matrix_builds.yaml

name: Build Package

permissions:
  attestations: write
  contents: write
  id-token: write
  packages: write

on:
  workflow_call:
    inputs:
      host:
        description: "Target host [aarch64-Linux, x86_64-Linux, riscv64-Linux, ALL]"
        type: string
        default: "ALL"
      sbuild-url:
        description: "Raw URL of SBUILD recipe"
        type: string
        required: true
      ghcr-url:
        description: "GHCR URL for package push"
        type: string
        required: true
      pkg-family:
        description: "Package family name"
        type: string
        required: true
      debug:
        description: "Enable debug mode"
        type: boolean
        default: false
      logs:
        description: "Keep build logs"
        type: boolean
        default: true
      rebuild:
        description: "Force rebuild"
        type: boolean
        default: true
      build-deps:
        description: "Build dependencies to install (comma-separated: nix,docker,go,rust)"
        type: string
        default: ""
      metadata-release:
        description: "Create soar-nest metadata release (for third-party use)"
        type: boolean
        default: true

jobs:
  setup-matrix:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Generate build matrix
        id: set-matrix
        run: |
          case "${{ inputs.host }}" in
             "ALL")
               MATRIX='[
                 {"host": "x86_64-Linux", "runner": "ubuntu-latest"},
                 {"host": "aarch64-Linux", "runner": "ubuntu-24.04-arm"},
                 {"host": "riscv64-Linux", "runner": "ubuntu-latest"}
               ]'
              ;;
            "x86_64-Linux")
              MATRIX='[{"host": "x86_64-Linux", "runner": "ubuntu-latest"}]'
              ;;
            "aarch64-Linux")
              MATRIX='[{"host": "aarch64-Linux", "runner": "ubuntu-24.04-arm"}]'
              ;;
             "riscv64-Linux")
               MATRIX='[{"host": "riscv64-Linux", "runner": "ubuntu-latest"}]'
               ;;
            *)
              echo "::error::Invalid host: ${{ inputs.host }}"
              exit 1
              ;;
          esac
          echo "matrix=$(echo "$MATRIX" | jq -c .)" >> "$GITHUB_OUTPUT"

  build:
    needs: setup-matrix
    strategy:
      fail-fast: false
      matrix:
        target: ${{ fromJson(needs.setup-matrix.outputs.matrix) }}
    name: "${{ matrix.target.host }}"
    runs-on: "${{ matrix.target.runner }}"
    timeout-minutes: 180
    env:
      DEBIAN_FRONTEND: noninteractive
      GIT_TERMINAL_PROMPT: 0
    steps:
      - name: Setup recipe identifier
        run: |
          # Extract recipe identifier from URL for artifact naming
          # e.g., binaries/hello/static.yaml -> hello-static
          RECIPE_PATH=$(echo "${{ inputs.sbuild-url }}" | grep -oE '(binaries|packages)/[^/]+/[^/]+\.yaml' || echo "")
          if [[ -n "$RECIPE_PATH" ]]; then
            PKG_NAME=$(echo "$RECIPE_PATH" | cut -d'/' -f2)
            RECIPE_NAME=$(basename "$RECIPE_PATH" .yaml)
            RECIPE_ID="${PKG_NAME}-${RECIPE_NAME}"
          else
            RECIPE_ID=$(echo -n "${{ inputs.sbuild-url }}" | sha256sum | cut -c1-8)
          fi
          echo "RECIPE_ID=${RECIPE_ID}" >> "$GITHUB_ENV"

      - name: Setup environment
        id: setup
        env:
          GHCR_TOKEN: "${{ github.token }}"
          MINISIGN_KEY: "${{ secrets.MINISIGN_KEY }}"
        run: |
          set -euo pipefail

          # Determine host triplet
          HOST_TRIPLET="${{ matrix.target.host }}"
          echo "HOST_TRIPLET=${HOST_TRIPLET}" >> "$GITHUB_ENV"

          # Temp directory
          SYSTMP="$(mktemp -d)"
          echo "SYSTMP=${SYSTMP}" >> "$GITHUB_ENV"

          # Install base packages
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            ca-certificates curl git jq p7zip-full rsync wget zstd

          # Install oras
          ORAS_VERSION="1.2.2"
          case "$(uname -m)" in
            x86_64)  ORAS_ARCH="amd64" ;;
            aarch64) ORAS_ARCH="arm64" ;;
          esac
          curl -fsSL "https://github.com/oras-project/oras/releases/download/v${ORAS_VERSION}/oras_${ORAS_VERSION}_linux_${ORAS_ARCH}.tar.gz" \
            | sudo tar -xzf - -C /usr/local/bin oras
          oras version

