name: Build Packages

on:
  push:
    branches: [master]
  workflow_dispatch:
  schedule:
    - cron: "0 0 * * 1"

permissions:
  contents: write

jobs:
  build:
    runs-on: artix

    steps:
    - uses: actions/checkout@v4
      with:
        token: ${{ secrets.GITEA_TOKEN }}

    - name: Install deps
      run: |
        pacman -Syu --noconfirm --needed --overwrite='*' \
          python-yaml \
          git \
          sudo \
          base-devel \
          debugedit

    - name: Create builder user
      run: |
        id -u builder &>/dev/null || useradd -m builder
        echo "builder ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/builder
        chmod 440 /etc/sudoers.d/builder

    - name: Build packages
      run: python build-packages.py

    - name: Set up repo
      run: |
        mkdir -p repo/euri-pkgs/os/x86_64
        cp /tmp/pkgout/*.pkg.tar.zst repo/euri-pkgs/os/x86_64/

    - name: Generate repo database
      run: |
        cd repo/euri-pkgs/os/x86_64
        repo-add euri-pkgs.db.tar.gz *.pkg.tar.zst

    - name: Sign repo database
      env:
        SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
        SIGNING_PASSPHRASE: ${{ secrets.SIGNING_PASSPHRASE }}
      run: |
        if [[ -n "$SIGNING_KEY" && -n "$SIGNING_PASSPHRASE" ]]; then
          export GNUPGHOME=/tmp/gpg-sign
          mkdir -p "$GNUPGHOME" && chmod 700 "$GNUPGHOME"
          echo "$SIGNING_KEY" | base64 -d > /tmp/signing-key.gpg
          gpg --batch --import /tmp/signing-key.gpg
          cd repo/euri-pkgs/os/x86_64
          gpg --batch --yes --pinentry-mode loopback --passphrase "$SIGNING_PASSPHRASE" \
            --detach-sign --output euri-pkgs.db.tar.gz.sig euri-pkgs.db.tar.gz
          cp euri-pkgs.db.tar.gz.sig euri-pkgs.db.sig

          rm -rf "$GNUPGHOME" /tmp/signing-key.gpg
        else
          echo "Signing secrets not set — skipping signature"
        fi

    - name: Copy to root for flat-URL compat
      run: |
        cp repo/euri-pkgs/os/x86_64/*.pkg.tar.zst repo/
        cp repo/euri-pkgs/os/x86_64/euri-pkgs.db* repo/

    - name: Generate index and package list
      run: python generate-index.py

    - name: Deploy to repo branch
      env:
        GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
      run: |
        git config user.name "gitea-actions"
        git config user.email "actions@antergos-nas.taild4360b.ts.net"
        git remote set-url origin "https://git:${GITEA_TOKEN}@antergos-nas.taild4360b.ts.net/Euri-Linux/euri-packages.git"
        git checkout -B repo
        git add -f repo
        git commit -m "Update packages [skip ci]" || echo "Nothing to commit"
        git push origin repo --force