name: Build and publish package

on:
  push:
    tags: ['v*']

jobs:
  package:
    runs-on: [self-hosted, hestia]
    # Forgejo's Arch package registry does not GPG-sign a pacman db.
    # BOS ISO [breadway] stays SigLevel = Never until a signed db exists.
    # Do not flip that here — flipping without a signed db breaks pacman.
    # Keep publishing the unsigned .pkg.tar.zst to the registry below.
    container:
      image: archlinux:latest
    steps:
      # Note: no actions/checkout — the archlinux image has no Node, which JS
      # actions require. Everything runs as shell steps and clones manually.
      - name: Build and publish
        env:
          PUBLISH_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          pacman -Syu --noconfirm base-devel git rust cargo libgit2 openssl pam wayland libxkbcommon gtk4
          useradd -m builder
          git config --global --add safe.directory '*'
          git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" /home/builder/src
          cd /home/builder/src
          git archive --format=tar.gz --prefix="breadlock-${VERSION}/" HEAD \
            > packaging/arch/breadlock-${VERSION}.tar.gz
          SHA=$(sha256sum packaging/arch/breadlock-${VERSION}.tar.gz | awk '{print $1}')
          sed -i "s/^pkgver=.*/pkgver=${VERSION}/" packaging/arch/PKGBUILD
          sed -i "s/^sha256sums=.*/sha256sums=('${SHA}')/" packaging/arch/PKGBUILD
          chown -R builder:builder /home/builder/src
          # --nocheck: packaging builds the artifact; tests belong in a CI job.
          su builder -c "cd /home/builder/src/packaging/arch && makepkg -f --noconfirm --nocheck"
          PKG=$(find /home/builder/src/packaging/arch -name '*.pkg.tar.zst' | head -1)
          mkdir -p /tmp/breadlock-pkg
          cp "$PKG" /tmp/breadlock-pkg/
          echo "${VERSION}" > /tmp/breadlock-pkg/VERSION
          curl -fsS -X PUT \
            -H "Authorization: token ${PUBLISH_TOKEN}" \
            -H "Content-Type: application/octet-stream" \
            --data-binary "@${PKG}" \
            "https://git.breadway.dev/api/packages/Breadway/arch/os"

      # Optional detach-sign. secrets.GPG_PRIVATE_KEY is the same BOS
      # release-signing key (releases@breadway.dev). If the secret is
      # missing, skip — the registry PUT above already published the
      # unsigned package. A lone .sig is not a signed repo: ISO
      # [breadway] stays SigLevel = Never until a signed db exists.
      # The .sig is uploaded as a generic-package artifact next to that
      # PUT, not injected into the Arch repo (which would not make
      # pacman verify anything without a signed db).
      - name: Detach-sign package (optional)
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
          PUBLISH_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -euo pipefail
          if [ -z "${GPG_PRIVATE_KEY:-}" ]; then
            echo "GPG_PRIVATE_KEY unset; skipping detach-sign."
            echo "ISO [breadway] stays SigLevel = Never until a signed db exists."
            exit 0
          fi
          PKG=$(find /tmp/breadlock-pkg -name '*.pkg.tar.zst' | head -1)
          if [ -z "$PKG" ]; then
            echo "no package in /tmp/breadlock-pkg; cannot sign" >&2
            exit 1
          fi
          VERSION=$(cat /tmp/breadlock-pkg/VERSION)
          pacman -S --noconfirm --needed gnupg
          export GNUPGHOME=/tmp/gnupg-breadlock
          mkdir -m 700 -p "$GNUPGHOME"
          echo "$GPG_PRIVATE_KEY" | gpg --batch --import
          gpg --batch --yes --detach-sign -o "${PKG}.sig" "$PKG"
          echo "Signed $(basename "$PKG") -> $(basename "$PKG").sig"
          # Generic package: workflow artifact alongside the Arch PUT.
          # Does not change [breadway] / pacman SigLevel.
          curl -fsS -X PUT \
            -H "Authorization: token ${PUBLISH_TOKEN}" \
            -H "Content-Type: application/octet-stream" \
            --data-binary "@${PKG}.sig" \
            "https://git.breadway.dev/api/packages/Breadway/generic/breadlock/${VERSION}/$(basename "$PKG").sig"