          # Install soar
          SOAR_TRIPLET="$(uname -m)-$(uname -s | tr '[:upper:]' '[:lower:]')"
          curl -fsSL "https://github.com/pkgforge/soar/releases/latest/download/soar-${SOAR_TRIPLET}" \
            -o /tmp/soar && sudo mv /tmp/soar /usr/local/bin/soar && sudo chmod +x /usr/local/bin/soar
          soar --version

          # Install sbuild
          curl -fsSL "https://github.com/pkgforge/sbuilder/releases/download/latest/sbuild-${SOAR_TRIPLET}" \
            -o "${SYSTMP}/sbuild" && chmod +x "${SYSTMP}/sbuild"
          "${SYSTMP}/sbuild" --version

          # Install squishy
          curl -fsSL "https://github.com/pkgforge/squishy-rs/releases/latest/download/squishy-${SOAR_TRIPLET}" \
            -o /tmp/squishy && sudo mv /tmp/squishy /usr/local/bin/squishy && sudo chmod +x /usr/local/bin/squishy
          squishy --version || true

          # Install appimagetool
          curl -fsSL "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-$(uname -m).AppImage" \
            -o /tmp/appimagetool && sudo mv /tmp/appimagetool /usr/local/bin/appimagetool && sudo chmod +x /usr/local/bin/appimagetool
          appimagetool --version || true

          # Setup minisign key if available
          if [[ -n "${MINISIGN_KEY:-}" ]]; then
            mkdir -p "${HOME}/.minisign"
            echo "${{ secrets.MINISIGN_SIGKEY }}" > "${HOME}/.minisign/minisign.key"
            echo "SIGN_ENABLED=true" >> "$GITHUB_ENV"
            # Install minisign
            sudo apt-get install -y -qq minisign
            minisign -v
          fi

          # GHCR login
          echo "${GHCR_TOKEN}" | oras login ghcr.io -u "${{ github.actor }}" --password-stdin

          # Parse GHCR URL
          GHCR_REPO="$(echo "${{ inputs.ghcr-url }}" | sed 's|^ghcr.io/||' | tr '[:upper:]' '[:lower:]')"
          echo "GHCR_REPO=${GHCR_REPO}" >> "$GITHUB_ENV"

      - name: Detect build dependencies
        id: detect-deps
        run: |
          # Fetch recipe content
          RECIPE_CONTENT=$(curl -fsSL "${{ inputs.sbuild-url }}" 2>/dev/null || echo "")

          if [[ -z "$RECIPE_CONTENT" ]]; then
            echo "::warning::Could not fetch recipe, using provided build-deps"
            echo "deps=${{ inputs.build-deps }}" >> $GITHUB_OUTPUT
            exit 0
          fi

          DETECTED_DEPS=""

          # Check for nix (shell: nix-shell, nix-build, or nix commands in script)
          if echo "$RECIPE_CONTENT" | grep -qiE '(shell:\s*nix|nix-build|nix-shell|nix\s+build|nix\s+develop)'; then
            DETECTED_DEPS="${DETECTED_DEPS},nix"
          fi

          # Check for docker
          if echo "$RECIPE_CONTENT" | grep -qiE '(docker\s+build|docker\s+run|dockerfile)'; then
            DETECTED_DEPS="${DETECTED_DEPS},docker"
          fi

          # Check for go
          if echo "$RECIPE_CONTENT" | grep -qiE '(go\s+build|go\s+install|CGO_|go\s+mod)'; then
            DETECTED_DEPS="${DETECTED_DEPS},go"
          fi

          # Check for rust/cargo
          if echo "$RECIPE_CONTENT" | grep -qiE '(cargo\s+build|cargo\s+install|rustc|Cargo\.toml)'; then
            DETECTED_DEPS="${DETECTED_DEPS},rust"
          fi

          # Check for zig
          if echo "$RECIPE_CONTENT" | grep -qiE '(zig\s+build|zig\s+cc)'; then
            DETECTED_DEPS="${DETECTED_DEPS},zig"
          fi

          # Check for python/pip
          if echo "$RECIPE_CONTENT" | grep -qiE '(pip\s+install|python\s+setup\.py|pyproject\.toml)'; then
            DETECTED_DEPS="${DETECTED_DEPS},python"
          fi

