name: Publish to AUR

on:
  push:
    tags:
      - 'v*'
  # Re-publish without a new upstream release, e.g. a PKGBUILD-only fix:
  # run it on master with the released version and the next pkgrel.
  workflow_dispatch:
    inputs:
      version:
        description: 'Released version to package, without the v (e.g. 1.2.3)'
        required: true
      pkgrel:
        description: 'Package release number'
        required: true
        default: '1'
      packages:
        description: 'Which AUR packages: both, source (ahfail) or bin (ahfail-bin)'
        required: true
        default: 'both'

jobs:
  aur:
    if: github.event_name != 'workflow_dispatch' || inputs.packages != 'bin'
    runs-on: ubuntu-latest
    container:
      image: archlinux:base-devel
    steps:
      - name: Install base tools
        run: pacman -Syu --noconfirm git openssh pacman-contrib nodejs sudo

      - uses: actions/checkout@v4

      - name: Extract version from tag
        id: version
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            VERSION="${{ inputs.version }}"
            PKGREL="${{ inputs.pkgrel }}"
          else
            VERSION="${GITHUB_REF#refs/tags/v}"
            PKGREL=1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "pkgrel=$PKGREL" >> "$GITHUB_OUTPUT"
          echo "Publishing $VERSION-$PKGREL to AUR"

      - name: Configure SSH for AUR
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.AUR_SSH_PRIVATE_KEY }}" > ~/.ssh/aur
          chmod 600 ~/.ssh/aur
          ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null
          cat > ~/.ssh/config <<'EOF'
          Host aur.archlinux.org
            User aur
            IdentityFile ~/.ssh/aur
            StrictHostKeyChecking accept-new
          EOF

      - name: Create unprivileged build user
        run: |
          useradd -m builder
          echo "builder ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
          mkdir -p /home/builder/.ssh
          cp -r ~/.ssh/. /home/builder/.ssh/
          chown -R builder:builder /home/builder/.ssh
          chmod 600 /home/builder/.ssh/aur

      - name: Clone existing AUR repo (or init new)
        run: |
          git clone ssh://aur@aur.archlinux.org/ahfail.git aur-pkg 2>&1 || true
          if [ ! -d aur-pkg/.git ]; then
            mkdir -p aur-pkg
            cd aur-pkg
            git init -b master
            git remote add origin ssh://aur@aur.archlinux.org/ahfail.git
          fi

      - name: Render PKGBUILD for this release
        run: |
          cp packaging/aur/PKGBUILD packaging/aur/ahfail.install aur-pkg/
          sed -i "s/^pkgver=.*/pkgver=${{ steps.version.outputs.version }}/" aur-pkg/PKGBUILD
          sed -i "s/^pkgrel=.*/pkgrel=${{ steps.version.outputs.pkgrel }}/" aur-pkg/PKGBUILD

      - name: Update checksums and regenerate .SRCINFO
        run: |
          chown -R builder:builder aur-pkg
          cd aur-pkg
          sudo -u builder updpkgsums
          sudo -u builder makepkg --printsrcinfo > .SRCINFO

      - name: Commit and push to AUR
        run: |
          cd aur-pkg
          git config user.name "Asger Geel Weirsoe"
          git config user.email "asger@weircon.dk"
          git add PKGBUILD .SRCINFO ahfail.install
          if git diff --staged --quiet; then
            echo "No changes — nothing to push."
            exit 0
          fi
          git commit -m "Update to ${{ steps.version.outputs.version }}-${{ steps.version.outputs.pkgrel }}"
          git push -u origin master

      # Mirror the same PKGBUILD to https://asger.weirsøe.dk/tarballz/, the
      # human-readable package index. The key is pinned on the web host to a
      # forced command that can only write this one file, and a failure there
      # must never turn an otherwise good AUR release red.
      - name: Publish PKGBUILD to the tarballz index
        continue-on-error: true
        env:
          TARBALLZ_SSH_KEY: ${{ secrets.TARBALLZ_SSH_KEY }}
        run: |
          printf '%s\n' "$TARBALLZ_SSH_KEY" > ~/.ssh/tarballz
          chmod 600 ~/.ssh/tarballz
          ssh -i ~/.ssh/tarballz -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
            "${{ vars.TARBALLZ_TARGET }}" < aur-pkg/PKGBUILD

  # ahfail-bin: the same release, prebuilt. The binary is built from the TAG
  # (also when this runs by hand from master), staged as a `meson install` tree,
  # hosted on https://asger.weirsøe.dk/tarballz/ next to the other packages, and
  # the AUR package only unpacks it.
  aur-bin:
    if: github.event_name != 'workflow_dispatch' || inputs.packages != 'source'
    runs-on: ubuntu-latest
    container:
      image: archlinux:base-devel
    steps:
      - name: Install build and packaging tools
        run: >
          pacman -Syu --noconfirm --needed git openssh nodejs sudo pacman-contrib curl
          rust meson ninja gtk3 gtk-session-lock gstreamer gst-plugins-base
          gst-plugins-good gst-plugins-bad-libs pam

