# Gitea Actions: a tag vX.Y.Z (matching VERSION) becomes a release with
#   daynivo-kiosk-os-X.Y.Z.tar.gz (+ .sha256)   installed by install-online.sh and the updater
#   install-online.sh                            the one-line installer
#   <date>-daynivo-kiosk-os-X.Y.Z.img.xz (+ .sha256), built afterwards (30–90+ minutes)
#
# Runner requirements: act_runner with the "ubuntu-latest" label, and for the
# image job `container.privileged: true` in its config (pi-gen needs loop
# devices and binfmt_misc). A secret RELEASE_TOKEN (repository write access)
# is used when set, otherwise the job's own token.
name: Release

on:
  push:
    tags: ["v*"]

env:
  GITEA_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
  GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITEA_TOKEN }}

jobs:
  package:
    runs-on: ubuntu-latest
    container: debian:bookworm
    steps:
      - name: Tools
        run: |
          apt-get update
          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
            ca-certificates curl git python3 python3-flask python3-argon2 python3-websocket python3-pytest shellcheck
      - name: Checkout
        # Plain git: JavaScript actions need Node, which debian:bookworm doesn't have.
        run: git clone --depth 1 --branch "${{ github.ref_name }}" "${{ github.server_url }}/${{ github.repository }}.git" src
      - name: Tag matches VERSION
        working-directory: src
        run: test "v$(tr -d '[:space:]' < VERSION)" = "${{ github.ref_name }}"
      - name: Tests
        working-directory: src
        run: |
          python3 -m pytest -q -p no:cacheprovider
          shellcheck -S warning install.sh install-online.sh update.sh uninstall.sh tools/release-upload.sh image/build.sh
      - name: Package
        working-directory: src
        run: |
          V="$(tr -d '[:space:]' < VERSION)"
          mkdir -p ../dist
          git archive --prefix="daynivo-kiosk-os-$V/" -o "../dist/daynivo-kiosk-os-$V.tar.gz" HEAD
          (cd ../dist && sha256sum "daynivo-kiosk-os-$V.tar.gz" > "daynivo-kiosk-os-$V.tar.gz.sha256")
          cp install-online.sh ../dist/
      - name: Publish
        run: src/tools/release-upload.sh "${{ github.ref_name }}" dist/*

  image:
    needs: package
    runs-on: ubuntu-latest
    container:
      image: debian:bookworm
      options: --privileged
    timeout-minutes: 360
    steps:
      - name: Tools (pi-gen)
        run: |
          apt-get update
          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
            ca-certificates curl git python3 openssl coreutils quilt parted qemu-user-static binfmt-support \
            debootstrap zerofree zip dosfstools libarchive-tools libcap2-bin grep rsync xz-utils file bc gpg \
            pigz xxd arch-test bmap-tools kmod fdisk udev
      - name: Enable ARM emulation
        run: |
          mountpoint -q /proc/sys/fs/binfmt_misc || mount -t binfmt_misc binfmt_misc /proc/sys/fs/binfmt_misc
          update-binfmts --enable qemu-arm
      - name: Checkout
        run: git clone --depth 1 --branch "${{ github.ref_name }}" "${{ github.server_url }}/${{ github.repository }}.git" src
      - name: Build image
        working-directory: src
        run: ./image/build.sh --native
      - name: Publish
        run: src/tools/release-upload.sh "${{ github.ref_name }}" src/image/deploy/*.img.xz src/image/deploy/*.img.xz.sha256