          # Always include build-essential for C/C++ builds
          if echo "$RECIPE_CONTENT" | grep -qiE '(make\s|cmake|configure|gcc|g\+\+|clang)'; then
            DETECTED_DEPS="${DETECTED_DEPS},build-essential"
          fi

          # Remove leading comma
          DETECTED_DEPS="${DETECTED_DEPS#,}"

          # Merge with explicitly provided deps (explicit deps take priority)
          if [[ -n "${{ inputs.build-deps }}" ]]; then
            # If explicit deps provided, use those instead
            FINAL_DEPS="${{ inputs.build-deps }}"
          else
            FINAL_DEPS="$DETECTED_DEPS"
          fi

          echo "Detected dependencies: $DETECTED_DEPS"
          echo "Final dependencies: $FINAL_DEPS"
          echo "deps=$FINAL_DEPS" >> $GITHUB_OUTPUT

      - name: Check host compatibility
        if: matrix.target.host != 'riscv64-Linux'
        run: |
          SBUILD="${SYSTMP}/sbuild"

          if ! "$SBUILD" info "${{ inputs.sbuild-url }}" --check-host "${HOST_TRIPLET}"; then
            echo "::warning::Recipe not supported on ${HOST_TRIPLET}"
            echo "SKIP_BUILD=true" >> "$GITHUB_ENV"
          fi

      - name: Create metadata release (soar-nest)
        if: inputs.metadata-release == true
        env:
          GH_TOKEN: "${{ github.token }}"
        run: |
          METADATA_TAG="soar-nest"
          echo "METADATA_TAG=${METADATA_TAG}" >> "$GITHUB_ENV"

          # Create release if it doesn't exist
          if ! gh release view "$METADATA_TAG" --repo "${{ github.repository }}" &>/dev/null; then
            gh release create "$METADATA_TAG" \
              --repo "${{ github.repository }}" \
              --title "$METADATA_TAG" \
              --notes "Metadata release for soar integration" \
              --prerelease
          fi

          METADATA_DIR="/tmp/PKG_METADATA"
          mkdir -p "$METADATA_DIR"
          echo "METADATA_DIR=${METADATA_DIR}" >> "$GITHUB_ENV"
        continue-on-error: true

      - name: Install build dependencies
        if: env.SKIP_BUILD != 'true' && matrix.target.host != 'riscv64-Linux' && steps.detect-deps.outputs.deps != ''
        env:
          GITHUB_TOKEN: "${{ github.token }}"
        run: |
          set -euo pipefail
          BUILD_DEPS="${{ steps.detect-deps.outputs.deps }}"

          # Parse comma-separated deps
          IFS=',' read -ra DEPS <<< "$BUILD_DEPS"

          for dep in "${DEPS[@]}"; do
            dep="$(echo "$dep" | tr -d '[:space:]' | tr '[:upper:]' '[:lower:]')"
            echo "::group::Installing $dep"

            case "$dep" in
              nix)
                # Install Nix using pkgforge devscripts
                if ! command -v nix &>/dev/null; then
                  curl -qfsSL "https://raw.githubusercontent.com/pkgforge/devscripts/refs/heads/main/Linux/install_nix.sh" -o "/tmp/install_nix.sh"
                  chmod +x "/tmp/install_nix.sh"
                  bash "/tmp/install_nix.sh"
                  rm -f "/tmp/install_nix.sh"
                fi
                # Source nix environment
                [[ -f "${HOME}/.bash_profile" ]] && source "${HOME}/.bash_profile"
                [[ -f "${HOME}/.nix-profile/etc/profile.d/nix.sh" ]] && source "${HOME}/.nix-profile/etc/profile.d/nix.sh"
                [[ -f /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh ]] && source /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
                # Add nix to PATH for subsequent steps
                echo "/nix/var/nix/profiles/default/bin" >> "$GITHUB_PATH"
                echo "${HOME}/.nix-profile/bin" >> "$GITHUB_PATH"
                # Configure nix
                echo "access-tokens = github.com=${GITHUB_TOKEN}" | sudo tee -a /etc/nix/nix.conf
                # Set environment variables
                echo "NIXPKGS_ALLOW_BROKEN=1" >> "$GITHUB_ENV"
                echo "NIXPKGS_ALLOW_UNFREE=1" >> "$GITHUB_ENV"
                echo "NIXPKGS_ALLOW_INSECURE=1" >> "$GITHUB_ENV"
                echo "NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM=1" >> "$GITHUB_ENV"
                echo "NIX_INSTALLED=true" >> "$GITHUB_ENV"
                # Export full PATH with nix for child processes
                echo "PATH=/nix/var/nix/profiles/default/bin:${HOME}/.nix-profile/bin:${PATH}" >> "$GITHUB_ENV"
                nix --version
                ;;

