XBPS repository per architecture and attaches the packages, the vendor distfile,
# and the repodata to the draft before publishing it (xbps reads it from
# releases/latest/download); then the template job bumps version and both checksums in
# taema/srcpkgs/taema/template and the README download names.
name: release

on:
  push:
    tags: ["taema-v*"]

permissions:
  contents: write
  pull-requests: write

jobs:
  prepare:
    name: draft release
    runs-on: ubuntu-latest
    steps:
      - name: Create draft release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if ! gh release view "${GITHUB_REF_NAME}" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            gh release create "${GITHUB_REF_NAME}" --repo "$GITHUB_REPOSITORY" \
              --title "tæma ${GITHUB_REF_NAME#taema-v}" --draft --notes ""
          fi
  build:
    name: build (${{ matrix.arch }})
    needs: prepare
    runs-on: ubuntu-latest
    container: ghcr.io/void-linux/void-${{ matrix.libc }}:latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - libc: glibc
            arch: x86_64
          - libc: musl
            arch: x86_64-musl
    env:
      XBPS_ARCH: ${{ matrix.arch }}
    steps:
      - name: Install build tools
        run: |
          xbps-install -Syu xbps
          xbps-install -Sy python3 bash iproute2 util-linux sudo make git shadow github-cli findutils tzdata cargo tar gzip
      - uses: actions/checkout@v4
        if: matrix.libc != 'musl'
      - name: Check out source without Node
        if: matrix.libc == 'musl'
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          git clone "https://github.com/${GITHUB_REPOSITORY}.git" "$GITHUB_WORKSPACE"
          git -C "$GITHUB_WORKSPACE" checkout "$GITHUB_REF_NAME"
      - name: Check tag against version
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          version=$(sed -n 's/^__version__ = "\(.*\)"/\1/p' taema/src/taema/__init__.py)
          [ "${GITHUB_REF_NAME}" = "taema-v${version}" ] || {
            echo "tag ${GITHUB_REF_NAME} does not match __version__ ${version}" >&2; exit 1; }
          echo "VERSION=${version}" >> "$GITHUB_ENV"
      - name: Test and build
        run: |
          # The tests assume a normal user, so run them as one.
          useradd -m builder
          mkdir -p "$RUNNER_TEMP/repo"
          chown -R builder "$GITHUB_WORKSPACE" "$RUNNER_TEMP/repo"
          su builder -s /bin/sh -c "cd '$GITHUB_WORKSPACE/taema' && XBPS_ARCH='${{ matrix.arch }}' tools/build-xbps.sh '$RUNNER_TEMP/repo'"
      - name: Build vendor distfile
        if: matrix.arch == 'x86_64'
        run: |
          su builder -s /bin/sh -c "cd '$GITHUB_WORKSPACE/taema' && tools/vendor-dist.sh '$RUNNER_TEMP/repo'"
      - uses: actions/upload-artifact@v4
        if: matrix.libc != 'musl'
        with:
          name: repo-${{ matrix.arch }}
          path: ${{ runner.temp }}/repo/
          if-no-files-found: error
      - name: Upload package to draft release
        if: matrix.libc == 'musl'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          # $RUNNER_TEMP (container path), not the runner.temp context
          # (host path): the package was built into the container mount.
          gh release upload "${GITHUB_REF_NAME}" --repo "$GITHUB_REPOSITORY" \
            --clobber "$RUNNER_TEMP/repo/"*

