# Release pipeline: a `vX.Y.Z` tag (pushed by `cargo release`, see
# release.toml) builds distribution tarballs and attaches them to a
# Gitea release.
#
# Each tarball contains the two binaries (stripped, release profile),
# the systemd units, the example config, rendered man pages, and the
# license/readme — everything a distro package or a hand install needs.
name: release

on:
  push:
    tags: ["v*"]

jobs:
  build:
    runs-on: ubuntu-latest
    container: rust:1
    strategy:
      matrix:
        target: [x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu]
    steps:
      # v4 built-in checkout: native Go, needs no Node (rust:1 has none) and
      # keeps the token out of a fetch URL. Uses the job token for the private repo.
      - name: checkout
        uses: builtin:checkout

      - name: install tooling
        run: |
          apt-get update
          apt-get install -y --no-install-recommends scdoc jq
          if [ "${{ matrix.target }}" = "aarch64-unknown-linux-gnu" ]; then
            # libc6-dev-arm64-cross is a Recommends of the cross gcc, so
            # --no-install-recommends skips it — without it cc-rs builds
            # (blake3's NEON unit) fall back to host headers and die on
            # bits/wordsize.h.
            apt-get install -y --no-install-recommends \
              gcc-aarch64-linux-gnu libc6-dev-arm64-cross
          fi
          rustup target add ${{ matrix.target }}

      - name: build
        env:
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
        run: |
          cargo build --workspace --release --target ${{ matrix.target }}

      - name: package
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          PKG="varde-${VERSION}-${{ matrix.target }}"
          # Steps run under plain `sh`, which has no brace expansion —
          # spell the directories out.
          mkdir -p "$PKG/bin" "$PKG/systemd/user" "$PKG/man"
          cp "target/${{ matrix.target }}/release/varde-daemon" \
             "target/${{ matrix.target }}/release/varde-ctl" "$PKG/bin/"
          # Cross-strip is unavailable for the foreign target; native
          # strip handles the host one.
          if [ "${{ matrix.target }}" = "x86_64-unknown-linux-gnu" ]; then
            strip "$PKG"/bin/*
          else
            aarch64-linux-gnu-strip "$PKG"/bin/*
          fi
          cp dist/varde.service dist/varde.socket "$PKG/systemd/"
          cp dist/user/varde.service dist/user/varde.socket "$PKG/systemd/user/"
          cp dist/config.toml "$PKG/config.toml.example"
          scdoc < dist/varde.8.scd > "$PKG/man/varde.8"
          scdoc < dist/varde-ctl.1.scd > "$PKG/man/varde-ctl.1"
          cp README.md LICENSE-MIT LICENSE-APACHE "$PKG/"
          tar czf "$PKG.tar.gz" "$PKG"
          sha256sum "$PKG.tar.gz" > "$PKG.tar.gz.sha256"

      - name: create release and upload
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
          # Create the release if this matrix job is first; 409 = the
          # other job already made it.
          curl -sf -X POST "$API/releases" \
            -H "Authorization: token $TOKEN" \
            -H "Content-Type: application/json" \
            -d "{\"tag_name\": \"${GITHUB_REF_NAME}\", \"name\": \"${GITHUB_REF_NAME}\", \"draft\": false}" \
            || true
          RELEASE_ID=$(curl -sf "$API/releases/tags/${GITHUB_REF_NAME}" \
            -H "Authorization: token $TOKEN" | jq .id)
          for f in varde-*.tar.gz varde-*.tar.gz.sha256; do
            curl -sf -X POST \
              "$API/releases/${RELEASE_ID}/assets?name=$(basename "$f")" \
              -H "Authorization: token $TOKEN" \
              -F "attachment=@$f"
          done

  # The uhhm Arch registry (pacman.conf: .../api/packages/bl/arch/uhhm),
  # from the tarballs just released. On klokka: an Arch host with
  # makepkg. REGISTRY_TOKEN is the uhhm org's write:package token.
  publish:
    needs: build
    runs-on: aarch64
    steps:
      - name: checkout
        uses: builtin:checkout
      - name: fetch tarballs and pin the PKGBUILD
        run: |
          set -eu
          TAG="${GITHUB_REF_NAME}"
          VERSION="${TAG#v}"
          BASE="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/download/${TAG}"
          cd dist/arch
          for t in x86_64 aarch64; do
            f="varde-${VERSION}-${t}-unknown-linux-gnu.tar.gz"
            # The repo is private: anonymous release downloads 404.
            curl -fsSL -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -o "$f" "$BASE/$f"
          done
          SUM_X86=$(sha256sum "varde-${VERSION}-x86_64-unknown-linux-gnu.tar.gz" | cut -d' ' -f1)
          SUM_AARCH=$(sha256sum "varde-${VERSION}-aarch64-unknown-linux-gnu.tar.gz" | cut -d' ' -f1)
          sed -i "s/^pkgver=.*/pkgver=${VERSION}/" PKGBUILD
          sed -i "s/sha256sums_x86_64=('.*')/sha256sums_x86_64=('${SUM_X86}')/" PKGBUILD
          sed -i "s/sha256sums_aarch64=('.*')/sha256sums_aarch64=('${SUM_AARCH}')/" PKGBUILD
      - name: publish to the uhhm Arch registry
        run: |
          set -eu
          if [ -z "${{ secrets.REGISTRY_TOKEN }}" ]; then
            echo "::error::REGISTRY_TOKEN not set - add it to publish"
            exit 1
          fi
          cd dist/arch
          for carch in aarch64 x86_64; do
            pkgfile=$(CARCH="$carch" makepkg --packagelist | tail -1)
            CARCH="$carch" makepkg -f --nodeps --noconfirm
            curl --fail-with-body --user "bl:${{ secrets.REGISTRY_TOKEN }}" \
              --upload-file "$pkgfile" \
              "${GITHUB_SERVER_URL}/api/packages/bl/arch/uhhm"
          done