build.yml

name: Build and Release

on:
  push:
    branches: ["main"]
  workflow_dispatch:

permissions:
  contents: write
  pages: write
  id-token: write
  packages: read

env:
  XBPS_ALLOW_RESTRICTED: yes
  XBPS_ALLOW_CHROOT_BREAKOUT: yes

jobs:
  check-changes:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
      should_run: ${{ steps.set-matrix.outputs.should_run }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Determine Systems to Build
        id: set-matrix
        env:
          BEFORE_SHA: ${{ github.event.before }}
        run: |
          chmod +x vup/scripts/check_changes.py
          python3 vup/scripts/check_changes.py

  build:
    needs: check-changes
    if: needs.check-changes.outputs.should_run == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    container:
      image: ghcr.io/vup-linux/vup-builder:latest
      options: --privileged
    strategy:
      matrix:
        include: ${{ fromJson(needs.check-changes.outputs.matrix).include }}
      fail-fast: false
    concurrency:
      group: vup-build-${{ matrix.category }}-${{ matrix.arch }}
      cancel-in-progress: true
    steps:
      - name: Checkout VUP
        uses: actions/checkout@v7
        with:
          path: vup
          fetch-depth: 0

      - name: Checkout void-packages
        uses: actions/checkout@v7
        with:
          repository: void-linux/void-packages
          path: void-packages

      - name: Cache xbps-src bootstrap & ccache
        id: cache-xbps
        uses: actions/cache@v6
        with:
          path: |
            void-packages/masterdir-*
            void-packages/hostdir/repocache
            void-packages/hostdir/ccache
          key: xbps-cache-${{ runner.os }}-${{ hashFiles('void-packages/srcpkgs/base-chroot/template') }}
          restore-keys: |
            xbps-cache-${{ runner.os }}-

      - name: Setup xbps-src
        run: |
          cd void-packages
          cp ../vup/vup/xbps-src .
          mkdir -p srcpkgs/core/xbps-triggers
          cp -r ../vup/vup/srcpkgs/core/xbps-triggers/* srcpkgs/core/xbps-triggers/
          chmod +x xbps-src
          echo "XBPS_ALLOW_RESTRICTED=yes" >> etc/conf
          echo "XBPS_CCACHE=yes" >> etc/conf
          mkdir -p hostdir/ccache

      - name: Binary Bootstrap
        if: steps.cache-xbps.outputs.cache-hit != 'true'
        run: |
          cd void-packages
          ./xbps-src binary-bootstrap

      - name: Build Packages (Buffered)
        env:
          CATEGORY: ${{ matrix.category }}
          ARCH: ${{ matrix.arch }}
          PACKAGES: ${{ matrix.packages }}
        run: |
          cd void-packages
          python3 ../vup/vup/scripts/build_runner.py

      - name: Prepare Artifacts
        run: |
          mkdir -p dist-out
          if [ -d "void-packages/dist" ]; then
             cp -r void-packages/dist/* dist-out/
          fi
          mkdir -p logs-out
          cp void-packages/report-${{ matrix.category }}-${{ matrix.arch }}.json logs-out/
          cp void-packages/build-logs/*.log logs-out/

      - name: Upload Binpkgs
        uses: actions/upload-artifact@v7
        with:
          name: binpkgs-${{ matrix.category }}-${{ matrix.arch }}
          path: dist-out
          if-no-files-found: ignore
          retention-days: 1

      - name: Upload Build Logs
        uses: actions/upload-artifact@v7
        with:
          name: build-logs-${{ matrix.category }}-${{ matrix.arch }}
          path: logs-out
          if-no-files-found: ignore
          retention-days: 1

  release:
    needs: [check-changes, build]
    if: needs.check-changes.outputs.should_run == 'true' && always() && needs.build.result == 'success'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    strategy:
      matrix:
        include: ${{ fromJson(needs.check-changes.outputs.matrix).include }}
      fail-fast: false
    concurrency:
      group: vup-release-${{ matrix.category }}-${{ matrix.arch }}
      cancel-in-progress: false

    steps:
      - name: Set up QEMU
        if: matrix.arch != 'x86_64'
        uses: docker/setup-qemu-action@v4
        with:
          cache-image: false

      - name: Checkout VUP
        uses: actions/checkout@v7
        with:
          path: vup

