name: Build packages

on:
  push:
    branches: ['master']
    tags: '*'
  pull_request:

jobs:
  build-packages:
    strategy:
      matrix:
        target-os: [ debian-13, ubuntu-2404, ubuntu-2604, fedora-43, fedora-44, arch, opensuse-tumbleweed ]
        recipe: [ lact, lact-headless ]
        include:
          - target-os: rhel-8
            recipe: lact-headless
          - target-os: rhel-9
            recipe: lact-headless
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Docker Cache
        uses: AndreKurait/docker-cache@0.6.0
        with:
          key: docker-${{ matrix.target-os }}-${{ hashFiles('pkg/images/') }}

      - name: Import gpg key
        run: |
          echo -n "$GPG_KEY" | base64 -d > /tmp/package-signing-key.gpg
          echo -n "$GPG_KEY" | base64 -d | gpg --import || true
        env:
          GPG_KEY: ${{ secrets.GPG_KEY }}

      # TODO: remove this later, potential cause: https://github.com/moby/moby/issues/51665
      - name: Fix docker 
        run: |
          sudo tee /etc/docker/daemon.json <<EOF
          {
            "storage-driver": "overlay2"
          }
          EOF
          sudo systemctl restart docker
          docker info

      - name: Install pkger
        run: |
          curl -L -o /usr/local/bin/pkger https://github.com/ilya-zlobintsev/pkger/releases/download/v0.11.5/pkger
          chmod +x /usr/local/bin/pkger
      
      # A GitHub Action that implements smart caching for rust/cargo projects with sensible defaults.
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - name: Build packages (with signing)
        if: ${{ (contains(matrix.target-os, 'fedora') || contains(matrix.target-os, 'opensuse') || matrix.target-os == 'rhel-9') && env.GPG_KEY_PASSWORD != '' }}
        run: pkger -t -c .pkger.yml build ${{ matrix.recipe }} -i ${{ matrix.target-os }}
        env:
          GPG_KEY_PASSWORD: ${{ secrets.GPG_KEY_PASSWORD }}

      - name: Build packages (without signing)
        if: ${{ !(contains(matrix.target-os, 'fedora') || contains(matrix.target-os, 'opensuse') || matrix.target-os == 'rhel-9') || env.GPG_KEY_PASSWORD == '' }}
        run: pkger -t -c .pkger.yml build --no-sign ${{ matrix.recipe }} -i ${{ matrix.target-os }}
        env:
          GPG_KEY_PASSWORD: ${{ secrets.GPG_KEY_PASSWORD }}

      - name: Copy release files
        run: |
          OUT_DIR=$PWD/release-artifacts
          mkdir -p $OUT_DIR
          
          pushd pkg/output
          for DISTRO in $(ls); do
              cd $DISTRO
              rm -f *.src.rpm
          
              for FILE in $(ls); do
                  NAME="${FILE%.*}"
                  EXT="${FILE##*.}"
          
          	OUT_NAME="$OUT_DIR/$NAME.$DISTRO.$EXT"
          	cp $FILE $OUT_NAME
              done 
              cd ..
          done
          popd

      - name: Save gpg key
        run: |
          gpg --armor --export > $PWD/release-artifacts/lact.pubkey

      - name: Upload artifacts
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
        with:
          name: ${{ matrix.target-os }}-${{ matrix.recipe }}
          path: release-artifacts/*

  build-flatpak:
    runs-on: ubuntu-latest
    container:
      image: bilelmoussaoui/flatpak-github-actions:gnome-47
      options: --privileged
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
    - uses: flatpak/flatpak-github-actions/flatpak-builder@92ae9851ad316786193b1fd3f40c4b51eb5cb101 # v6
      with:
        bundle: io.github.ilya_zlobintsev.LACT.flatpak
        manifest-path: flatpak/io.github.ilya_zlobintsev.LACT.yaml
        cache-key: flatpak-builder-${{ github.sha }}
    - name: Upload artifacts
      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
      with:
        name: flatpak
        path: io.github.ilya_zlobintsev.LACT.flatpak
        
  build-docker:
    runs-on: ubuntu-latest
    steps:
      - name: Log into GHCR
        if: github.event_name != 'pull_request'
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker image metadata
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
        with:
          images: ghcr.io/${{ github.repository }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4

      - name: Build and push
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
        with:
          file: pkg/docker/Dockerfile
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  create-test-release:
    needs: [build-packages, build-flatpak]
    runs-on: ubuntu-latest
    if: (github.event_name == 'push' && github.ref == 'refs/heads/master')

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Download artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: downloaded-artifacts/
          pattern: "!*.dockerbuild"

      - name: Create release
        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
        with:
          removeArtifacts: true
          allowUpdates: true
          artifactErrorsFailBuild: false
          artifacts: "downloaded-artifacts/*/*"
          body: ${{ github.event.head_commit.message }}
          prerelease: true
          name: Test release
          tag: test-build

      - name: Update test-build tag
        run: |
          git tag -f test-build
          git push -f origin test-build
        shell: bash

  create-stable-release:
    needs: [build-packages, build-flatpak]
    runs-on: ubuntu-latest
    if: (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Download artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: downloaded-artifacts/
          pattern: "!*.dockerbuild"

      - name: Create release
        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
        with:
          artifacts: "downloaded-artifacts/*/*"
          name: ${{ github.ref_name }}
          tag: ${{ github.ref_name }}
          body: ${{ github.ref_name }} changelog goes here
          draft: true