cd-deploy-aur.yml

name: 'CD: AUR Update'
run-name: "AUR update (${{ inputs.channel || 'stable' }}) — ${{ github.event.release.tag_name || inputs.tag || 'latest' }}"

on:
  release:
    types: [released]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag (stable: v02.07.00.55-bj.1 / nightly: nightly-20260531-abc1234)'
        required: false
        type: string
      channel:
        description: 'AUR package to update'
        required: false
        type: choice
        default: stable
        options: [stable, nightly]
  workflow_call:
    inputs:
      tag:
        description: 'Release tag'
        required: true
        type: string
      channel:
        description: 'AUR channel: stable or nightly'
        required: false
        type: string
        default: stable

permissions: read-all

concurrency:
  group: cd-deploy-aur-${{ inputs.channel || 'stable' }}
  cancel-in-progress: false

jobs:
  aur-update:
    name: Update AUR PKGBUILD (${{ inputs.channel || 'stable' }})
    runs-on: ubuntu-24.04
    timeout-minutes: 15

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
        with:
          egress-policy: audit

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - name: Determine tag, channel, pkgname, pkgver
        id: meta
        run: |
          set -euo pipefail

          # release event → always stable
          if [[ "${{ github.event_name }}" == "release" ]]; then
            TAG="${{ github.event.release.tag_name }}"
            CHANNEL="stable"
          elif [[ -n "${{ inputs.tag }}" ]]; then
            TAG="${{ inputs.tag }}"
            CHANNEL="${{ inputs.channel || 'stable' }}"
          else
            echo "::error::No tag provided for non-release trigger"
            exit 1
          fi

          if [[ "$CHANNEL" == "nightly" ]]; then
            PKGNAME="bambu-studio-nightly-bin"
            # nightly tag: nightly-YYYYMMDD-sha7  →  pkgver: YYYYMMDD.sha7
            DATE_PART=$(echo "$TAG" | cut -d- -f2)
            SHA_PART=$(echo "$TAG"  | cut -d- -f3)
            PKGVER="${DATE_PART}.${SHA_PART}"
          else
            PKGNAME="bambu-studio-bin"
            VERSION="${TAG#v}"
            PKGVER="${VERSION//-/.}"  # no hyphens in AUR pkgver
          fi

          echo "tag=$TAG"         >> "$GITHUB_OUTPUT"
          echo "channel=$CHANNEL" >> "$GITHUB_OUTPUT"
          echo "pkgname=$PKGNAME" >> "$GITHUB_OUTPUT"
          echo "pkgver=$PKGVER"   >> "$GITHUB_OUTPUT"
          echo "Tag: $TAG  Channel: $CHANNEL  pkgname: $PKGNAME  pkgver: $PKGVER"

      - name: Get AppImage URL and SHA256
        id: asset
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          TAG="${{ steps.meta.outputs.tag }}"

          # Find Ubuntu 24.04 AppImage (GitHub-hosted, not self-hosted).
          # Release assets can lag behind the publish job (GitHub eventual
          # consistency), so retry a few times before giving up.
          URL=""
          for attempt in 1 2 3 4 5 6; do
            URL=$(gh release view "$TAG" --repo "${{ github.repository }}" --json assets \
              --jq '[.assets[]
                | select(
                    (.name | test("^BambuStudio_ubuntu-24\\.04_amd64_.*\\.AppImage$"; "i")) and
                    (.name | test("_selfhosted\\.AppImage$"; "i") | not)
                  )] | .[0].url // ""')
            [[ -n "$URL" ]] && break
            echo "AppImage asset not visible yet for $TAG (attempt $attempt/6) — waiting 20s…"
            sleep 20
          done

          if [[ -z "$URL" ]]; then
            echo "::error::No AppImage asset found for tag $TAG after retries"
            exit 1
          fi

          SHA256=$(curl -fsSL "$URL" | sha256sum | cut -d' ' -f1)
          echo "url=$URL"       >> "$GITHUB_OUTPUT"
          echo "sha256=$SHA256" >> "$GITHUB_OUTPUT"
          echo "AppImage URL: $URL"

      - name: Write PKGBUILD
        run: |
          set -euo pipefail
          PKGNAME="${{ steps.meta.outputs.pkgname }}"
          CHANNEL="${{ steps.meta.outputs.channel }}"

          if [[ "$CHANNEL" == "nightly" ]]; then
            PKGDESC="BambuStudio nightly pre-release builds for Bambu Lab 3D printers"
            # Nightly coexists with stable — no provides/conflicts
            PROVIDES=""
            CONFLICTS=""
          else
            PKGDESC="BambuStudio slicer for Bambu Lab 3D printers"
            PROVIDES="provides=('bambu-studio')"
            CONFLICTS="conflicts=('bambu-studio')"
          fi

          cat > PKGBUILD << PKGBUILD_EOF
          # Maintainer: BenJule <benjamin.luetker@gmail.com>
          pkgname=${PKGNAME}
          pkgver=PKGVER_PLACEHOLDER
          pkgrel=1
          pkgdesc="${PKGDESC}"
          arch=('x86_64')
          url="https://github.com/BenJule/BambuStudio"
          license=('AGPL3')
          ${PROVIDES}
          ${CONFLICTS}
          depends=('gtk3' 'glib2' 'glibc' 'libsecret' 'webkit2gtk')
          source=("BambuStudio.AppImage::URL_PLACEHOLDER")
          sha256sums=('SHA256_PLACEHOLDER')
          package() {
            install -Dm755 "\$srcdir/BambuStudio.AppImage" "\$pkgdir/usr/bin/bambu-studio"
          }
          PKGBUILD_EOF

          sed -i \
            -e "s|PKGVER_PLACEHOLDER|${{ steps.meta.outputs.pkgver }}|g" \
            -e "s|URL_PLACEHOLDER|${{ steps.asset.outputs.url }}|g" \
            -e "s|SHA256_PLACEHOLDER|${{ steps.asset.outputs.sha256 }}|g" \
            PKGBUILD
          # Remove blank provides/conflicts lines for nightly
          sed -i '/^[[:space:]]*$/d' PKGBUILD
          cat PKGBUILD

      - name: Publish to AUR
        uses: KSXGitHub/github-actions-deploy-aur@da03e160361ce01bf087e790b6ffd196d7dccff7  # v4.1.3
        with:
          pkgname: ${{ steps.meta.outputs.pkgname }}
          pkgbuild: ./PKGBUILD
          commit_username: ${{ github.repository_owner }}
          commit_email: ${{ github.repository_owner }}@users.noreply.github.com
          ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
          commit_message: "update to ${{ steps.meta.outputs.tag }}"