      - name: Prepare Workspace
        run: mkdir -p work/dist

      - name: Download Old Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          CATEGORY: ${{ matrix.category }}
          ARCH: ${{ matrix.arch }}
        run: |
          cd work
          python3 ../vup/vup/scripts/manage_release.py download || true

      - name: Download New Binpkgs
        uses: actions/download-artifact@v8
        with:
          name: binpkgs-${{ matrix.category }}-${{ matrix.arch }}
          path: work/dist

      - name: Prune Old Packages
        env:
          CATEGORY: ${{ matrix.category }}
          ARCH: ${{ matrix.arch }}
        run: |
          cd work
          rm -f dist/*-repodata*
          python3 ../vup/vup/scripts/manage_release.py prune

      - name: Sign and Index
        env:
          XBPS_PRIVATE_KEY: ${{ secrets.XBPS_PRIVATE_KEY }}
        run: |
          # Map arch to docker platform
          case "${{ matrix.arch }}" in
            x86_64)  PLATFORM="linux/amd64" ;;
            aarch64) PLATFORM="linux/arm64" ;;
            armv7l)  PLATFORM="linux/arm/v7" ;;
            *)       PLATFORM="linux/amd64" ;;
          esac

          # Write key if present
          [ -n "$XBPS_PRIVATE_KEY" ] && echo "$XBPS_PRIVATE_KEY" > work/privkey.pem

          docker run --rm --platform "$PLATFORM" \
            -v "$PWD/work/dist:/dist" \
            ${XBPS_PRIVATE_KEY:+-v "$PWD/work/privkey.pem:/privkey.pem:ro"} \
            ghcr.io/void-linux/void-glibc:latest sh -c '
              cd /dist
              # Remove old signatures - they will be regenerated
              rm -f *.sig *.sig2
              [ -f /privkey.pem ] && for p in *.xbps; do
                [ -e "$p" ] && xbps-rindex --sign-pkg --privkey /privkey.pem "$p"
              done
              xbps-rindex -a *.xbps
              [ -f /privkey.pem ] && xbps-rindex --sign --privkey /privkey.pem --signedby "VUP Builder" .
              ls -la *-repodata* 2>/dev/null || echo "No repodata!"
            '

          rm -f work/privkey.pem

      - name: Clean Remote Assets
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          CATEGORY: ${{ matrix.category }}
          ARCH: ${{ matrix.arch }}
        run: |
          cd work
          python3 ../vup/vup/scripts/manage_release.py clean_remote

      - name: Upload Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ matrix.category }}-${{ matrix.arch }}-current
          files: work/dist/*
          fail_on_unmatched_files: true

  report-status:
    needs: [build, release]
    if: always() && needs.build.result != 'skipped'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Download Reports
        uses: actions/download-artifact@v8
        with:
          pattern: build-logs-*
          path: reports
          merge-multiple: true

      - name: Generate Summary
        id: summary
        run: |
          echo "# Build Summary" >> $GITHUB_STEP_SUMMARY
          python3 vup/scripts/generate_summary.py reports >> $GITHUB_STEP_SUMMARY

  deploy-index:
    needs: [check-changes, release]
    if: needs.check-changes.outputs.should_run == 'true' && always() && needs.release.result == 'success'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    concurrency:
      group: vup-deploy-index
      cancel-in-progress: false
    steps:
      - name: Checkout VUP
        uses: actions/checkout@v7

      - name: Generate Global Index
        run: |
          python3 vup/scripts/generate_index.py

      - name: Upload Pages Artifact
        uses: actions/upload-pages-artifact@v5
        with:
          path: public

      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v5

  notify-web:
    needs: deploy-index
    if: needs.deploy-index.result == 'success'
    runs-on: ubuntu-latest
    steps:
      - name: Trigger vup-web sync
        env:
          VUP_WEBHOOK_SECRET: ${{ secrets.VUP_WEBHOOK_SECRET }}
        run: |
          if [ -z "$VUP_WEBHOOK_SECRET" ]; then
            echo "VUP_WEBHOOK_SECRET not set; skipping notify."
            exit 0
          fi
          # Give GH Pages CDN a moment to publish the new index.json
          sleep 30
          curl -fsSL --retry 5 --retry-delay 15 --max-time 600 \
            -X POST https://voiduserpackages.org/api/sync \
            -H "Content-Type: application/json" \
            -H "X-Webhook-Secret: $VUP_WEBHOOK_SECRET" \
            -d '{"action":"sync"}'