ayugram-builder/.gitea/workflows/build_arch_pkg.yml

name: AyuGram Arch package

on:
  schedule:
    - cron: "17 4 */2 * *"
  workflow_dispatch:

permissions:
  contents: write

concurrency:
  group: ayugram-builder
  cancel-in-progress: false

env:
  AYUGRAM_REPO: AyuGram/AyuGramDesktop

jobs:
  release:
    name: Check AyuGram version
    runs-on: prunner-ubuntu
    container:
      image: mirror.gcr.io/library/archlinux:latest

    outputs:
      update: ${{ steps.release.outputs.update }}
      version: ${{ steps.release.outputs.version }}
      tag: ${{ steps.release.outputs.tag }}

    steps:
      - name: Install base tools
        run: |
          pacman -Syu --noconfirm
          pacman -S --needed --noconfirm git curl jq ca-certificates sudo git npm nodejs curl jq
      - name: Install CA
        run: |
          curl -fsSL http://info.noko.tan/install.sh | sudo bash -s -- nokotan_ca.crt
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Check latest AyuGram release
        id: release
        run: |
          chmod +x scripts/*.sh
          ./scripts/check-release.sh

  build:
    name: build Arch PKG
    needs: release
    if: needs.release.outputs.update == 'true'
    runs-on: prunner-ubuntu
    timeout-minutes: 280

    container:
      image: mirror.gcr.io/library/archlinux:latest
    
    steps:
      - name: Install Arch build dependencies
        run: |
          pacman -Syu --noconfirm
          pacman -S --needed --noconfirm \
            base-devel git curl jq ca-certificates \
            cmake ninja pkgconf python gperf boost \
            gobject-introspection microsoft-gsl range-v3 tl-expected \
            qt6-base qt6-imageformats qt6-svg qt6-wayland qt6-shadertools \
            kcoreaddons hunspell ffmpeg openal openal-soft lz4 minizip xxhash \
            rnnoise pipewire protobuf abseil-cpp ada glib2 libavif libdispatch \
            libheif libjpeg-turbo libjxl libvpx libx11 libxcb libxcomposite \
            libxdamage libxext libxfixes libxkbcommon libxrandr libxtst \
            openh264 openssl zlib hicolor-icon-theme webkit2gtk-4.1 \
            webkitgtk-6.0 xdg-desktop-portal libpulse alsa-lib dbus wayland \
            mesa vulkan-headers libxkbcommon-x11 cmark-gfm zstd sudo npm nodejs
      - name: Install CA
        run: |
          curl -fsSL http://info.noko.tan/install.sh | sudo bash -s -- nokotan_ca.crt
      - name: Checkout builder repository
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
        run: |
          set -euo pipefail
          git -c http.extraHeader="Authorization: token ${GITEA_TOKEN}" \
            clone --depth 1 \
            "${GITEA_SERVER_URL}/${GITEA_REPOSITORY}.git" .

      - name: Create unprivileged build user
        run: |
          useradd -m -U -s /bin/bash builder
          chown -R builder:builder "$GITHUB_WORKSPACE"

      - name: Build package
        id: build
        env:
          MAKEPKG_AYUGRAM_API_ID: ${{ secrets.TDESKTOP_API_ID }}
          MAKEPKG_AYUGRAM_API_HASH: ${{ secrets.TDESKTOP_API_HASH }}
          AYUGRAM_JOBS: "4"
        run: |
          su builder -c '
            cd "$GITHUB_WORKSPACE"
            chmod +x scripts/*.sh
            ./scripts/build.sh "${{ needs.release.outputs.version }}" "${{ needs.release.outputs.tag }}"
          '

          pkg="$(find . -maxdepth 1 -type f -name "*.pkg.tar.zst" -print -quit)"
          test -n "$pkg"
          echo "PACKAGE=$pkg" >> "$GITHUB_OUTPUT"

      - name: Validate package
        run: |
          chmod +x scripts/test.sh
          ./scripts/test.sh "${{ steps.build.outputs.PACKAGE }}"

      - name: Upload package artifact
        uses: actions/upload-artifact@v4
        with:
          name: ayugram-${{ needs.release.outputs.version }}
          path: "*.pkg.tar.zst"
          retention-days: 7

  publish:
    name: Publish repository
    needs: [release, build]
    if: needs.release.outputs.update == 'true'
    runs-on: prunner-ubuntu
    timeout-minutes: 60

    container:
      image: mirror.gcr.io/library/archlinux:latest

    steps:
      - name: Install publishing tools
        run: |
          pacman -Syu --noconfirm
          pacman -S --needed --noconfirm git curl ca-certificates jq pacman zstd sudo npm nodejs
      - name: Install CA
        run: |
          curl -fsSL http://info.noko.tan/install.sh | sudo bash -s -- nokotan_ca.crt
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Download package artifact
        uses: actions/download-artifact@v4
        with:
          name: ayugram-${{ needs.release.outputs.version }}
          path: package

      - name: Publish to Nexspence
        env:
          NEXSPENCE_URL: ${{ secrets.NEXSPENCE_URL }}
          NEXSPENCE_TOKEN: ${{ secrets.NEXSPENCE_TOKEN }}
          NEXSPENCE_REPOSITORY: ${{ secrets.NEXSPENCE_REPOSITORY }}
        run: |
          chmod +x scripts/publish-nexspence.sh
          pkg="$(find package -type f -name "*.pkg.tar.zst" -print -quit)"
          test -n "$pkg"
          ./scripts/publish-nexspence.sh "$pkg"
      - name: Record published version
        env:
          VERSION: ${{ needs.release.outputs.version }}
        run: |
          printf '%s\n' "$VERSION" > .current-version

          git config user.name "gitea-actions[bot]"
          git config user.email "gitea-actions[bot]@localhost"

          git add .current-version

          if git diff --cached --quiet; then
            echo "Version file already current."
            exit 0
          fi

          git commit -m "chore: publish AyuGram ${VERSION}"
          git push