name: Build Packages

on:
  push:
    branches: [master]
  workflow_dispatch:
  schedule:
    - cron: "0 0 * * 1"

permissions:
  contents: write

jobs:
  build:
    runs-on: ubuntu-latest
    container:
      image: artixlinux/artixlinux:base-dinit

    steps:
    - uses: actions/checkout@v4

    - name: Install deps
      run: |
        pacman -Syu --noconfirm --needed --overwrite='*' \
          python-yaml \
          git \
          sudo \
          base-devel \
          debugedit

    - name: Create builder user
      run: |
        useradd -m builder
        echo "builder ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

    - name: Build packages
      run: python build-packages.py

    - name: Set up repo
      run: |
        mkdir -p repo/antergos-pkgs/os/x86_64
        cp /tmp/pkgout/*.pkg.tar.zst repo/antergos-pkgs/os/x86_64/

    - name: Generate repo database
      run: |
        cd repo/antergos-pkgs/os/x86_64
        repo-add antergos-pkgs.db.tar.gz *.pkg.tar.zst

    - name: Sign repo database
      env:
        SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
        SIGNING_PASSPHRASE: ${{ secrets.SIGNING_PASSPHRASE }}
      run: |
        if [[ -n "$SIGNING_KEY" && -n "$SIGNING_PASSPHRASE" ]]; then
          export GNUPGHOME=/tmp/gpg-sign
          mkdir -p "$GNUPGHOME" && chmod 700 "$GNUPGHOME"
          echo "$SIGNING_KEY" | base64 -d > /tmp/signing-key.gpg
          gpg --batch --import /tmp/signing-key.gpg
          cd repo/antergos-pkgs/os/x86_64
          gpg --batch --yes --pinentry-mode loopback --passphrase "$SIGNING_PASSPHRASE" \
            --detach-sign --output antergos-pkgs.db.tar.gz.sig antergos-pkgs.db.tar.gz
          rm -rf "$GNUPGHOME" /tmp/signing-key.gpg
        else
          echo "Signing secrets not set — skipping signature"
        fi

    - name: Copy to root for flat-URL compat
      run: |
        cp repo/antergos-pkgs/os/x86_64/*.pkg.tar.zst repo/
        cp repo/antergos-pkgs/os/x86_64/antergos-pkgs.db* repo/

    - name: Generate index and package list
      run: python generate-index.py

    - name: Deploy to Pages
      uses: peaceiris/actions-gh-pages@v3
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}
        publish_dir: ./repo
        keep_files: false