      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Resolve version
        id: version
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            VERSION="${{ inputs.version }}"
            PKGREL="${{ inputs.pkgrel }}"
          else
            VERSION="${GITHUB_REF#refs/tags/v}"
            PKGREL=1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "pkgrel=$PKGREL" >> "$GITHUB_OUTPUT"

      - name: Build the tagged source into a staged tree
        run: |
          # The packaging files come from this checkout; the binary from the tag.
          cp -r packaging/aur-bin /tmp/aur-bin
          git -c advice.detachedHead=false checkout "v${{ steps.version.outputs.version }}"
          meson setup build --prefix=/usr --buildtype=release -Dupdate_check=false
          meson compile -C build
          DESTDIR="$PWD/stage" meson install -C build
          find stage -type f | sort

      - name: Pack the tarball
        id: tarball
        run: |
          # Reproducible-ish: fixed owner, sorted entries, mtime of the tagged commit.
          EPOCH="$(git log -1 --format=%ct)"
          tar --sort=name --owner=0 --group=0 --numeric-owner --mtime="@$EPOCH" \
              --zstd -cf ahfail.tar.zst -C stage usr etc
          SHA="$(sha256sum ahfail.tar.zst | cut -d' ' -f1)"
          # The hash is part of the name, so a published name never changes bytes.
          NAME="ahfail-${{ steps.version.outputs.version }}-${SHA:0:12}-x86_64.tar.zst"
          mv ahfail.tar.zst "$NAME"
          echo "name=$NAME" >> "$GITHUB_OUTPUT"
          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
          ls -l "$NAME"

      - name: Upload the tarball to tarballz
        env:
          TARBALLZ_BIN_SSH_KEY: ${{ secrets.TARBALLZ_BIN_SSH_KEY }}
        run: |
          mkdir -p ~/.ssh
          printf '%s\n' "$TARBALLZ_BIN_SSH_KEY" > ~/.ssh/tarballz-bin
          chmod 600 ~/.ssh/tarballz-bin
          # Forced command on the web host: this key may only write ahfail-*.tar.*
          # and ahfail-bin.PKGBUILD, and keeps the newest three tarballs.
          ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
            "${{ vars.TARBALLZ_TARGET }}" "tarball ${{ steps.tarball.outputs.name }}" < "${{ steps.tarball.outputs.name }}"

      - name: Verify the public URL serves the same bytes
        run: |
          URL="https://asger.weirsoe.dk/tarballz/${{ steps.tarball.outputs.name }}"
          GOT="$(curl -fsSL --retry 3 "$URL" | sha256sum | cut -d' ' -f1)"
          if [ "$GOT" != "${{ steps.tarball.outputs.sha }}" ]; then
            echo "error: $URL does not serve the uploaded tarball" >&2
            exit 1
          fi

      - name: Configure SSH for AUR
        run: |
          echo "${{ secrets.AUR_SSH_PRIVATE_KEY }}" > ~/.ssh/aur
          chmod 600 ~/.ssh/aur
          ssh-keyscan -H aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null
          cat > ~/.ssh/config <<'EOF'
          Host aur.archlinux.org
            User aur
            IdentityFile ~/.ssh/aur
            StrictHostKeyChecking accept-new
          EOF
          useradd -m builder

      - name: Render PKGBUILD and .SRCINFO
        run: |
          git clone ssh://aur@aur.archlinux.org/ahfail-bin.git aur-bin-pkg 2>&1 || true
          if [ ! -d aur-bin-pkg/.git ]; then
            mkdir -p aur-bin-pkg && cd aur-bin-pkg
            git init -b master
            git remote add origin ssh://aur@aur.archlinux.org/ahfail-bin.git
            cd ..
          fi
          cp /tmp/aur-bin/PKGBUILD /tmp/aur-bin/ahfail.install aur-bin-pkg/
          cd aur-bin-pkg
          sed -i "s/@TARBALL@/${{ steps.tarball.outputs.name }}/g; s/@SHA256@/${{ steps.tarball.outputs.sha }}/" PKGBUILD
          sed -i "s/^pkgver=.*/pkgver=${{ steps.version.outputs.version }}/; s/^pkgrel=.*/pkgrel=${{ steps.version.outputs.pkgrel }}/" PKGBUILD
          chown -R builder: .
          sudo -u builder makepkg --printsrcinfo > .SRCINFO
          cat PKGBUILD | tail -20

      - name: Commit and push to AUR
        run: |
          cd aur-bin-pkg
          git config user.name "Asger Geel Weirsoe"
          git config user.email "asger@weircon.dk"
          git add PKGBUILD .SRCINFO ahfail.install
          if git diff --staged --quiet; then
            echo "No changes, nothing to push."
            exit 0
          fi
          git commit -m "Update to ${{ steps.version.outputs.version }}-${{ steps.version.outputs.pkgrel }}"
          git push -u origin master

      - name: Publish PKGBUILD to the tarballz index
        continue-on-error: true
        run: |
          ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
            "${{ vars.TARBALLZ_TARGET }}" < aur-bin-pkg/PKGBUILD