build-deb-v4.yml

name: Debian Package Builder v4

on:
  workflow_dispatch:

concurrency:
  group: debian_builder_v4
  cancel-in-progress: true

jobs:
  build:
    runs-on: ${{ matrix.host-os }}
    strategy:
      matrix:
        stage: [experimental, unstable, testing ] # release-3_1, release-3_0, release-2_2, release-2_1]
        distro-codename: [
          ubuntu-focal-amd64, 
          ubuntu-focal-arm64, 
          ubuntu-jammy-amd64, 
          ubuntu-jammy-arm64, 
          ubuntu-noble-amd64,
          ubuntu-noble-arm64,
          debian-bullseye-amd64,
          debian-bullseye-arm64,
          debian-bookworm-amd64,
          debian-bookworm-arm64,
          debian-testing-amd64,
          debian-testing-arm64  
        ]
        exclude:
          - stage: release-3_1
            distro-codename: debian-testing-amd64 # debian testing is never released
          - stage: release-3_1
            distro-codename: debian-testing-arm64 # debian testing is never released
          - stage: release-3_1
            distro-codename: ubuntu-noble-arm64   # enable w/ 3.2
          - stage: release-3_1
            distro-codename: ubuntu-noble-amd64          
        include:
          - distro-codename: ubuntu-focal-amd64
            host-os: ubuntu-20.04
            arch: amd64
            distro: ubuntu
            codename: focal
          - distro-codename: ubuntu-focal-arm64
            host-os: [self-hosted, Linux, arm64, focal]
            arch: arm64
            distro: ubuntu
            codename: focal
          - distro-codename: ubuntu-jammy-amd64
            host-os: ubuntu-22.04
            arch: amd64
            distro: ubuntu
            codename: jammy
          - distro-codename: ubuntu-jammy-arm64
            host-os: [self-hosted, Linux, arm64, jammy]
            arch: arm64
            distro: ubuntu
            codename: jammy
          - distro-codename: ubuntu-noble-amd64
            host-os: [self-hosted, Linux, X64, noble]
            arch: amd64
            distro: ubuntu
            codename: noble
          - distro-codename: ubuntu-noble-arm64
            host-os: [self-hosted, Linux, arm64, noble]
            arch: arm64
            distro: ubuntu
            codename: noble
          - distro-codename: debian-bullseye-amd64
            host-os: [self-hosted, Linux, X64, bullseye]
            arch: amd64
            distro: debian
            codename: bullseye
          - distro-codename: debian-bullseye-arm64
            host-os: [self-hosted, Linux, arm64, bullseye]
            arch: arm64
            distro: debian
            codename: bullseye
          - distro-codename: debian-bookworm-amd64
            host-os: [self-hosted, Linux, X64, bookworm]
            arch: amd64
            distro: debian
            codename: bookworm
          - distro-codename: debian-bookworm-arm64
            host-os: [self-hosted, Linux, arm64, bookworm]
            arch: arm64
            distro: debian
            codename: bookworm
          - distro-codename: debian-testing-amd64
            host-os: [self-hosted, Linux, X64, testing]
            arch: amd64
            distro: debian
            codename: testing
          - distro-codename: debian-testing-arm64
            host-os: [self-hosted, Linux, arm64, testing]
            arch: arm64
            distro: debian
            codename: testing

    steps:
      - uses: actions/checkout@v4
      - name: Set Job Parameters
        id: init
        run: |
          echo "SIGNING_KEY_ID=C91ECAB862037F9474087DBC7107DED133505B88" >> $GITHUB_OUTPUT
          echo "MANIFEST_PATH=${{ github.workspace }}/manifests" >> $GITHUB_OUTPUT
          echo "PKG_REPO_PATH=${{ github.workspace }}/repo" >> $GITHUB_OUTPUT
          echo "PKG_BUILD_DIR=${{ github.workspace }}/packages" >> $GITHUB_OUTPUT
          echo "GH_REPO_ROOT=${{ github.workspace }}" >> $GITHUB_OUTPUT
          echo "stage=${{ matrix.stage }}" >> $GITHUB_OUTPUT
          echo "distro=${{ matrix.distro }}" >> $GITHUB_OUTPUT
          echo "codename=${{ matrix.codename }}" >> $GITHUB_OUTPUT
          echo "arch=${{ matrix.arch }}" >> $GITHUB_OUTPUT
          echo "target=${{ matrix.stage }}-${{ matrix.distro }}-${{ matrix.codename }}-${{ matrix.arch }}" >> $GITHUB_OUTPUT
          echo "repo_url=https://regolith-desktop.org/${{ matrix.stage }}-${{ matrix.distro }}-${{ matrix.codename }}-${{ matrix.arch }}" >> $GITHUB_OUTPUT
      - name: Env setup
        run: |
          set -e
          mkdir ${{ steps.init.outputs.MANIFEST_PATH }} || true
          mkdir ${{ steps.init.outputs.PKG_BUILD_DIR }} || true

