name: Build linux-raveos kernel

on:
  push:
    branches:
      - main
    paths:
      - 'linux-raveos/**'
  workflow_dispatch:

concurrency:
  group: raveos-kernel-build
  cancel-in-progress: true

jobs:
  build:
    runs-on: iso-builder

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install build dependencies
        run: |
          set -euo pipefail
          sudo pacman -S --needed --noconfirm \
            base-devel clang llvm lld bc binutils cpio gettext \
            libelf openssl pahole perl python rust rust-bindgen \
            rust-src xxhash xz zlib zstd

      - name: Clone core repo
        run: |
          set -euo pipefail
          rm -rf /tmp/raveos-core-repo
          git clone --depth 1 git@git.rp1.hu:RaveOS/raveos-core-repo.git /tmp/raveos-core-repo
          mkdir -p /tmp/builtpkgs

      - name: Import GPG signing key
        run: |
          set -euo pipefail
          export GNUPGHOME=/tmp/raveos-gnupg
          rm -rf "$GNUPGHOME"
          mkdir -m 700 "$GNUPGHOME"
          echo "${{ secrets.GPG_PRIVATE_KEY }}" | base64 -d | gpg --batch --import

      - name: Check if already built
        id: check
        run: |
          set -euo pipefail
          CORE="/tmp/raveos-core-repo/x86_64"
          PKGVER=$(grep '^pkgver=' linux-raveos/PKGBUILD | cut -d= -f2)
          PKGREL=$(grep '^pkgrel=' linux-raveos/PKGBUILD | cut -d= -f2)
          FULLVER="${PKGVER}-${PKGREL}"
          echo "PKGVER=$PKGVER" >> $GITHUB_OUTPUT
          echo "PKGREL=$PKGREL" >> $GITHUB_OUTPUT
          if ls "$CORE"/linux-cachyos-${PKGVER}-${PKGREL}-*.pkg.tar.zst 2>/dev/null | grep -q .; then
            echo "SKIP=yes" >> $GITHUB_OUTPUT
            echo "linux-cachyos ${FULLVER} mar bent van -> skip"
          else
            echo "SKIP=no" >> $GITHUB_OUTPUT
            echo "linux-cachyos ${FULLVER} build indul..."
          fi

      - name: Build linux-cachyos
        if: steps.check.outputs.SKIP == 'no'
        run: |
          set -euo pipefail
          cd linux-raveos
          rm -f *.pkg.tar.zst || true
          makepkg -s --noconfirm
          cp -v linux-cachyos-*.pkg.tar.zst /tmp/builtpkgs/

      - name: Sign built packages
        if: steps.check.outputs.SKIP == 'no'
        run: |
          set -euo pipefail
          export GNUPGHOME=/tmp/raveos-gnupg
          for pkg in /tmp/builtpkgs/*.pkg.tar.zst; do
            gpg --batch --yes --pinentry-mode loopback \
                --passphrase "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" \
                --local-user 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
                --detach-sign "$pkg"
            echo "Alairva: $(basename "$pkg")"
          done

      - name: Publish to core repo
        if: steps.check.outputs.SKIP == 'no'
        run: |
          set -euo pipefail
          CORE="/tmp/raveos-core-repo/x86_64"
          mkdir -p "$CORE"

          BUILT=$(ls /tmp/builtpkgs/*.pkg.tar.zst 2>/dev/null || true)
          if [ -z "$BUILT" ]; then
            echo "Nincs csomag -> kihagyva"
            exit 0
          fi

          cd /tmp/raveos-core-repo
          git config user.name "Forgejo Actions"
          git config user.email "actions@forgejo.local"

          for pkg in $BUILT; do
            PKGFILE=$(basename "$pkg")
            PKGNAME=$(echo "$PKGFILE" | sed 's/-[0-9][^-]*-[^-]*-[^-]*\.pkg\.tar\.zst$//')
            rm -f "$CORE/${PKGNAME}-"*.pkg.tar.zst* 2>/dev/null || true
            cp -v "$pkg" "$CORE/"
            [ -f "$pkg.sig" ] && cp -v "$pkg.sig" "$CORE/"
          done

          export GNUPGHOME=/tmp/raveos-gnupg
          repo-add -s -k 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
              "$CORE/raveos-core-repo.db.tar.gz" "$CORE"/linux-cachyos-[^h]*.pkg.tar.zst
          repo-add -s -k 25C7668F1235F5664F037671BDB2A9CE6EBFF113 \
              "$CORE/raveos-core-repo.db.tar.gz" "$CORE"/linux-cachyos-headers-*.pkg.tar.zst

          git add -A
          git commit -m "kernel: linux-cachyos ${{ steps.check.outputs.PKGVER }}-${{ steps.check.outputs.PKGREL }}"
          git push origin main

          TAG="vrepo-$(date +%Y%m%d-%H%M%S)"
          git tag -a "$TAG" -m "linux-raveos ${GITHUB_SHA:0:7}"
          git push origin "$TAG"

          echo "::notice title=Kernel published::linux-raveos ${{ steps.check.outputs.PKGVER }}-${{ steps.check.outputs.PKGREL }}"

      - name: Cleanup
        if: always()
        run: |
          gpgconf --homedir /tmp/raveos-gnupg --kill gpg-agent || true
          sudo rm -rf /tmp/raveos-gnupg || true
          sudo rm -rf /tmp/builtpkgs || true
          sudo rm -rf /tmp/raveos-core-repo || true
          sudo rm -rf linux-raveos/src linux-raveos/pkg || true
          df -h
