name: AUR Publish

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag (e.g. v0.1.0)"
        required: true

permissions:
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      # Secret-gated so tag pushes made before AUR_SSH_PRIVATE_KEY is set up
      # (see packaging/aur/README.md for the one-time onboarding flow) do not
      # red-X the Release. Once the secret is configured, subsequent tag
      # pushes publish to AUR automatically with no other changes.
      - name: Check AUR secret presence
        id: check
        env:
          AUR_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
        run: |
          if [ -z "$AUR_KEY" ]; then
            echo "::notice::AUR_SSH_PRIVATE_KEY is not set; skipping AUR publish. See packaging/aur/README.md for one-time setup."
            echo "skip=true" >> "$GITHUB_OUTPUT"
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Resolve tag
        if: steps.check.outputs.skip == 'false'
        id: tag
        run: |
          if [ "${{ github.event_name }}" = "push" ]; then
            tag="${{ github.ref_name }}"
          else
            tag="${{ inputs.tag }}"
          fi
          # AUR pkgver disallows '-' (reserved for the pkgrel delimiter),
          # so strip the RTM gate suffix before stamping PKGBUILD. Tag
          # name itself is preserved for the source URL.
          version="${tag#v}"
          version="${version%%-RTM*}"
          echo "tag=$tag" >> "$GITHUB_OUTPUT"
          echo "version=$version" >> "$GITHUB_OUTPUT"

      - name: Render PKGBUILD (stamp version + sha256)
        if: steps.check.outputs.skip == 'false'
        id: render
        run: |
          set -e
          version="${{ steps.tag.outputs.version }}"
          tag="${{ steps.tag.outputs.tag }}"
          url="https://github.com/${{ github.repository }}/archive/${tag}.tar.gz"

          # GitHub generates the archive tarball on first request; give it
          # a few attempts in case the tag-push → archive materialization
          # has a small race window.
          for i in 1 2 3 4 5; do
            sha=$(curl -sSL "$url" | sha256sum | awk '{print $1}')
            # sha256 of empty string → don't accept it.
            if [ "$sha" != "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" ] \
              && [ -n "$sha" ]; then
              break
            fi
            echo "archive not ready yet, retrying ($i/5)..."
            sleep 5
          done
          if [ -z "$sha" ]; then
            echo "failed to compute sha256 for $url" >&2
            exit 1
          fi
          echo "sha256: $sha"

          # Anchor on the assignment lines so the template comment at the
          # top (which mentions __PKGVER__ / __SHA256__ literally) is not
          # also rewritten — otherwise the published PKGBUILD ships with
          # the stamped values inlined into the explanatory text.
          sed -e "s|^pkgver=__PKGVER__$|pkgver=${version}|" \
              -e "s|^sha256sums=('__SHA256__')$|sha256sums=('${sha}')|" \
              packaging/aur/PKGBUILD > PKGBUILD.rendered
          mv PKGBUILD.rendered packaging/aur/PKGBUILD
          echo "---- rendered PKGBUILD ----"
          cat packaging/aur/PKGBUILD

      # KSXGitHub/github-actions-deploy-aur handles: makepkg-style SRCINFO
      # regeneration, SSH key material setup, ssh-keyscan of aur.archlinux.org,
      # and the git clone/commit/push to ssh://aur@aur.archlinux.org/<pkg>.git.
      # Pinned to v4.1.3 (specific patch) — v2 floating tag has an upstream
      # regression that fails with `bash: --command: invalid option`
      # (upstream issue #50, fixed 2026-04-18). v3+ uses the same input
      # shape, so the pin is safe.
      - name: Publish to AUR
        if: steps.check.outputs.skip == 'false'
        uses: KSXGitHub/github-actions-deploy-aur@v4.1.3
        with:
          pkgname: winpodx
          pkgbuild: packaging/aur/PKGBUILD
          # #255 PR 4: ship the install scriptlet alongside PKGBUILD so
          # pacman's install= directive resolves at install time. Without
          # this, the post_install / post_remove banners + cleanup hook
          # don't fire (the PKGBUILD references winpodx.install but the
          # AUR repo wouldn't have the file).
          assets: |
            packaging/aur/winpodx.install
          commit_username: kernalix7
          commit_email: kernalix7@kodenet.io
          ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
          commit_message: "Update to ${{ steps.tag.outputs.version }}"
          ssh_keyscan_types: rsa,ecdsa,ed25519