          # Following allows for internal dependencies
          # FIXME(kgilmer): extract following logic to distro specific script
          rm /tmp/manifest.txt || true
          wget -P /tmp "https://regolith-desktop.org/${{ steps.init.outputs.target }}/manifest.txt" || true

          if [ -f /tmp/manifest.txt ]; then
            echo "Adding repo to apt: ${{ steps.init.outputs.target }}"
            rm /tmp/manifest.txt
            wget -qO - https://regolith-desktop.org/regolith3.key | sudo apt-key add -
            echo deb "[arch=${{ steps.init.outputs.arch }}] ${{ steps.init.outputs.repo_url }} ${{ steps.init.outputs.codename }} main" | sudo tee /etc/apt/sources.list.d/regolith.list
          fi

          if [ -f "/etc/apt/sources.list.d/regolith-local.list" ]; then
            sudo rm /etc/apt/sources.list.d/regolith-local.list
            echo "Cleaned up temp apt repo"
          fi
          
          sudo apt update
          DEBIAN_FRONTEND=noninteractive sudo apt install -y --no-install-recommends jq git devscripts reprepro wget dput
      - name: Pull Manifest
        run: |
          set -e
          wget -P "${{ steps.init.outputs.PKG_REPO_PATH }}" "https://regolith-desktop.org/${{ steps.init.outputs.target }}/manifest.txt" || true
          echo "Previous manifest:"
          cat ${{ steps.init.outputs.PKG_REPO_PATH }}/manifest.txt || true
      - name: Check for changes
        id: changes
        run: |
          set -e
          set -x
          CHANGE_OUTPUT=$(${{ steps.init.outputs.GH_REPO_ROOT }}/.github/scripts/main.sh \
            ${{ steps.init.outputs.GH_REPO_ROOT }} \
            ${{ steps.init.outputs.GH_REPO_ROOT }}/.github/scripts/ext-debian.sh \
            "${{ steps.init.outputs.stage }}" \
            "${{ steps.init.outputs.distro }}" \
            "${{ steps.init.outputs.codename }}" \
            "${{ steps.init.outputs.arch }}" \
            "unneeded to check change" \
            "unneeded to check change" \
            check \
            ${{ steps.init.outputs.MANIFEST_PATH }} \
            ${{ steps.init.outputs.PKG_REPO_PATH }} \
            ${{ steps.init.outputs.PKG_BUILD_DIR }} | tail -n1)
          if [ "$CHANGE_OUTPUT" == "No package changes found, exiting." ]; then
            echo "changed=0" >> $GITHUB_OUTPUT
            echo "No package changes to build"
          else
            echo "changed=1" >> $GITHUB_OUTPUT
            echo "New Manifest: "
            cat ${{ steps.init.outputs.MANIFEST_PATH }}/next-manifest.txt
          fi
      - uses: webfactory/ssh-agent@v0.9.0
        if: steps.changes.outputs.changed == 1
        with:
          ssh-private-key: ${{ secrets.KAMATERA_SSH_KEY }}
      - name: Pull repo
        if: steps.changes.outputs.changed == 1
        run: |
          set -e
          set -x
          ssh-keyscan -H ${{ secrets.KAMATERA_HOSTNAME }} >> ~/.ssh/known_hosts
          scp -r root@${{ secrets.KAMATERA_HOSTNAME }}:/var/www/html/${{ steps.init.outputs.target }}/* "${{ steps.init.outputs.PKG_REPO_PATH }}" || true
          if [ ! -d ${{ steps.init.outputs.PKG_REPO_PATH }} ]; then
            mkdir -p "${{ steps.init.outputs.PKG_REPO_PATH }}"
          fi
      - name: Build
        if: steps.changes.outputs.changed == 1
        run: |
          set -e
          export DEBEMAIL="regolith.linux@gmail.com"
          export DEBFULLNAME="Regolith Linux"
          export DEBIAN_FRONTEND=noninteractive
          mkdir -p ~/.gnupg/
          printf "${{ secrets.PACKAGE_PRIVATE_KEY2 }}" | base64 --decode > ~/.gnupg/private.key
