release.yml

on:
  push:
    tags:
      - v[0-9]+.*
      - testing-ci.*

name: Build Packages

jobs:
  build-deb:
    name: Debian
    runs-on: ubuntu-latest
    container: ubuntu:20.04

    steps:
    - name: Checkout code
      uses: actions/checkout@v3

    - name: Install build dependencies
      run: |
        echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections
        sed 's/^deb /deb-src /' /etc/apt/sources.list >> /etc/apt/sources.list
        apt-get -q -y update
        apt-get -q -y install build-essential debhelper dpkg-sig fakeroot wget git meson \
            python3-pyudev python3-pytest python3-libevdev sudo gpg
        apt-get -q -y build-dep libwacom libwacom-dev

        # makedeb
        wget -qO - 'https://proget.makedeb.org/debian-feeds/makedeb.pub' \
          | gpg --dearmor \
          | sudo tee /usr/share/keyrings/makedeb-archive-keyring.gpg 1> /dev/null

        echo 'deb [signed-by=/usr/share/keyrings/makedeb-archive-keyring.gpg arch=all] https://proget.makedeb.org/ makedeb main' \
          | sudo tee /etc/apt/sources.list.d/makedeb.list

        sudo apt update

        apt-get -q -y update
        apt-get -q -y install makedeb

    - name: Build package
      run: |
        cd pkg/debian
        ./updlinks.sh

        # Fix permissions (can't makepkg as root)
        useradd -m build
        echo "build ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
        chown -R build .

        # Import GPG key for liwbacom/Peter Hutterer
        su build --pty -s /bin/bash -c 'gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 3C2C43D9447D5938EF4551EBE23B7E70B467F0BF'

        # build package
        su build --pty -s /bin/bash -c 'makedeb --sync-deps --no-confirm --skip-pgp-check'

    - name: Sign package
      env:
        GPG_KEY_ID: 56C464BAAC421453
        GPG_KEY: ${{ secrets.LINUX_SURFACE_GPG_KEY }}
      run: |
        cd pkg/debian

        # import GPG key
        echo "$GPG_KEY" | base64 -d | gpg --import --no-tty --batch --yes
        export GPG_TTY=$(tty)

        # sign package
        dpkg-sig -g "--batch --no-tty" --sign builder -k $GPG_KEY_ID ./*.deb

    - name: Prepare release
      run: |
        mkdir release
        rm -f ./pkg/debian/libwacom-surface-dbgsym_*.deb || true
        mv ./pkg/debian/*.deb release

    - name: Upload artifacts
      uses: actions/upload-artifact@v3
      with:
        name: debian-latest
        path: release

  build-f41:
    name: Build Fedora 41 package
    runs-on: ubuntu-latest
    container:
      image: registry.fedoraproject.org/fedora:41
      options: --security-opt seccomp=unconfined
    steps:
    - name: Checkout code
      uses: actions/checkout@v3

    - name: Install build dependencies
      run: |
        dnf distro-sync -y
        dnf install -y make rpmdevtools rpm-sign 'dnf-command(builddep)'
        dnf builddep -y pkg/fedora/libwacom-surface.spec

    - name: Build package
      run: |
        cd pkg/fedora

        # Build the .rpm packages
        ./makerpm

    - name: Sign packages
      env:
        GPG_KEY_ID: 56C464BAAC421453
        GPG_KEY: ${{ secrets.LINUX_SURFACE_GPG_KEY }}
      run: |
        cd pkg/fedora/out

        # import GPG key
        echo "$GPG_KEY" | base64 -d | gpg --import --no-tty --batch --yes

        # sign package
        cd noarch
        rpm --resign *.rpm --define "_gpg_name $GPG_KEY_ID"

        cd ..

        cd x86_64
        rpm --resign *.rpm --define "_gpg_name $GPG_KEY_ID"

    - name: Prepare artifacts
      run: |
        cd pkg/fedora
        mkdir release

        cp out/noarch/* release/
        cp out/x86_64/* release/

        rm release/libwacom-surface-devel-*

    - name: Upload artifacts
      uses: actions/upload-artifact@v3
      with:
        name: fedora-41-latest
        path: pkg/fedora/release

  build-f40:
    name: Build Fedora 40 package
    runs-on: ubuntu-latest
    container:
      image: registry.fedoraproject.org/fedora:40
      options: --security-opt seccomp=unconfined
    steps:
    - name: Checkout code
      uses: actions/checkout@v3

    - name: Install build dependencies
      run: |
        dnf distro-sync -y
        dnf install -y make rpmdevtools rpm-sign 'dnf-command(builddep)'
        dnf builddep -y pkg/fedora/libwacom-surface.spec

    - name: Build package
      run: |
        cd pkg/fedora

        # Build the .rpm packages
        ./makerpm

    - name: Sign packages
      env:
        GPG_KEY_ID: 56C464BAAC421453
        GPG_KEY: ${{ secrets.LINUX_SURFACE_GPG_KEY }}
      run: |
        cd pkg/fedora/out

