build.yml

name: Build packages

on:
  push:
    branches: [main]
    paths-ignore:
      - iso/**
      - web/**
      - .github/workflows/iso.yml
      - .github/workflows/pages.yml
  schedule:
    - cron: "0 18 * * *"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: packages
  cancel-in-progress: false

env:
  SUITE: trixie-nightly
  BUCKET: cutefish-deb

jobs:
  changes:
    name: Changes
    runs-on: ubuntu-24.04
    outputs:
      changed: ${{ steps.compare.outputs.changed }}
      commits: ${{ steps.compare.outputs.commits }}

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Compare with the published build
        id: compare
        run: |
          echo "packaging $GITHUB_SHA" > commits
          while read -r project _; do
            [[ -z "$project" || "$project" == \#* ]] && continue
            grep -qs native "debian/$project/debian/source/format" && continue
            echo "$project $(git ls-remote "https://github.com/cutefishos/$project.git" HEAD | cut -f 1)" >> commits
          done < versions
          cat commits

          # The nightly run builds only when a commit moved since the last
          # publish; a push or a manual run always builds.
          changed=true
          if [[ "$GITHUB_EVENT_NAME" == schedule ]] \
             && curl -fsSL "https://download.cutefish.org/debian/dists/$SUITE/commits" | cmp -s - commits; then
            changed=false
            echo "Nothing changed since the last publish." >> "$GITHUB_STEP_SUMMARY"
          fi
          echo "changed=$changed" >> "$GITHUB_OUTPUT"
          {
            echo "commits<<EOF"
            cat commits
            echo EOF
          } >> "$GITHUB_OUTPUT"

  # Every architecture builds the same commits, the ones listed above.
  build:
    name: Debian 13 ${{ matrix.arch }}
    needs: changes
    if: needs.changes.outputs.changed == 'true'
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 300
    strategy:
      matrix:
        include:
          - arch: amd64
            runner: ubuntu-24.04
          - arch: arm64
            runner: ubuntu-24.04-arm

    steps:
      - name: Free disk space
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache
          df -h /

      - name: Checkout
        uses: actions/checkout@v7
        with:
          path: packaging

      - name: Check out the projects
        env:
          COMMITS: ${{ needs.changes.outputs.commits }}
        run: |
          echo "$COMMITS" | while read -r project commit; do
            [[ "$project" == packaging ]] && continue
            git init --quiet "$project"
            git -C "$project" fetch --quiet --depth 1 "https://github.com/cutefishos/$project.git" "$commit"
            git -C "$project" checkout --quiet --detach FETCH_HEAD
          done

      # Skia's GN binary is built for the runner's architecture.
      - name: Cache Skia
        uses: actions/cache@v6
        with:
          path: cutefish-toolkit/third_party/skia
          key: skia-${{ matrix.arch }}-${{ hashFiles('cutefish-toolkit/scripts/fetch-skia.sh') }}

      - name: Fetch Skia
        run: cutefish-toolkit/scripts/fetch-skia.sh

      - name: Build
        run: |
          docker run --rm \
            -v "$PWD:/work" \
            -w /work \
            debian:trixie \
            bash -euo pipefail -c '
              apt-get update
              apt-get install -y --no-install-recommends \
                build-essential \
                ca-certificates \
                devscripts \
                equivs \
                git \
                xz-utils

              git config --global --add safe.directory "*"
              packaging/debian/build.sh --install --snapshot
            '
          sudo chown -R "$(id -u):$(id -g)" packaging/out

      - name: Upload packages
        uses: actions/upload-artifact@v7
        with:
          name: packages-${{ matrix.arch }}
          path: |
            packaging/out/debian/*
            !packaging/out/debian/*-dbgsym_*
          if-no-files-found: error
          retention-days: 7

  repository:
    name: Repository
    needs: [changes, build]
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write
      attestations: write

    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          path: packaging

      - name: Download packages
        uses: actions/download-artifact@v8
        with:
          pattern: packages-*
          path: out

