wayscriber/.github/workflows/build-packages.yml

name: Release
run-name: Release ${{ github.ref_name }}

on:
  push:
    tags:
      - "v*"

jobs:
  package:
    # This runner defines the oldest supported release ABI (glibc 2.39).
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    outputs:
      version: ${{ steps.meta.outputs.version }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up repository tool SDK
        uses: actions/setup-dotnet@v4
        with:
          global-json-file: global.json

      - name: Cache repository tool packages
        uses: actions/cache@v4
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('global.json', 'tools/**/*.cs') }}

      - name: Build repository tool once
        run: dotnet build tools/wayscriber.cs

      - name: Install build dependencies
        run: dotnet run tools/wayscriber.cs --no-build -- ci install-dependencies package

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@1.98.1

      - name: Install nfpm
        run: dotnet run tools/wayscriber.cs --no-build -- ci install-nfpm

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: |
            .

      - name: Read release version
        id: meta
        run: dotnet run tools/wayscriber.cs --no-build -- release resolve-version

      - name: Check version metadata
        run: dotnet run tools/wayscriber.cs --no-build -- version check --release-version "${{ steps.meta.outputs.version }}"

      - name: Check nixpkgs recipe dependencies
        run: dotnet run tools/wayscriber.cs --no-build -- check nixpkgs-recipe

      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          github_access_token: ${{ secrets.GITHUB_TOKEN }}
          extra_nix_config: |
            experimental-features = nix-command flakes

      - name: Check Nix flake package versions
        run: dotnet run tools/wayscriber.cs --no-build -- check nix-versions

      - name: Check Nix flake package and development shell instantiation
        run: dotnet run tools/wayscriber.cs --no-build -- check nix-instantiation

      - name: Pre-fetch Cargo dependencies (locked)
        run: dotnet run tools/wayscriber.cs --no-build -- dev fetch --target x86_64-unknown-linux-gnu

      - name: Build and package (tar/deb/rpm)
        run: dotnet run tools/wayscriber.cs --no-build -- package build --version "${{ steps.meta.outputs.version }}" --formats tar,deb,rpm --artifact-root dist

      - name: Check direct Arch installer compatibility
        run: dotnet run tools/wayscriber.cs --no-build -- package check-live-arch-installer --archive "dist/wayscriber-v${{ steps.meta.outputs.version }}-linux-x86_64.tar.gz"

      - name: Verify packaged metadata and retained licenses
        run: dotnet run tools/wayscriber.cs --no-build -- package verify-artifacts --artifact-root dist --version "${{ steps.meta.outputs.version }}"

      - name: Clean Ubuntu 24.04 install smoke
        run: dotnet run tools/wayscriber.cs --no-build -- package smoke-ubuntu --artifact-root dist

      - name: Upload tarball
        uses: actions/upload-artifact@v4
        with:
          name: wayscriber-${{ steps.meta.outputs.version }}-tar
          path: dist/wayscriber-v${{ steps.meta.outputs.version }}-linux-x86_64.tar.gz

      - name: Upload configurator tarball
        uses: actions/upload-artifact@v4
        with:
          name: wayscriber-configurator-${{ steps.meta.outputs.version }}-tar
          path: dist/wayscriber-configurator-v${{ steps.meta.outputs.version }}-linux-x86_64.tar.gz

      - name: Upload deb
        uses: actions/upload-artifact@v4
        with:
          name: wayscriber-${{ steps.meta.outputs.version }}-deb
          path: dist/wayscriber-amd64.deb

      - name: Upload configurator deb
        uses: actions/upload-artifact@v4
        with:
          name: wayscriber-configurator-${{ steps.meta.outputs.version }}-deb
          path: dist/wayscriber-configurator-amd64.deb

      - name: Upload rpm
        uses: actions/upload-artifact@v4
        with:
          name: wayscriber-${{ steps.meta.outputs.version }}-rpm
          path: dist/wayscriber-x86_64.rpm

      - name: Upload configurator rpm
        uses: actions/upload-artifact@v4
        with:
          name: wayscriber-configurator-${{ steps.meta.outputs.version }}-rpm
          path: dist/wayscriber-configurator-x86_64.rpm