        # import GPG key
        echo "$GPG_KEY" | base64 -d | gpg --import --no-tty --batch --yes

        # sign package
        cd noarch
        rpm --resign *.rpm --define "_gpg_name $GPG_KEY_ID"

        cd ..

        cd x86_64
        rpm --resign *.rpm --define "_gpg_name $GPG_KEY_ID"

    - name: Prepare artifacts
      run: |
        cd pkg/fedora
        mkdir release

        cp out/noarch/* release/
        cp out/x86_64/* release/

        rm release/libwacom-surface-devel-*

    - name: Upload artifacts
      uses: actions/upload-artifact@v3
      with:
        name: fedora-40-latest
        path: pkg/fedora/release

  build-f39:
    name: Build Fedora 39 package
    runs-on: ubuntu-latest
    container:
      image: registry.fedoraproject.org/fedora:39
      options: --security-opt seccomp=unconfined
    steps:
    - name: Checkout code
      uses: actions/checkout@v3

    - name: Install build dependencies
      run: |
        dnf distro-sync -y
        dnf install -y make rpmdevtools rpm-sign 'dnf-command(builddep)'
        dnf builddep -y pkg/fedora/libwacom-surface.spec

    - name: Build package
      run: |
        cd pkg/fedora

        # Build the .rpm packages
        ./makerpm

    - name: Sign packages
      env:
        GPG_KEY_ID: 56C464BAAC421453
        GPG_KEY: ${{ secrets.LINUX_SURFACE_GPG_KEY }}
      run: |
        cd pkg/fedora/out

        # import GPG key
        echo "$GPG_KEY" | base64 -d | gpg --import --no-tty --batch --yes

        # sign package
        cd noarch
        rpm --resign *.rpm --define "_gpg_name $GPG_KEY_ID"

        cd ..

        cd x86_64
        rpm --resign *.rpm --define "_gpg_name $GPG_KEY_ID"

    - name: Prepare artifacts
      run: |
        cd pkg/fedora
        mkdir release

        cp out/noarch/* release/
        cp out/x86_64/* release/

        rm release/libwacom-surface-devel-*

    - name: Upload artifacts
      uses: actions/upload-artifact@v3
      with:
        name: fedora-39-latest
        path: pkg/fedora/release

  release:
    name: Publish release
    needs: [build-deb, build-f41, build-f40, build-f39]
    runs-on: ubuntu-latest
    steps:
    - name: Download Debian artifacts
      uses: actions/download-artifact@v3
      with:
        name: debian-latest
        path: debian-latest

    - name: Download Fedora 40 artifacts
      uses: actions/download-artifact@v3
      with:
        name: fedora-40-latest
        path: fedora-40-latest

    - name: Download Fedora 39 artifacts
      uses: actions/download-artifact@v3
      with:
        name: fedora-39-latest
        path: fedora-39-latest

    - name: Upload assets
      uses: svenstaro/upload-release-action@v2
      with:
        repo_token: ${{ secrets.GITHUB_TOKEN }}
        file: ./*-latest/*
        tag: ${{ github.ref }}
        overwrite: true
        file_glob: true

  repo-deb:
    name: Update Debian package repository
    needs: [release]
    runs-on: ubuntu-latest
    container: debian:sid
    steps:
    - name: Install dependencies
      run: |
        apt-get update
        apt-get install -y git

    - name: Download artifacts
      uses: actions/download-artifact@v3
      with:
        name: debian-latest
        path: debian-latest

    - name: Update repository
      env:
        SURFACEBOT_TOKEN: ${{ secrets.LINUX_SURFACE_BOT_TOKEN }}
        BRANCH_STAGING: u/staging
        GIT_REF: ${{ github.ref }}
      run: |
        repo="https://surfacebot:${SURFACEBOT_TOKEN}@github.com/linux-surface/repo.git"

        # clone package repository
        git clone -b "${BRANCH_STAGING}" "${repo}" repo

        # copy packages
        cp debian-latest/* repo/debian/
        cd repo/debian

        # parse git tag from ref
        GIT_TAG=$(echo $GIT_REF | sed 's|^refs/tags/||g')

        # convert packages into references
        for pkg in $(find . -name '*.deb'); do
          echo "libwacom-surface:$GIT_TAG/$(basename $pkg)" > $pkg.blob
          rm $pkg
        done

        # set git identity
        git config --global user.email "surfacebot@users.noreply.github.com"
        git config --global user.name "surfacebot"

        # commit and push
        update_branch="${BRANCH_STAGING}-$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)"
        git switch -c "${update_branch}"
        git add .
        git commit -m "Update Debian libwacom"
        git push --set-upstream origin "${update_branch}"

  repo-f41:
    name: Update Fedora 41 package repository
    needs: [release]
    runs-on: ubuntu-latest
    container:
      image: registry.fedoraproject.org/fedora:41
      options: --security-opt seccomp=unconfined
    steps:
    - name: Install dependencies
      run: |
        dnf install -y git findutils