      # The amd64 build provides the sources and the Architecture: all
      # packages.
      - name: Index
        env:
          SIGNING_KEY: ${{ secrets.APT_SIGNING_KEY }}
        run: |
          docker run --rm \
            -v "$PWD:/work" \
            -w /work \
            -e SIGNING_KEY \
            -e SUITE \
            debian:trixie \
            bash -euo pipefail -c '
              apt-get update
              apt-get install -y --no-install-recommends \
                apt-utils \
                devscripts \
                gnupg \
                xz-utils

              if [[ -n "$SIGNING_KEY" ]]; then
                gpg --batch --import <<< "$SIGNING_KEY"
                packaging/debian/publish.sh --sign "$SUITE" repo out/packages-amd64 out/packages-arm64
              else
                packaging/debian/publish.sh "$SUITE" repo out/packages-amd64 out/packages-arm64
              fi
            '

      - name: Checksums
        env:
          COMMITS: ${{ needs.changes.outputs.commits }}
        run: |
          sudo chown -R "$(id -u):$(id -g)" repo
          echo "$COMMITS" > "repo/dists/$SUITE/commits"
          (cd repo && find "pool/$SUITE" -type f | sort | xargs sha256sum) > "repo/dists/$SUITE/SHA256SUMS"
          cat "repo/dists/$SUITE/SHA256SUMS"
          {
            echo "## Commits"
            echo '```'
            cat "repo/dists/$SUITE/commits"
            echo '```'
            echo "## SHA-256"
            echo '```'
            cat "repo/dists/$SUITE/SHA256SUMS"
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Attest
        uses: actions/attest-build-provenance@v4
        with:
          subject-checksums: repo/dists/${{ env.SUITE }}/SHA256SUMS

      - name: Upload repository
        uses: actions/upload-artifact@v7
        with:
          name: cutefish-debian-13
          path: repo/
          if-no-files-found: error
          retention-days: 7

  # A clean system on each architecture installs the desktop from the new
  # repository, checking its signature too, before anything is published.
  install:
    name: Install ${{ matrix.arch }}
    needs: repository
    runs-on: ${{ matrix.runner }}
    strategy:
      matrix:
        include:
          - arch: amd64
            runner: ubuntu-24.04
          - arch: arm64
            runner: ubuntu-24.04-arm

    steps:
      - name: Download repository
        uses: actions/download-artifact@v8
        with:
          name: cutefish-debian-13
          path: repo

      - name: Install
        run: |
          signed=trusted=yes
          if [[ -f "repo/dists/$SUITE/InRelease" ]]; then
            signed=signed-by=/repo/cutefish.asc
          fi
          docker run --rm \
            -v "$PWD/repo:/repo:ro" \
            -e SUITE \
            -e SIGNED="$signed" \
            -e DEBIAN_FRONTEND=noninteractive \
            debian:trixie \
            bash -euo pipefail -c '
              echo "deb [$SIGNED] file:/repo $SUITE main" > /etc/apt/sources.list.d/cutefish.list
              apt-get update
              apt-get install -y cutefish-desktop
              dpkg -l | grep cutefish
            '

  publish:
    name: Publish
    needs: install
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      actions: write

    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          path: packaging

      - name: Download repository
        uses: actions/download-artifact@v8
        with:
          name: cutefish-debian-13
          path: repo

      - name: Publish
        env:
          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: auto
        run: |
          if [[ -z "$R2_ACCOUNT_ID" || ! -f repo/dists/$SUITE/InRelease ]]; then
            echo "R2 or the signing key is not configured; skipping."
            exit 0
          fi
          s3() { aws s3 --endpoint-url "https://$R2_ACCOUNT_ID.r2.cloudflarestorage.com" "$@"; }

          # New packages go up before the indexes that name them, and old
          # ones are removed only after the indexes stop naming them.
          s3 sync "repo/pool/$SUITE" "s3://$BUCKET/debian/pool/$SUITE"
          s3 sync "repo/dists/$SUITE" "s3://$BUCKET/debian/dists/$SUITE" --delete
          s3 cp repo/cutefish.asc "s3://$BUCKET/debian/cutefish.asc"
          packaging/web/index.sh root > index.html
          s3 cp index.html "s3://$BUCKET/index.html"
          s3 cp index.html "s3://$BUCKET/debian/index.html"
          s3 sync "repo/pool/$SUITE" "s3://$BUCKET/debian/pool/$SUITE" --delete

      # A run started with the workflow's own token is the one kind that may
      # start another workflow.
      - name: Build the ISO
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh workflow run iso.yml --repo "$GITHUB_REPOSITORY" --ref "$GITHUB_REF_NAME"