name: Update pacman repo DB (repo-add)

on:
  push:
    tags:
      - "v*"
      - "vrepo-*"
  workflow_dispatch:

jobs:
  repoadd:
    runs-on: iso-builder

    steps:
      - name: Checkout repository via SSH
        run: |
          git clone --depth 1 git@git.rp1.hu:RaveOS/raveos-core-repo.git "${GITHUB_WORKSPACE}"

      - name: Install repo-add (pacman-contrib)
        run: |
          set -euo pipefail
          sudo pacman -S --needed --noconfirm pacman-contrib

      - name: Import GPG signing key
        run: |
          set -euo pipefail
          export GNUPGHOME=/tmp/raveos-gnupg
          rm -rf "$GNUPGHOME"
          mkdir -m 700 "$GNUPGHOME"
          echo "${{ secrets.GPG_PRIVATE_KEY }}" | base64 -d | gpg --batch --import
          echo "gpg-agent-cache-prime" | gpg --batch --yes --pinentry-mode loopback \
              --passphrase "${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }}" \
              -u 25C7668F1235F5664F037671BDB2A9CE6EBFF113 --detach-sign --output /dev/null

      - name: Rebuild repo DB files
        run: |
          set -euo pipefail
          export GNUPGHOME=/tmp/raveos-gnupg

          REPO_NAME="raveos-core-repo"

          if [ ! -d "x86_64" ]; then
            echo "ERROR: x86_64 directory not found!"
            exit 1
          fi

          cd x86_64

          rm -f "${REPO_NAME}.db" \
                "${REPO_NAME}.files" \
                "${REPO_NAME}.db.tar.xz" \
                "${REPO_NAME}.files.tar.xz" \
                "${REPO_NAME}.db.tar.xz.old" \
                "${REPO_NAME}.files.tar.xz.old" \
                "${REPO_NAME}.db.sig" \
                "${REPO_NAME}.files.sig" \
                "${REPO_NAME}.db.tar.xz.sig" \
                "${REPO_NAME}.files.tar.xz.sig" || true

          repo-add -s -k 25C7668F1235F5664F037671BDB2A9CE6EBFF113 "${REPO_NAME}.db.tar.xz" ./*.pkg.tar.zst

          ln -sf "${REPO_NAME}.db.tar.xz" "${REPO_NAME}.db"
          ln -sf "${REPO_NAME}.files.tar.xz" "${REPO_NAME}.files"
          ln -sf "${REPO_NAME}.db.tar.xz.sig" "${REPO_NAME}.db.sig"
          ln -sf "${REPO_NAME}.files.tar.xz.sig" "${REPO_NAME}.files.sig"

          echo "=== DB files created ==="
          ls -la | grep -E "${REPO_NAME}\.(db|files)"

      - name: Commit and push updated DB files (to main)
        run: |
          set -euo pipefail

          cd "${GITHUB_WORKSPACE}"

          git config user.name "Forgejo Actions"
          git config user.email "actions@forgejo.local"

          git fetch origin main
          git checkout -B main origin/main

          git add x86_64/raveos-core-repo.db* x86_64/raveos-core-repo.files* || true

          if git diff --staged --quiet; then
            echo "No DB changes, nothing to commit."
            exit 0
          fi

          git commit -m "Update pacman repo DB (repo-add)"
          git push origin main

      - name: Cleanup old tags (keep last 5)
        run: |
          cd "${GITHUB_WORKSPACE}"
          git fetch --tags
          OLD_TAGS=$(git tag --sort=-creatordate | tail -n +6)
          if [ -z "$OLD_TAGS" ]; then
            echo "Nincs torlendo tag."
          else
            echo "$OLD_TAGS" | while read -r tag; do
              git push origin --delete "$tag" && echo "Tag torolve: $tag" || echo "Tag torles sikertelen: $tag"
            done
          fi

      - name: Cleanup
        if: always()
        run: |
          export GNUPGHOME=/tmp/raveos-gnupg
          gpgconf --kill gpg-agent 2>/dev/null || true
          rm -rf /tmp/raveos-gnupg
          sudo rm -rf /var/cache/pacman/pkg/* || true
          df -h