    - name: Download artifacts
      uses: actions/download-artifact@v3
      with:
        name: fedora-41-latest
        path: fedora-41-latest

    - name: Update repository
      env:
        SURFACEBOT_TOKEN: ${{ secrets.LINUX_SURFACE_BOT_TOKEN }}
        BRANCH_STAGING: u/staging
        GIT_REF: ${{ github.ref }}
      run: |
        repo="https://surfacebot:${SURFACEBOT_TOKEN}@github.com/linux-surface/repo.git"

        # clone package repository
        git clone -b "${BRANCH_STAGING}" "${repo}" repo

        # copy packages
        cp fedora-41-latest/* repo/fedora/f41
        cd repo/fedora/f41

        # parse git tag from ref
        GIT_TAG=$(echo $GIT_REF | sed 's|^refs/tags/||g')

        # convert packages into references
        for pkg in $(find . -name '*.rpm'); do
          echo "libwacom-surface:$GIT_TAG/$(basename $pkg)" > $pkg.blob
          rm $pkg
        done

        # set git identity
        git config --global user.email "surfacebot@users.noreply.github.com"
        git config --global user.name "surfacebot"

        # commit and push
        update_branch="${BRANCH_STAGING}-$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)"
        git checkout -b "${update_branch}"
        git add .
        git commit -m "Update Fedora 41 libwacom"
        git push --set-upstream origin "${update_branch}"

  repo-f40:
    name: Update Fedora 40 package repository
    needs: [release]
    runs-on: ubuntu-latest
    container:
      image: registry.fedoraproject.org/fedora:40
      options: --security-opt seccomp=unconfined
    steps:
    - name: Install dependencies
      run: |
        dnf install -y git findutils

    - name: Download artifacts
      uses: actions/download-artifact@v3
      with:
        name: fedora-40-latest
        path: fedora-40-latest

    - name: Update repository
      env:
        SURFACEBOT_TOKEN: ${{ secrets.LINUX_SURFACE_BOT_TOKEN }}
        BRANCH_STAGING: u/staging
        GIT_REF: ${{ github.ref }}
      run: |
        repo="https://surfacebot:${SURFACEBOT_TOKEN}@github.com/linux-surface/repo.git"

        # clone package repository
        git clone -b "${BRANCH_STAGING}" "${repo}" repo

        # copy packages
        cp fedora-40-latest/* repo/fedora/f40
        cd repo/fedora/f40

        # parse git tag from ref
        GIT_TAG=$(echo $GIT_REF | sed 's|^refs/tags/||g')

        # convert packages into references
        for pkg in $(find . -name '*.rpm'); do
          echo "libwacom-surface:$GIT_TAG/$(basename $pkg)" > $pkg.blob
          rm $pkg
        done

        # set git identity
        git config --global user.email "surfacebot@users.noreply.github.com"
        git config --global user.name "surfacebot"

        # commit and push
        update_branch="${BRANCH_STAGING}-$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)"
        git checkout -b "${update_branch}"
        git add .
        git commit -m "Update Fedora 40 libwacom"
        git push --set-upstream origin "${update_branch}"

  repo-f39:
    name: Update Fedora 39 package repository
    needs: [release]
    runs-on: ubuntu-latest
    container:
      image: registry.fedoraproject.org/fedora:39
      options: --security-opt seccomp=unconfined
    steps:
    - name: Install dependencies
      run: |
        dnf install -y git findutils

    - name: Download artifacts
      uses: actions/download-artifact@v3
      with:
        name: fedora-39-latest
        path: fedora-39-latest

    - name: Update repository
      env:
        SURFACEBOT_TOKEN: ${{ secrets.LINUX_SURFACE_BOT_TOKEN }}
        BRANCH_STAGING: u/staging
        GIT_REF: ${{ github.ref }}
      run: |
        repo="https://surfacebot:${SURFACEBOT_TOKEN}@github.com/linux-surface/repo.git"

        # clone package repository
        git clone -b "${BRANCH_STAGING}" "${repo}" repo

        # copy packages
        cp fedora-39-latest/* repo/fedora/f39
        cd repo/fedora/f39

        # parse git tag from ref
        GIT_TAG=$(echo $GIT_REF | sed 's|^refs/tags/||g')

        # convert packages into references
        for pkg in $(find . -name '*.rpm'); do
          echo "libwacom-surface:$GIT_TAG/$(basename $pkg)" > $pkg.blob
          rm $pkg
        done

        # set git identity
        git config --global user.email "surfacebot@users.noreply.github.com"
        git config --global user.name "surfacebot"

        # commit and push
        update_branch="${BRANCH_STAGING}-$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)"
        git checkout -b "${update_branch}"
        git add .
        git commit -m "Update Fedora 39 libwacom"
        git push --set-upstream origin "${update_branch}"