name: Tag and publish to AUR

on:
  push:
    branches: [master]

jobs:
  tag:
    runs-on: ubuntu-latest
    container:
      image: archlinux:latest
    defaults:
      run:
        shell: bash
    outputs:
      created: ${{ steps.tag.outputs.created }}
      pkgver: ${{ steps.tag.outputs.pkgver }}
    steps:
      - name: Install dependencies
        run: pacman -Syu --noconfirm --needed git

      - name: Checkout source
        run: |
          git clone --branch ${{ gitea.ref_name }} \
            http://gitea-actions:${{ gitea.token }}@gitea:3030/${{ gitea.repository }}.git .

      - name: Tag if pkgver bumped
        id: tag
        run: |
          set -euo pipefail
          PKGVER=$(awk -F= '/^pkgver=/{print $2}' PKGBUILD)
          TAG="v${PKGVER}"
          git config --global --add safe.directory "$(pwd)"
          git fetch --tags origin
          if git rev-parse -q --verify "refs/tags/${TAG}" >/dev/null; then
            echo "Tag ${TAG} already exists, skipping release."
            echo "created=0" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          git config user.name "${{ vars.AUR_GIT_NAME || 'Radu Macocian' }}"
          git config user.email "${{ vars.AUR_GIT_EMAIL || 'radu@macocian.com' }}"
          git tag -a "${TAG}" -m "Release ${TAG}"
          git push \
            http://gitea-actions:${{ gitea.token }}@gitea:3030/${{ gitea.repository }}.git \
            "${TAG}"
          echo "created=1" >> "$GITHUB_OUTPUT"
          echo "pkgver=${PKGVER}" >> "$GITHUB_OUTPUT"

  publish:
    needs: tag
    if: needs.tag.outputs.created == '1'
    runs-on: ubuntu-latest
    container:
      image: archlinux:latest
    defaults:
      run:
        shell: bash
    steps:
      - name: Install dependencies
        run: |
          pacman -Syu --noconfirm --needed git openssh pacman-contrib base-devel sudo curl coreutils
          useradd -m builder
          echo "builder ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

      - name: Checkout source at tag
        run: |
          git clone --depth 1 --branch v${{ needs.tag.outputs.pkgver }} \
            http://gitea-actions:${{ gitea.token }}@gitea:3030/${{ gitea.repository }}.git .

      - name: Recompute sha256sums for tagged archive
        run: |
          set -euo pipefail
          PKGVER=$(awk -F= '/^pkgver=/{print $2}' PKGBUILD)
          URL=$(awk -F\" '/^url=/{print $2}' PKGBUILD)
          SRC_URL="${URL}/archive/v${PKGVER}.tar.gz"
          echo "Fetching ${SRC_URL}"
          curl -fsSL "${SRC_URL}" -o /tmp/src.tar.gz
          NEW_SHA=$(sha256sum /tmp/src.tar.gz | awk '{print $1}')
          sed -i "s/^sha256sums=.*/sha256sums=('${NEW_SHA}')/" PKGBUILD

      - name: Configure SSH for AUR
        env:
          AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
        run: |
          install -dm700 ~/.ssh
          printf '%s\n' "$AUR_SSH_KEY" > ~/.ssh/aur
          chmod 600 ~/.ssh/aur
          ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null
          cat > ~/.ssh/config <<EOF
          Host aur.archlinux.org
            User aur
            IdentityFile ~/.ssh/aur
            IdentitiesOnly yes
          EOF
          chmod 600 ~/.ssh/config

      - name: Publish to AUR
        run: |
          set -euo pipefail
          SRC=$(pwd)
          rm -rf /tmp/aur
          git clone ssh://aur@aur.archlinux.org/omni-launcher.git /tmp/aur
          if [ ! -d /tmp/aur/.git ]; then
            git -C /tmp/aur init
            git -C /tmp/aur remote add origin ssh://aur@aur.archlinux.org/omni-launcher.git
          fi
          git config --global --add safe.directory /tmp/aur
          cp "$SRC/PKGBUILD" /tmp/aur/PKGBUILD
          chown -R builder:builder /tmp/aur
          sudo -u builder bash -c 'cd /tmp/aur && makepkg --printsrcinfo > .SRCINFO'
          cd /tmp/aur
          git config user.name "${{ vars.AUR_GIT_NAME || 'Radu Macocian' }}"
          git config user.email "${{ vars.AUR_GIT_EMAIL || 'radu@macocian.com' }}"
          git add PKGBUILD .SRCINFO
          if git diff --cached --quiet; then
            echo "No changes to publish."
            exit 0
          fi
          PKGVER=$(awk -F= '/^pkgver=/{print $2}' PKGBUILD)
          PKGREL=$(awk -F= '/^pkgrel=/{print $2}' PKGBUILD)
          git commit -m "Update to ${PKGVER}-${PKGREL}"
          git push origin master