publish.yml

# SPDX-FileCopyrightText: 2026 Travis Lyons
# SPDX-License-Identifier: MIT

name: Publish main

on:
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: publish-main
  cancel-in-progress: true

jobs:
  plan:
    name: Plan
    # A force push rewrites history, so the pushed diff describes nothing that
    # was reviewed and github.event.before may not even be reachable. Skipping
    # plan skips build and publish with it; recover with an ordinary push.
    if: ${{ !github.event.forced && !github.event.deleted }}
    runs-on: ubuntu-latest
    outputs:
      packages: ${{ steps.plan.outputs.packages }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      # full-rebuild-paths is deliberately unset and require-base deliberately
      # set: both defaults widen the selection to every package, which here
      # would rebuild already published filenames and trip the immutability
      # guard below. Full-matrix validation is the pull request pipeline's job.
      - id: plan
        uses: ./.github/actions/discover-packages
        with:
          base-sha: ${{ github.event.before }}
          head-sha: ${{ github.sha }}
          require-base: 'true'

      - name: Confirm main is current
        env:
          GITHUB_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          set -euo pipefail

          head_sha=$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/heads/main" --jq .object.sha)
          if [[ "$head_sha" != "$GITHUB_SHA" ]]; then
            echo "Refusing to publish superseded commit $GITHUB_SHA; main is at $head_sha" >&2
            exit 1
          fi

  build:
    name: Build (${{ matrix.package }})
    needs: plan
    if: needs.plan.outputs.packages != '[]'
    strategy:
      fail-fast: false
      max-parallel: 4
      matrix:
        package: ${{ fromJSON(needs.plan.outputs.packages) }}
    runs-on: ubuntu-latest
    container:
      image: archlinux:base-devel@sha256:ee205c220399524a683cf495d411691b921baed8ab47cdc6d732efa782fae484
      options: --privileged
    steps:
      - name: Install tools
        shell: bash
        run: |
          pacman -Syu --noconfirm --needed devtools git namcap python sudo
          systemd-machine-id-setup
          printf '%s\n' '#!/bin/bash' 'exec /usr/bin/systemd-nspawn --keep-unit "$@"' > /usr/local/bin/systemd-nspawn
          chmod 0755 /usr/local/bin/systemd-nspawn

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Configure build user
        shell: bash
        run: |
          useradd --create-home builder
          printf 'builder ALL=(ALL) NOPASSWD: ALL\n' > /etc/sudoers.d/builder
          chmod 0440 /etc/sudoers.d/builder
          chown -R builder:builder "$GITHUB_WORKSPACE"

      - name: Check package metadata
        env:
          PACKAGE: ${{ matrix.package }}
        shell: bash
        run: |
          set -euo pipefail
          cd "$GITHUB_WORKSPACE/$PACKAGE"
          namcap PKGBUILD
          sudo --user=builder --set-home bash -c 'makepkg --printsrcinfo > .SRCINFO.generated'
          diff --unified .SRCINFO .SRCINFO.generated
          rm .SRCINFO.generated

      - name: Build package
        env:
          PACKAGE: ${{ matrix.package }}
        run: |
          sudo --user=builder --set-home "$GITHUB_WORKSPACE/build.sh" "$PACKAGE"

      - name: Validate package archive
        env:
          PACKAGE: ${{ matrix.package }}
        shell: bash
        run: |
          set -euo pipefail
          mapfile -t archives < <(find "$GITHUB_WORKSPACE/$PACKAGE" -type f -name '*.pkg.tar.zst' -print)
          if (( ${#archives[@]} == 0 )); then
            echo 'No package archives were built' >&2
            exit 1
          fi
          namcap "${archives[@]}"

      - name: Upload package archive
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: package-${{ matrix.package }}
          path: ${{ matrix.package }}/*.pkg.tar.zst
          if-no-files-found: error
          retention-days: 1

  publish:
    name: Publish (${{ matrix.package }})
    needs: [plan, build]
    if: needs.plan.outputs.packages != '[]'
    strategy:
      fail-fast: false
      max-parallel: 4
      matrix:
        package: ${{ fromJSON(needs.plan.outputs.packages) }}
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
    environment: packages.trly.dev
    steps:
      - name: Download package archive
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: package-${{ matrix.package }}
          path: ${{ runner.temp }}/packages/${{ matrix.package }}

      - name: Install pkgdepot
        env:
          PKGDEPOT_VERSION: 0.2.1
          PKGDEPOT_SHA256: 441ff17351e6ab06c1e59b07353976080d570bb5359cdc3a76ea1f81dd13d7eb
        shell: bash
        run: |
          set -euo pipefail

          archive="pkgdepot_${PKGDEPOT_VERSION}_linux_amd64.tar.gz"
          curl --fail --location --remote-name \
            "https://github.com/trly/pkgdepot/releases/download/v${PKGDEPOT_VERSION}/${archive}"
          printf '%s  %s\n' "$PKGDEPOT_SHA256" "$archive" | sha256sum --check
          install_dir="$RUNNER_TEMP/pkgdepot/bin"
          install --directory "$install_dir"
          tar --extract --gzip --file "$archive" --directory "$install_dir" pkgdepot
          printf '%s\n' "$install_dir" >> "$GITHUB_PATH"

      # Re-checked here, not just in plan: the build runs between the two jobs,
      # so the plan-time check no longer covers the moment of the write.
      - name: Confirm main is current
        env:
          GITHUB_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          set -euo pipefail

          head_sha=$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/heads/main" --jq .object.sha)
          if [[ "$head_sha" != "$GITHUB_SHA" ]]; then
            echo "Refusing to publish superseded commit $GITHUB_SHA; main is at $head_sha" >&2
            exit 1
          fi

      - name: Publish package archives
        env:
          PKGDEPOT_URL: https://packages.trly.dev
          PKGDEPOT_OAUTH_ISSUER: https://id.trly.dev
          PKGDEPOT_OAUTH_CLIENT_ID: ${{ secrets.PKGDEPOT_OAUTH_CLIENT_ID }}
          PKGDEPOT_OAUTH_CLIENT_SECRET: ${{ secrets.PKGDEPOT_OAUTH_CLIENT_SECRET }}
        shell: bash
        run: |
          set -euo pipefail

          mapfile -t archives < <(find "$RUNNER_TEMP/packages" -type f -name '*.pkg.tar.zst' -print | sort)
          if (( ${#archives[@]} == 0 )); then
            echo 'No package archives were downloaded' >&2
            exit 1
          fi

          declare -A published_filenames=()
          while IFS= read -r filename; do
            published_filenames["$filename"]=1
          done < <(pkgdepot package list stable | jq -r '.[].filename')

          for archive in "${archives[@]}"; do
            filename=$(basename "$archive")
            if [[ ${published_filenames["$filename"]+present} ]]; then
              echo "Refusing to overwrite published package $filename" >&2
              exit 1
            fi
            pkgdepot package publish stable "$archive"
          done