name: Build hyprland-raveos stack

on:
  push:
    branches:
      - main
    paths:
      - 'hyprland-raveos/**'
  workflow_dispatch:

concurrency:
  group: raveos-hyprland-build
  cancel-in-progress: true

jobs:
  build:
    runs-on: iso-builder

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install build dependencies
        run: |
          set -euo pipefail
          sudo pacman -S --needed --noconfirm \
            base-devel cmake meson ninja clang llvm lld rust go git \
            wayland wayland-protocols cairo pango libxkbcommon libinput \
            libdrm mesa libglvnd pixman xorg-xwayland rsync pacman-contrib

      - name: Fetch core repo via rsync
        run: |
          set -euo pipefail
          RSYNC_SSH="ssh -p 2222 -i $HOME/.ssh/vps_backup_key -o StrictHostKeyChecking=no"
          rm -rf /tmp/raveos-core-repo
          mkdir -p /tmp/raveos-core-repo/x86_64
          rsync -az -e "$RSYNC_SSH" \
            root@10.66.66.1:/root/docker/repo/repo/x86_64/ /tmp/raveos-core-repo/x86_64/ || true
          mkdir -p /tmp/builtpkgs

      - name: Import GPG signing key
        run: |
          set -euo pipefail
          export GNUPGHOME=/tmp/raveos-gnupg
          rm -rf "$GNUPGHOME"
          mkdir -m 700 "$GNUPGHOME"
          echo "${{ secrets.GPG_PRIVATE_KEY }}" | base64 -d | gpg --batch --import

      - name: Build hyprland-raveos stack
        run: |
          set -euo pipefail
          ORDER=(
            hyprutils
            hyprwayland-scanner
            hyprlang
            hyprgraphics
            hyprcursor
            aquamarine
            hyprwire
            hyprland-guiutils
            hyprland
            xdg-desktop-portal-hyprland
            hyprpolkitagent
            hyprland-qt-support
            dms-shell
          )

          mkdir -p /tmp/builtpkgs
          CORE="/tmp/raveos-core-repo/x86_64"

          for pkg in "${ORDER[@]}"; do
            dir="hyprland-raveos/$pkg"
            [ -d "$dir" ] || continue

            PKGVER=$(grep '^pkgver=' "$dir/PKGBUILD" | head -1 | cut -d= -f2 | tr -d "'\"")
            PKGREL=$(grep '^pkgrel=' "$dir/PKGBUILD" | head -1 | cut -d= -f2 | tr -d "'\"")

            echo "=== Checking $pkg (${PKGVER}-${PKGREL}) ==="
            if ls "$CORE"/${pkg}-${PKGVER}-${PKGREL}-*.pkg.tar.zst 2>/dev/null | grep -q .; then
              echo "$pkg already built -> skipping"
              continue
            fi

            echo "=== Building $pkg ==="
            cd "$dir"
            rm -f *.pkg.tar.zst || true
            makepkg -s --noconfirm -f

            for built in *.pkg.tar.zst; do
              [ -f "$built" ] || continue
              cp -v "$built" /tmp/builtpkgs/
              sudo pacman -U --noconfirm "$built" || true
            done
            cd - >/dev/null
          done

      - name: Sign built packages
        run: |
          set -euo pipefail
          export GNUPGHOME=/tmp/raveos-gnupg
          for pkg in /tmp/builtpkgs/*.pkg.tar.zst; do
            [ -f "$pkg" ] || continue
            gpg --batch --yes --pinentry-mode loopback \
                --passphrase "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" \
                --local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
                --detach-sign --no-armor "$pkg"
          done

      - name: Update repo database and sync to VPS
        run: |
          set -euo pipefail
          BUILT=$(ls /tmp/builtpkgs/*.pkg.tar.zst 2>/dev/null || true)
          if [ -z "$BUILT" ]; then
            echo "Nincs új csomag -> kihagyva"
            exit 0
          fi

          CORE="/tmp/raveos-core-repo/x86_64"
          for pkg in $BUILT; do
            PKGFILE=$(basename "$pkg")
            PKGNAME=$(echo "$PKGFILE" | sed 's/-[0-9][^-]*-[^-]*-[^-]*\.pkg\.tar\.zst$//')
            rm -f "$CORE/${PKGNAME}-"*.pkg.tar.zst* 2>/dev/null || true
            cp -v "$pkg" "$CORE/"
            [ -f "$pkg.sig" ] && cp -v "$pkg.sig" "$CORE/"
          done

          export GNUPGHOME=/tmp/raveos-gnupg
          cd "$CORE"
          ALLPKGS=$(ls *.pkg.tar.zst)
          repo-add raveos-core-repo.db.tar.xz $ALLPKGS

          for f in raveos-core-repo.db.tar.xz raveos-core-repo.files.tar.xz; do
            gpg --batch --yes --pinentry-mode loopback \
                --passphrase "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" \
                --local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
                --detach-sign --no-armor -o "$f.sig" "$f"
          done
          ln -sf raveos-core-repo.db.tar.xz.sig raveos-core-repo.db.sig
          ln -sf raveos-core-repo.files.tar.xz.sig raveos-core-repo.files.sig

          RSYNC_SSH="ssh -p 2222 -i $HOME/.ssh/vps_backup_key -o StrictHostKeyChecking=no"
          rsync -az --delete -e "$RSYNC_SSH" \
            "$CORE/" root@10.66.66.1:/root/docker/repo/repo/x86_64/

          echo "::notice title=Hyprland stack published::All packages updated in repo"

      - name: Cleanup
        if: always()
        run: |
          gpgconf --homedir /tmp/raveos-gnupg --kill gpg-agent || true
          sudo rm -rf /tmp/raveos-gnupg || true
          sudo rm -rf /tmp/builtpkgs || true
          sudo rm -rf /tmp/raveos-core-repo || true
          df -h