      - name: Upload manifests
        uses: actions/upload-artifact@v4
        with:
          name: wayscriber-${{ steps.meta.outputs.version }}-manifest
          path: |
            dist/checksums.txt
            dist/manifest.json

  package-repos:
    name: Build apt/dnf repositories
    needs: package
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    env:
      GPG_PRIVATE_KEY_B64: ${{ secrets.PACKAGE_REPO_GPG_PRIVATE_KEY_B64 }}
      GPG_PASSPHRASE: ${{ secrets.PACKAGE_REPO_GPG_PASSPHRASE }}
      GPG_KEY_ID: ${{ secrets.PACKAGE_REPO_GPG_KEY_ID }}
      PACKAGE_REPO_REMOTE_HOST: ${{ secrets.PACKAGE_REPO_REMOTE_HOST }}
      PACKAGE_REPO_REMOTE_PATH: ${{ secrets.PACKAGE_REPO_REMOTE_PATH }}
      PACKAGE_REPO_REMOTE_USER: ${{ secrets.PACKAGE_REPO_REMOTE_USER }}
      PACKAGE_REPO_SSH_KEY: ${{ secrets.PACKAGE_REPO_SSH_KEY }}
      PACKAGE_REPO_SSH_KNOWN_HOSTS: ${{ secrets.PACKAGE_REPO_SSH_KNOWN_HOSTS }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up repository tool SDK
        uses: actions/setup-dotnet@v4
        with:
          global-json-file: global.json

      - name: Build repository tool once
        run: dotnet build tools/wayscriber.cs

      - name: Install repository tooling
        run: dotnet run tools/wayscriber.cs --no-build -- ci install-dependencies repositories

      - name: Download packaged artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - name: Build apt and rpm repositories
        env:
          ARTIFACT_ROOT: dist
          OUTPUT_ROOT: repo-out
          DEB_SUITE: stable
          DEB_COMPONENT: main
          DEB_ARCH: amd64
          RPM_ARCH: x86_64
          REPO_ORIGIN: Wayscriber
          REPO_LABEL: Wayscriber
          SIGN_RPMS: 1
        run: dotnet run tools/wayscriber.cs --no-build -- package build-repositories

      - name: Upload repo bundle
        uses: actions/upload-artifact@v4
        with:
          name: wayscriber-${{ needs.package.outputs.version }}-repos
          path: |
            repo-out/apt
            repo-out/rpm
            repo-out/WAYSCRIBER-GPG-KEY.asc

      - name: Deploy to website host (rsync)
        if: ${{ env.PACKAGE_REPO_REMOTE_HOST != '' && env.PACKAGE_REPO_REMOTE_PATH != '' && env.PACKAGE_REPO_SSH_KEY != '' }}
        env:
          DEPLOY_HOST: ${{ env.PACKAGE_REPO_REMOTE_HOST }}
          DEPLOY_PATH: ${{ env.PACKAGE_REPO_REMOTE_PATH }}
          DEPLOY_USER: ${{ env.PACKAGE_REPO_REMOTE_USER }}
        run: dotnet run tools/wayscriber.cs --no-build -- release deploy-package-repositories

  release:
    needs: package
    runs-on: ubuntu-24.04
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      contents: write
    steps:
      - name: Download packaged artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - name: Publish GitHub release (auto notes)
        uses: softprops/action-gh-release@v2
        with:
          files: dist/**/*
          generate_release_notes: true

  aur:
    needs: [package, release]
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-24.04
    env:
      AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
      AUR_SSH_KNOWN_HOSTS: ${{ secrets.AUR_SSH_KNOWN_HOSTS }}
      AUR_SSH_PASSPHRASE: ${{ secrets.AUR_SSH_PASSPHRASE }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up repository tool SDK
        uses: actions/setup-dotnet@v4
        with:
          global-json-file: global.json

      - name: Cache repository tool packages
        uses: actions/cache@v4
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('global.json', 'tools/**/*.cs') }}

      - name: Build repository tool once
        run: dotnet build tools/wayscriber.cs

      - name: Require AUR credentials
        run: dotnet run tools/wayscriber.cs --no-build -- ci require-environment AUR_SSH_PRIVATE_KEY

      - name: Configure SSH for AUR and test it
        run: dotnet run tools/wayscriber.cs --no-build -- aur prepare-ssh

      - name: Download packaged artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - name: Set git identity for AUR
        env:
          AUR_GIT_USERNAME: ${{ secrets.AUR_GIT_USERNAME }}
          AUR_GIT_EMAIL: ${{ secrets.AUR_GIT_EMAIL }}
        run: dotnet run tools/wayscriber.cs --no-build -- aur configure-git

      - name: Clone AUR repos
        run: dotnet run tools/wayscriber.cs --no-build -- aur clone

      - name: Update AUR from manifest
        run: dotnet run tools/wayscriber.cs --no-build -- aur update --manifest dist/manifest.json --source-dir aur-wayscriber --bin-dir aur-wayscriber-bin --config-dir aur-wayscriber-configurator --push