release.yml

name: CI/CD

on:
  push:
    branches:
      - master

permissions:
  contents: write
  pages: write
  id-token: write
  packages: write

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

concurrency:
  group: ${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    # GitHub Actions run without a TTY device. This is a workaround to get one,
    # based on https://github.com/actions/runner/issues/241#issuecomment-2019042651
    shell: 'script --return --quiet --log-out /dev/null --command "bash -e {0}"'

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      keyring: ${{ steps.create-apt-repo.outputs.keyring }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Pages
        uses: actions/configure-pages@v5

      - name: Tune dpkg
        uses: abbbi/github-actions-tune@v1

      - name: Set dpkg
        run: sudo rm -f /usr/local/bin/dpkg

      - name: Tune apt
        uses: firebuild/apt-eatmydata-action@v1

      - name: Build package
        id: build
        run: |
          sed -i "s,^Description:,Files:$(find . -type f | grep -oP '(?<=^\./).*' | grep -vP '^(\.|debian/)' | while read -r file; do echo -e " $file /opt/closure/$file"; done | grep -oP '.*(?=/)' | awk -v ORS='\\n' '1')Description:," debian/control
          sed -i "s,^Files:,Files:$(find . -type f | grep -oP '(?<=^\./).*' | grep -oP '(?<=^debian/).+' | while read -r file; do echo -e " debian/$file /opt/closure/DEBIAN/$file"; done | grep -oP '.*(?=/)' | awk -v ORS='\\n' '1')," debian/control
          sudo apt-get update
          sudo apt-get install -y equivs
          equivs-build debian/control
          echo -e "built=$?\ntag=$(grep -oP '(?<=^Version: ).*' debian/control)\nmessage=$(git log -1 --pretty=%B)\n" >> "$GITHUB_OUTPUT"

      - name: Create release
        if: ${{ steps.build.outputs.built == '0' }}
        uses: ncipollo/release-action@v1
        with:
          artifacts: "*.deb"
          body: ${{ steps.build.outputs.message }}
          tag: "v${{ steps.build.outputs.tag }}"
          commit: "master"
          allowUpdates: true

      - name: Generate repo
        uses: morph027/apt-repo-action@main
        id: create-apt-repo
        with:
          import-from-repo-url: deb https://ipitio.github.io/closure master main
          import-from-repo-failure-allow: true
          repo-name: closure
          codename: master
          origin: github.com/ipitio/closure
          signing-key: ${{ secrets.SIGNING_KEY }}
          architectures: amd64 i386 arm64 armhf arm

      - name: Copy script
        run: |
          echo "#!/bin/bash
          sudonot() {
              if command -v sudo >/dev/null; then
                  sudo -E \"\${@:-:}\" || \"\${@:-:}\"
              else
                  \"\${@:-:}\"
              fi
          }
          export DEBIAN_FRONTEND=noninteractive
          sudonot apt-get update
          sudonot apt-get -o APT::Get::AllowUnauthenticated=true install -qq gpg wget
          sudonot mkdir -m 0755 -p /etc/apt/keyrings/
          wget -qO- https://ipitio.github.io/closure/gpg.key | gpg --dearmor | sudonot tee /etc/apt/keyrings/closure.gpg > /dev/null
          echo \"deb [signed-by=/etc/apt/keyrings/closure.gpg] https://ipitio.github.io/closure master main\" | sudonot tee /etc/apt/sources.list.d/closure.list &>/dev/null
          sudonot chmod 644 /etc/apt/keyrings/closure.gpg
          sudonot chmod 644 /etc/apt/sources.list.d/closure.list
          sudonot apt-get update
          sudonot apt-get -o APT::Get::AllowUnauthenticated=true install --no-install-recommends -qq closure
          DEBIAN_FRONTEND=
          " | tee ${{ steps.create-apt-repo.outputs.dir }}/i

      - name: Upload artifact
        uses: actions/upload-pages-artifact@v3
        id: upload-artifact
        with:
          name: github-pages
          path: ${{ steps.create-apt-repo.outputs.dir }}

  deploy:
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}

    runs-on: ubuntu-latest
    needs: build

    steps:
      - name: Deploy repo
        id: deployment
        uses: actions/deploy-pages@v4

  test:
    runs-on: ubuntu-latest
    needs: deploy

    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Log in to the Container registry
        uses: docker/login-action@v3.1.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5.5.1
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v5.3.0
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}