              docker)
                # Install Docker
                if ! command -v docker &>/dev/null; then
                  curl -fsSL https://get.docker.com | sudo sh
                fi
                sudo usermod -aG docker "$USER" || true
                sudo systemctl start docker || sudo service docker start || true
                docker --version
                ;;

              go|golang)
                # Install Go
                if ! command -v go &>/dev/null; then
                  GO_VERSION="1.23.4"
                  case "$(uname -m)" in
                    x86_64)  GO_ARCH="amd64" ;;
                    aarch64) GO_ARCH="arm64" ;;
                  esac
                  curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${GO_ARCH}.tar.gz" | sudo tar -xzf - -C /usr/local
                  echo "/usr/local/go/bin" >> "$GITHUB_PATH"
                  echo "${HOME}/go/bin" >> "$GITHUB_PATH"
                fi
                /usr/local/go/bin/go version || go version
                ;;

              rust|cargo)
                # Install Rust
                if ! command -v cargo &>/dev/null; then
                  curl -fsSL https://sh.rustup.rs | sh -s -- -y --no-modify-path
                  source "${HOME}/.cargo/env"
                  echo "${HOME}/.cargo/bin" >> "$GITHUB_PATH"
                fi
                rustc --version && cargo --version
                ;;

              zig)
                # Install Zig
                if ! command -v zig &>/dev/null; then
                  ZIG_VERSION="0.13.0"
                  case "$(uname -m)" in
                    x86_64)  ZIG_ARCH="x86_64" ;;
                    aarch64) ZIG_ARCH="aarch64" ;;
                  esac
                  curl -fsSL "https://ziglang.org/download/${ZIG_VERSION}/zig-linux-${ZIG_ARCH}-${ZIG_VERSION}.tar.xz" \
                    | sudo tar -xJf - -C /usr/local
                  sudo ln -sf "/usr/local/zig-linux-${ZIG_ARCH}-${ZIG_VERSION}/zig" /usr/local/bin/zig
                fi
                zig version
                ;;

              python|pip)
                # Python/pip should be available, just upgrade
                sudo apt-get install -y python3-pip python3-venv
                pip3 install --upgrade pip
                python3 --version && pip3 --version
                ;;

              build-essential)
                # Install build tools
                sudo apt-get install -y build-essential cmake autoconf automake libtool pkg-config
                ;;

              *)
                echo "::warning::Unknown dependency: $dep"
                ;;
            esac

            echo "::endgroup::"
          done

      - name: Disable AppArmor restrictions
        if: env.SKIP_BUILD != 'true'
        run: |
          echo "kernel.apparmor_restrict_unprivileged_userns=0" | sudo tee /etc/sysctl.d/99-userns.conf
          echo 0 | sudo tee /proc/sys/kernel/apparmor_restrict_unprivileged_userns || true
          sudo sysctl -p || true
        continue-on-error: true

      - name: Build package
        if: env.SKIP_BUILD != 'true' && matrix.target.host != 'riscv64-Linux'
        env:
          GHCR_TOKEN: "${{ github.token }}"
          GITHUB_TOKEN: "${{ secrets.RO_GHTOKEN || github.token }}"
          GITLAB_TOKEN: "${{ secrets.RO_GLTOKEN }}"
          MINISIGN_KEY: "${{ secrets.MINISIGN_KEY }}"
          MINISIGN_PASSWORD: "${{ secrets.MINISIGN_PASSWORD }}"
        run: |
          set +e  # Don't exit on error, we want to capture the result

          SBUILD="${SYSTMP}/sbuild"

          # Output directory
          OUTDIR="${SYSTMP}/output"
          mkdir -p "$OUTDIR"
          echo "SBUILD_OUTDIR=${OUTDIR}" >> "$GITHUB_ENV"

          # Build arguments
          ARGS=(
            "--outdir" "$OUTDIR"
            "--ci"
            "--checksums"
            "--timeout" "10800"
            "--push"
            "--ghcr-repo" "${GHCR_REPO}"
          )

