name: Build ISO

on:
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    container:
      image: artixlinux/artixlinux:base
      options: --privileged

    steps:
    - uses: actions/checkout@v4


    - name: Install dependencies
      run: |
        pacman -Syu --noconfirm --needed --overwrite='*' \
          artools \
          git \
          squashfs-tools \
          sudo \
          python \
          python-pip

    - name: Bootstrap Antergos package signing key
      run: |
        KEY_FINGERPRINT=AA644A095D2AF5F950FADB57C51BFE8D3A985236
        curl -fsSL -o /tmp/antergos-next.gpg https://raw.githubusercontent.com/Antergos-NeXT/antergos-packages/master/packages/antergos-next-keyring/antergos-next.gpg
        pacman-key --init
        pacman-key --add /tmp/antergos-next.gpg
        gpg --homedir /etc/pacman.d/gnupg --batch --with-colons --fingerprint "$KEY_FINGERPRINT" | grep -q "fpr:::::::::$KEY_FINGERPRINT:"
        pacman-key --lsign-key "$KEY_FINGERPRINT"
        rm -f /tmp/antergos-next.gpg


    - name: Set up WORKSPACE_DIR
      run: |
        echo "WORKSPACE_DIR=${{ github.workspace }}" >> $GITHUB_ENV

    - name: Debug workspace
      run: |
        echo "GITHUB_WORKSPACE=$GITHUB_WORKSPACE"
        echo "github.workspace=${{ github.workspace }}"
        pwd
        ls -la

    - name: Override pacman.conf with antergos-pkgs repo
      run: |
        mkdir -p /root/.config/artools/pacman.conf.d
        cp "pacman.conf.d/iso-x86_64.conf" \
           /root/.config/artools/pacman.conf.d/iso-x86_64.conf
        # Also override the default in case USER_CONF_DIR differs
        cp "pacman.conf.d/iso-x86_64.conf" \
           /usr/share/artools/pacman.conf.d/iso-x86_64.conf

    - name: Check available swap and block devices
      run: |
        swapon --show || echo "No swap"
        lsblk
        free -h

    - name: Setup tmpfs for build directory
      run: |
        mkdir -p /var/lib/artools/buildiso
        mount -t tmpfs -o size=12G,exec,suid,dev tmpfs /var/lib/artools/buildiso
        mount | grep buildiso

    - name: Build ISO
      run: |
        sudo -E ./buildiso -p antergos

    - name: Generate checksums
      run: |
        cd "${WORKSPACE_DIR}/iso/antergos"
        ISO=$(ls antergos-*.iso | head -1)
        [[ -z "$ISO" || ! -f "$ISO" ]] && { echo "No ISO found"; exit 1; }
        sha256sum "$ISO" > "$ISO.sha256"
        cat "$ISO.sha256"

    - name: Upload ISO artifact
      uses: actions/upload-artifact@v4
      with:
        name: Antergos-NeXT-ISO
        path: ${{ github.workspace }}/iso/

    - name: Upload to Internet Archive
      if: false  # My NVMe tried to unalive itself, 1536 unsafe shutdowns, ext4 cooked medium-rare, so I'm raw-dogging my own distro now. Set to true when I stop being my own QA team.
      env:
        IA_ACCESS_KEY: ${{ secrets.IA_ACCESS_KEY }}
        IA_SECRET_KEY: ${{ secrets.IA_SECRET_KEY }}
      run: |
        pip install --break-system-packages internetarchive

        mkdir -p "$HOME/.config/internetarchive"
        cat > "$HOME/.config/internetarchive/ia.ini" <<EOF
        [s3]
        access = $IA_ACCESS_KEY
        secret = $IA_SECRET_KEY
        EOF

        ISO_DIR="${WORKSPACE_DIR}/iso"
        ISO=$(ls "$ISO_DIR"/antergos/*.iso 2>/dev/null | head -1)
        [[ -z "$ISO" || ! -f "$ISO" ]] && { echo "No ISO found"; exit 1; }

        DATE=$(date +%Y.%m.%d)
        IDENTIFIER="antergos-next-$(date +%Y%m%d)-${{ github.run_number }}"

        SIZE=$(stat -c%s "$ISO")
        if [[ $SIZE -lt 524288000 ]]; then
          echo "WARNING: ISO smaller than expected (${SIZE} bytes)"
          file "$ISO" | grep -q "ISO 9660\|UDF" || { echo "Corrupted ISO"; exit 1; }
        fi

        ia upload "$IDENTIFIER" "$ISO" \
          --metadata="title:Antergos NeXT $(date +%Y.%m.%d)" \
          --metadata="mediatype:software" \
          --metadata="collection:open_source_software" \
          --metadata="description:Antergos NeXT technical successor ISO — KDE Plasma, Dinit, Calamares installer" \
          --metadata="subject:Antergos; Linux; Artix; Dinit; KDE Plasma; Calamares" \
          --retries 5

        echo "Uploaded to: https://archive.org/details/$IDENTIFIER"