          gpg --batch --import ~/.gnupg/private.key
          ${{ steps.init.outputs.GH_REPO_ROOT }}/.github/scripts/main.sh \
            ${{ steps.init.outputs.GH_REPO_ROOT }} \
            ${{ steps.init.outputs.GH_REPO_ROOT }}/.github/scripts/ext-debian.sh \
            "${{ steps.init.outputs.stage }}" \
            "${{ steps.init.outputs.distro }}" \
            "${{ steps.init.outputs.codename }}" \
            "${{ steps.init.outputs.arch }}" \
            "${{ steps.init.outputs.repo_url }}" \
            "${{ steps.init.outputs.SIGNING_KEY_ID }}" \
            build \
            ${{ steps.init.outputs.MANIFEST_PATH }} \
            ${{ steps.init.outputs.PKG_REPO_PATH }} \
            ${{ steps.init.outputs.PKG_BUILD_DIR }} | tee -a ${{ steps.init.outputs.GH_REPO_ROOT }}/CHANGELOG_${{ steps.init.outputs.target }}.raw.txt
          if [ -f ${{ steps.init.outputs.MANIFEST_PATH }}/next-manifest.txt ]; then
            echo "Temp manifest not deleted by main.sh, build aborted/failed."
            echo "changed=0" >> $GITHUB_OUTPUT
            exit 1
          else
            cat ${{ steps.init.outputs.GH_REPO_ROOT }}/CHANGELOG_${{ steps.init.outputs.target }}.raw.txt | grep ^CHLOG: | cut -c 7- > ${{ steps.init.outputs.GH_REPO_ROOT }}/CHANGELOG_${{ steps.init.outputs.target }}.txt
          fi
      - name: Deploy via rsync
        if: steps.changes.outputs.changed == 1
        run: |
          set -e
          set -x
          for i in 1 2 3 4 5; do echo "Attempt $i" && rsync -avzh ${{ steps.init.outputs.PKG_REPO_PATH }}/* root@${{ secrets.KAMATERA_HOSTNAME }}:/var/www/html/${{ steps.init.outputs.target }} && break || sleep 5; done          
      - name: Log Build Output
        if: steps.changes.outputs.changed == 1
        run: |
          cat ${{ steps.init.outputs.PKG_REPO_PATH }}/manifest.txt || true
          echo "PKG_BUILD_DIR:"
          find ${{ steps.init.outputs.PKG_BUILD_DIR }}
      - name: Cleanup
        run: |
          # FIXME(kgilmer) extract following logic to distro-specific script
          # Remove regolith repo from build system apt config
          if [ -f /etc/apt/sources.list.d/regolith.list ]; then
            sudo rm -f /etc/apt/sources.list.d/regolith.list
          fi
      - uses: actions/upload-artifact@v4
        if: steps.changes.outputs.changed == 1
        with:
          name: CHANGELOG_${{ steps.init.outputs.target }}
          path: |
            ${{ steps.init.outputs.GH_REPO_ROOT }}/CHANGELOG_${{ steps.init.outputs.target }}.txt

  test:
    needs: build
    uses: ./.github/workflows/test-desktop-installable2.yml

  generate-release:
    needs: build
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/download-artifact@v4
      - name: Concat Release Notes
        id: release-setup
        run: |
          set -e
          echo "TIMESTAMP=$(date +%Y%m%d_%H%M%S)" >> $GITHUB_OUTPUT
          FILES=$(find . -name CHANGELOG\*)
          if [ -n "$FILES" ]; then
            cat CHANGELOG_*/CHANGELOG_*.txt >> CHANGELOG.txt
            echo "changed=1" >> $GITHUB_OUTPUT
          else
            echo "changed=0" >> $GITHUB_OUTPUT
          fi
      - uses: softprops/action-gh-release@v2
        if: steps.release-setup.outputs.changed == 1
        with:
          body: See CHANGELOG.txt for updates and manifests for current state of repos.
          name: Package Build ${{ steps.release-setup.outputs.TIMESTAMP }}
          tag_name: pkgbuild-${{ steps.release-setup.outputs.TIMESTAMP }}
          files: |
            *.txt