name: Build and deploy StartOS package

on:
  push:
    branches:
      - main
    tags:
      - 'v*.*.*_*'
  workflow_dispatch:
    inputs:
      deploy:
        description: Install the built package on StartOS
        required: false
        default: false
        type: boolean

permissions:
  contents: read

jobs:
  build:
    runs-on: startos-build

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - name: Install StartOS packaging tools
        run: |
          set -euo pipefail

          if ! command -v mksquashfs >/dev/null; then
            if ! command -v apt-get >/dev/null; then
              echo "Cannot install mksquashfs: this runner does not provide apt-get." >&2
              exit 1
            fi

            if [ "$(id -u)" -eq 0 ]; then
              apt-get -o APT::Sandbox::User=root update
              apt-get -o APT::Sandbox::User=root install --yes squashfs-tools
            elif command -v sudo >/dev/null; then
              sudo apt-get -o APT::Sandbox::User=root update
              sudo apt-get -o APT::Sandbox::User=root install --yes squashfs-tools
            else
              echo "Cannot install mksquashfs: root access or sudo is required." >&2
              exit 1
            fi
          fi

          if ! command -v start-cli >/dev/null; then
            curl --fail --silent --show-error --location \
              https://start9.com/start-cli/install.sh \
              | sh
          fi

          echo "${HOME}/.local/bin" >> "${GITHUB_PATH}"

      - name: Verify runner prerequisites
        run: |
          set -euo pipefail

          for command in docker make mksquashfs npm start-cli; do
            command -v "${command}" >/dev/null || {
              echo "Missing runner prerequisite: ${command}" >&2
              exit 1
            }
          done

          docker info >/dev/null

      - name: Restore package signing key
        env:
          S9PK_BUILD_KEY_BASE64: ${{ secrets.S9PK_BUILD_KEY_BASE64 }}
        run: |
          set -euo pipefail

          : "${S9PK_BUILD_KEY_BASE64:?S9PK_BUILD_KEY_BASE64 is required}"

          workspace_dir="$(dirname "${GITHUB_WORKSPACE}")"
          install -d -m 700 "${workspace_dir}/.startos"
          printf '%s' "${S9PK_BUILD_KEY_BASE64}" \
            | base64 --decode \
            > "${workspace_dir}/.startos/build.key.pem"
          chmod 600 "${workspace_dir}/.startos/build.key.pem"

      - name: Install dependencies
        run: npm ci

      - name: Validate release tag
        if: startsWith(github.ref, 'refs/tags/')
        run: ./scripts/check-release-version.sh "${GITHUB_REF_NAME}"

      - name: Build x86_64 package
        run: make x86

      - name: Verify package manifest
        run: |
          set -euo pipefail

          test -s todo-back_x86_64.s9pk
          start-cli s9pk inspect todo-back_x86_64.s9pk manifest
          sha256sum todo-back_x86_64.s9pk

      # Gitea currently works most consistently with the v3 artifact protocol.
      - name: Upload workflow artifact
        uses: actions/upload-artifact@v3
        with:
          name: todo-back-x86_64-${{ github.sha }}
          path: todo-back_x86_64.s9pk
          if-no-files-found: error
          retention-days: 14

      - name: Install release on StartOS
        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.deploy == 'true'
        env:
          STARTOS_HOST: ${{ secrets.STARTOS_HOST }}
        run: |
          set -euo pipefail

          : "${STARTOS_HOST:?STARTOS_HOST is required}"
          start-cli \
            --host "${STARTOS_HOST}" \
            package install \
            --sideload todo-back_x86_64.s9pk