name: Build and Release RaveOS ISO

on:
  push:
    branches: ["main"]
  workflow_dispatch:

jobs:
  build-iso:
    runs-on: iso-builder

    env:
      TMPDIR: ${{ github.workspace }}/.tmp
      GIT_TMPDIR: ${{ github.workspace }}/.tmp

    steps:
      - name: Checkout build repository
        uses: actions/checkout@v4

      - name: Prepare temp directories (NO /tmp usage)
        run: |
          mkdir -p "${GITHUB_WORKSPACE}/.tmp"
          mkdir -p "${GITHUB_WORKSPACE}/release-tmp"
          df -h

      - name: Fix raveos-core-repo pacman repo (overwrite clean) 
        run: |
          sudo sed -i '/^\[raveos-core-repo\]/,/^$/d' /etc/pacman.conf
          cat <<'EOF' | sudo tee -a /etc/pacman.conf
          [raveos-core-repo]
          SigLevel = Never TrustAll
          Server = https://page.rp1.hu/x86_64/
          EOF

      - name: Update pacman databases
        run: sudo pacman -Sy --noconfirm

      - name: Verify archiso
        run: mkarchiso --version

      - name: Setup Chaotic-AUR
        run: |
          if [ ! -f /etc/pacman.d/chaotic-mirrorlist ]; then
            sudo mkdir -p /etc/pacman.d
            echo 'Server = https://cdn-mirror.chaotic.cx/$repo/$arch' | sudo tee /etc/pacman.d/chaotic-mirrorlist
            sudo pacman-key --recv-key 3056513887B78AEB --keyserver keyserver.ubuntu.com || true
            sudo pacman-key --lsign-key 3056513887B78AEB || true
            sudo pacman -U --noconfirm \
              https://cdn-mirror.chaotic.cx/chaotic-aur/chaotic-keyring.pkg.tar.zst \
              https://cdn-mirror.chaotic.cx/chaotic-aur/chaotic-mirrorlist.pkg.tar.zst || true
          fi

      - name: Build ISO
        run: |
          chmod +x ./build.sh
          sudo ./build.sh

      - name: Check build output
        run: |
          ls -lh output/*.iso

      - name: Generate release info
        run: |
          ISO_FILE=$(ls output/*.iso | head -1)
          ISO_NAME=$(basename "$ISO_FILE")
          ISO_SIZE=$(du -h "$ISO_FILE" | cut -f1)
          ISO_SHA256=$(sha256sum "$ISO_FILE" | cut -d' ' -f1)
          BUILD_DATE=$(date '+%Y-%m-%d %H:%M:%S')
          COMMIT_SHA=${GITHUB_SHA}
          COMMIT_SHORT=${GITHUB_SHA::7}

          cat <<EOF > release-info.md
          # RaveOS Latest Release

          **Build Date:** ${BUILD_DATE}  
          **Filename:** ${ISO_NAME}  
          **Size:** ${ISO_SIZE}  
          **SHA256:** ${ISO_SHA256}  
          **Source Commit:** ${COMMIT_SHORT}

          ## Download

          [Download ${ISO_NAME}](https://git.rp1.hu/RaveOS/RaveOS-Releases/raw/branch/main/${ISO_NAME})

          ## Verification

          \`\`\`bash
          wget https://git.rp1.hu/RaveOS/RaveOS-Releases/raw/branch/main/${ISO_NAME}
          echo "${ISO_SHA256}  ${ISO_NAME}" | sha256sum -c
          \`\`\`
          EOF

          cat release-info.md


      - name: Push ISO to Releases repository
        run: |
          set -e

          cd "${GITHUB_WORKSPACE}/release-tmp"
          rm -rf ./*

          git clone --depth=1 git@git.rp1.hu:RaveOS/RaveOS-Releases.git .
          git config user.name "RaveOS Builder"
          git config user.email "builder@raveos.local"

          rm -f *.iso
          cp "${GITHUB_WORKSPACE}/output/"*.iso .
          cp "${GITHUB_WORKSPACE}/release-info.md" README.md

          git add .
          git commit -m "Release $(ls *.iso)"
          git push origin main

      - name: Cleanup (SAFE)
        if: always()
        run: |
          sudo umount -R "${GITHUB_WORKSPACE}/work" 2>/dev/null || true
          sudo umount -R "${GITHUB_WORKSPACE}/output" 2>/dev/null || true
          sudo rm -rf "${GITHUB_WORKSPACE}/work"
          sudo rm -rf "${GITHUB_WORKSPACE}/output"
          sudo rm -rf "${GITHUB_WORKSPACE}/release-tmp"
          sudo rm -rf "${GITHUB_WORKSPACE}/.tmp"
          sudo rm -rf /var/cache/pacman/pkg/*
          df -h