          [[ "${{ inputs.rebuild }}" == "true" ]] && ARGS+=("--force")
          [[ "${{ inputs.logs }}" == "true" ]] && ARGS+=("--keep")
          [[ "${{ inputs.debug }}" == "true" ]] && ARGS+=("--log-level" "debug")
          [[ "${SIGN_ENABLED:-}" == "true" ]] && ARGS+=("--sign")

          # Run build
          echo "::group::Build Output"
          "$SBUILD" build "${ARGS[@]}" "${{ inputs.sbuild-url }}" 2>&1 | tee "${SYSTMP}/build.log"
          BUILD_STATUS=$?
          echo "::endgroup::"

          # Sanitize log (remove tokens)
          sed -i -E '/(ghp_|github_pat|token|secret|access_key)/Id' "${SYSTMP}/build.log" 2>/dev/null || true

          if [[ $BUILD_STATUS -ne 0 ]]; then
            echo "BUILD_FAILED=true" >> "$GITHUB_ENV"
            echo "::error::Build failed with status $BUILD_STATUS"
          fi

      - name: Build package (RISC-V via QEMU)
        if: env.SKIP_BUILD != 'true' && matrix.target.host == 'riscv64-Linux'
        uses: uraimo/run-on-arch-action@v3
        with:
          arch: riscv64
          distro: ubuntu24.04
          githubToken: ${{ github.token }}
          setup: |
            mkdir -p "${PWD}/riscv64-artifacts"/{output,logs}
          dockerRunArgs: |
            --volume "${PWD}/riscv64-artifacts:/host-artifacts"
            --env-file "${GITHUB_ENV:-/dev/null}"
          run: |
            set +e

            SYSTMP="/tmp"
            BUILD_LOG="${SYSTMP}/build.log"
            OUTDIR="/tmp/output"
            mkdir -p "$OUTDIR"

            # Install base packages
            apt-get update -qq
            apt-get install -y -qq \
              ca-certificates curl git jq p7zip-full rsync wget zstd

            # Install oras
            ORAS_VERSION="1.2.2"
            curl -fsSL "https://github.com/oras-project/oras/releases/download/v${ORAS_VERSION}/oras_${ORAS_VERSION}_linux_riscv64.tar.gz" \
              | tar -xzf - -C /usr/local/bin oras

            # Install soar
            curl -fsSL "https://github.com/pkgforge/soar/releases/latest/download/soar-riscv64-linux" \
              -o /usr/local/bin/soar && chmod +x /usr/local/bin/soar

            # Install sbuild
            curl -fsSL "https://github.com/pkgforge/sbuilder/releases/download/latest/sbuild-riscv64-linux" \
              -o /usr/local/bin/sbuild && chmod +x /usr/local/bin/sbuild

            # Install squishy
            curl -fsSL "https://github.com/pkgforge/squishy-rs/releases/latest/download/squishy-riscv64-linux" \
              -o /usr/local/bin/squishy && chmod +x /usr/local/bin/squishy

            # Install appimagetool
            curl -fsSL "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-riscv64.AppImage" \
              -o /usr/local/bin/appimagetool && chmod +x /usr/local/bin/appimagetool

            # Install minisign if needed
            if [ -n "${{ secrets.MINISIGN_KEY }}" ]; then
              apt-get install -y -qq minisign
              mkdir -p "${HOME}/.minisign"
              echo "${{ secrets.MINISIGN_SIGKEY }}" > "${HOME}/.minisign/minisign.key"
            fi

            # GHCR login
            echo "${{ github.token }}" | oras login ghcr.io -u "${{ github.actor }}" --password-stdin

            # Parse GHCR URL
            GHCR_REPO="$(echo "${{ inputs.ghcr-url }}" | sed 's|^ghcr.io/||' | tr '[:upper:]' '[:lower:]')"

            # Build arguments
            ARGS=(
              "--outdir" "$OUTDIR"
              "--ci"
              "--checksums"
              "--timeout" "10800"
              "--push"
              "--ghcr-repo" "${GHCR_REPO}"
            )

            [ "${{ inputs.rebuild }}" == "true" ] && ARGS+=("--force")
            [ "${{ inputs.logs }}" == "true" ] && ARGS+=("--keep")
            [ "${{ inputs.debug }}" == "true" ] && ARGS+=("--log-level" "debug")
            [ -n "${{ secrets.MINISIGN_KEY }}" ] && ARGS+=("--sign")