  sign:
    needs: build
    runs-on: ubuntu-latest
    container: ghcr.io/void-linux/void-glibc:latest
    steps:
      - name: Install sign tools
        run: |
          xbps-install -Syu xbps
          xbps-install -Sy libstdc++ github-cli git
      # Checkout first: its default clean would wipe downloaded assets.
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          pattern: repo-*
          merge-multiple: true
          path: ${{ github.workspace }}/assets
      - name: Fetch musl assets from draft release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          # $GITHUB_WORKSPACE, not the github.workspace context: the
          # download-artifact action lands files in the container path.
          gh release download "${GITHUB_REF_NAME}" --repo "$GITHUB_REPOSITORY" \
            --pattern "*musl*" --dir "$GITHUB_WORKSPACE/assets" --clobber
      - name: Sign repository and publish release
        env:
          GH_TOKEN: ${{ github.token }}
          XBPS_PRIVKEY: ${{ secrets.XBPS_PRIVKEY }}
        run: |
          version=${GITHUB_REF_NAME#taema-v}
          out="$GITHUB_WORKSPACE/assets"
          if [ -n "$XBPS_PRIVKEY" ]; then
            key="$RUNNER_TEMP/privkey.pem"
            umask 077
            printf '%s\n' "$XBPS_PRIVKEY" > "$key"
            umask 022
            cd "$out"
            # D20: packages are built only for x86_64 glibc and x86_64 musl.
            for arch in x86_64 x86_64-musl; do
              XBPS_ARCH=$arch xbps-rindex -a "taema-${version}_1.${arch}.xbps"
              XBPS_ARCH=$arch xbps-rindex --privkey "$key" --signedby "Bongbetic <soubarna@live.in>" -s .
            done
            for arch in x86_64 x86_64-musl; do
              xbps-rindex --privkey "$key" -S "taema-${version}_1.${arch}.xbps"
            done
            rm -f "$key"
            cd "$GITHUB_WORKSPACE"
          else
            echo "secret XBPS_PRIVKEY is not set; publishing the package only" >&2
          fi
          cat > "$RUNNER_TEMP/notes.md" <<NOTES
          Add the repository once, then install and update like any other package:

          \`\`\`sh
          echo 'repository=https://github.com/${GITHUB_REPOSITORY}/releases/latest/download' | sudo tee /etc/xbps.d/20-taema.conf
          sudo xbps-install -S taema
          \`\`\`

          Later updates arrive with \`sudo xbps-install -Su\`. The first sync asks you to accept the
          repository key. Check that the fingerprint matches the README before you accept.
          NOTES
          cat CHANGELOG.md >> "$RUNNER_TEMP/notes.md"
          notes="$(cat "$RUNNER_TEMP/notes.md")"
          gh release upload "$GITHUB_REF_NAME" \
            --repo "$GITHUB_REPOSITORY" --clobber \
            "$out"/*
          gh release edit "$GITHUB_REF_NAME" \
            --repo "$GITHUB_REPOSITORY" --title "tæma ${version}" \
            --notes "$notes" --draft=false

  template:
    needs: sign
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: main
      - name: Bump template and README
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          version=${GITHUB_REF_NAME#taema-v}
          src_sum=$(curl -fsSL "https://github.com/${GITHUB_REPOSITORY}/archive/refs/tags/${GITHUB_REF_NAME}.tar.gz" | sha256sum | cut -d' ' -f1)
          vendor_sum=$(curl -fsSL "https://github.com/${GITHUB_REPOSITORY}/releases/download/${GITHUB_REF_NAME}/taema-vendor-${version}.tar.gz" | sha256sum | cut -d' ' -f1)
          t=taema/srcpkgs/taema/template
          if grep -q "^version=${version}\$" "$t" && grep -q "^checksum=\"${src_sum} ${vendor_sum}\"\$" "$t"; then
            echo "template already current"; exit 0
          fi
          sed -i "s/^version=.*/version=${version}/; s/^revision=.*/revision=1/; s/^checksum=.*/checksum=\"${src_sum} ${vendor_sum}\"/" "$t"
          sed -i "s/taema-<version>_1\.x86_64\.xbps/taema-${version}_1.x86_64.xbps/; s/taema-<version>_1\.x86_64-musl\.xbps/taema-${version}_1.x86_64-musl.xbps/" README.md
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git commit -am "Template and README: taema ${version}"
          git push origin HEAD:main