            # Run build
            echo "::group::Build Output"
            /usr/local/bin/sbuild build "${ARGS[@]}" "${{ inputs.sbuild-url }}" 2>&1 | tee "$BUILD_LOG"
            BUILD_STATUS=$?
            echo "::endgroup::"

            # Sanitize log (remove tokens)
            sed -i -E '/(ghp_|github_pat|token|secret|access_key)/Id' "$BUILD_LOG" 2>/dev/null || true

            # Copy log and output to host artifacts
            cp "$BUILD_LOG" /host-artifacts/logs/build.log
            cp -r "$OUTDIR"/* /host-artifacts/output/ 2>/dev/null || true

            if [ $BUILD_STATUS -ne 0 ]; then
              echo "BUILD_FAILED=true" >> /host-artifacts/status.txt 2>/dev/null || true
              echo "::error::Build failed with status $BUILD_STATUS"
              exit 1
            fi

      - name: Upload build logs
        if: always() && env.SKIP_BUILD != 'true'
        uses: actions/upload-artifact@v6
        with:
          name: "build-log-${{ env.RECIPE_ID }}-${{ matrix.target.host }}"
          path: |
            ${{ env.SYSTMP }}/build.log
            ${{ github.workspace }}/riscv64-artifacts/build.log
          retention-days: 7
          if-no-files-found: ignore

      - name: Attest build provenance
        if: env.SKIP_BUILD != 'true' && env.BUILD_FAILED != 'true'
        uses: actions/attest-build-provenance@v3
        with:
          subject-name: "${{ inputs.pkg-family }}-${{ matrix.target.host }}"
          subject-path: |
            ${{ env.SBUILD_OUTDIR }}/**
            ${{ github.workspace }}/riscv64-artifacts/output/**
        continue-on-error: true

      - name: Verify build
        if: env.SKIP_BUILD != 'true' && matrix.target.host != 'riscv64-Linux'
        run: |
          if [[ "${BUILD_FAILED:-}" == "true" ]]; then
            echo "::error::Build failed"
            exit 1
          fi
          echo "Build completed successfully"

      - name: Verify build (RISC-V)
        if: env.SKIP_BUILD != 'true' && matrix.target.host == 'riscv64-Linux'
        run: |
          if [[ -f "${{ github.workspace }}/riscv64-artifacts/status.txt" ]]; then
            echo "::error::Build failed"
            cat "${{ github.workspace }}/riscv64-artifacts/status.txt"
            exit 1
          fi
          echo "Build completed successfully"

      - name: Create build status file
        if: always() && matrix.target.host != 'riscv64-Linux'
        run: |
          STATUS="success"
          if [[ "${BUILD_FAILED:-}" == "true" ]]; then
            STATUS="failure"
          elif [[ "${SKIP_BUILD:-}" == "true" ]]; then
            STATUS="skipped"
          fi

          GHCR_URL="${GHCRPKG_URL:-}"

          jq -n \
            --arg status "$STATUS" \
            --arg host "${{ matrix.target.host }}" \
            --arg url "${{ inputs.sbuild-url }}" \
            --arg ghcr "$GHCR_URL" \
            '{status: $status, host: $host, recipe_url: $url, ghcr_url: $ghcr}' > "${SYSTMP}/build-status.json"

      - name: Create build status file (RISC-V)
        if: always() && matrix.target.host == 'riscv64-Linux'
        run: |
          STATUS="success"
          if [[ -f "${{ github.workspace }}/riscv64-artifacts/status.txt" ]]; then
            STATUS="failure"
          fi

          GHCR_URL="${GHCRPKG_URL:-}"

          mkdir -p "${{ github.workspace }}/riscv64-artifacts"

          jq -n \
            --arg status "$STATUS" \
            --arg host "${{ matrix.target.host }}" \
            --arg url "${{ inputs.sbuild-url }}" \
            --arg ghcr "$GHCR_URL" \
            '{status: $status, host: $host, recipe_url: $url, ghcr_url: $ghcr}' > "${{ github.workspace }}/riscv64-artifacts/build-status.json"

      - name: Upload build status
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: "build-status-${{ env.RECIPE_ID }}-${{ matrix.target.host }}"
          path: |
            ${{ env.SYSTMP }}/build-status.json
            ${{ github.workspace }}/riscv64-artifacts/build-status.json
          retention-days: 1
          if-no-files-found: ignore