name: bump-and-build

# Triggers:
#   - schedule: a daily cron (Gitea cron is UTC). Tune to taste.
#   - workflow_dispatch: run it manually from the Actions tab.
on:
  schedule:
    - cron: '17 4 * * *'   # 04:17 UTC daily
  workflow_dispatch: {}

# The auto-provided GITEA_TOKEN needs write access to push the bump back.
permissions:
  contents: write

jobs:
  update:
    # Label must match a runner that can run containers. `ubuntu-latest` is the
    # default act_runner label; swap for `docker` (or your runner's label) if needed.
    runs-on: ubuntu-latest
    container:
      image: archlinux:base-devel

    steps:
      - name: Install build tooling
        run: |
          set -euo pipefail
          pacman -Sy --noconfirm --needed curl libarchive git sudo

      - name: Checkout
        uses: https://gitea.com/actions/checkout@v4
        with:
          fetch-depth: 0

      # Mirror PKGBUILD's pkgver() exactly: pull the .deb, read control's Version,
      # strip the trailing "-release". Compare against the hardcoded pkgver line.
      - name: Detect upstream version
        id: ver
        run: |
          set -euo pipefail
          deb_url=$(grep -m1 '^_deb_url=' PKGBUILD | cut -d"'" -f2)
          upstream=$(curl -fsSL "$deb_url" \
            | bsdtar -xOf - control.tar.xz \
            | bsdtar -xOf - control \
            | awk -F': ' '/^Version:/ { print $2 }' \
            | sed 's/-release$//' \
            | tr -d '[:space:]')
          current=$(grep -m1 '^pkgver=' PKGBUILD | cut -d= -f2)
          echo "upstream=${upstream}" >> "$GITHUB_OUTPUT"
          echo "current=${current}"   >> "$GITHUB_OUTPUT"
          echo "Upstream: ${upstream}   Current: ${current}"

      - name: Bump PKGBUILD and regenerate .SRCINFO
        if: ${{ steps.ver.outputs.upstream != steps.ver.outputs.current }}
        env:
          UPSTREAM: ${{ steps.ver.outputs.upstream }}
        run: |
          set -euo pipefail
          sed -i "s/^pkgver=.*/pkgver=${UPSTREAM}/" PKGBUILD
          sed -i "s/^pkgrel=.*/pkgrel=1/"        PKGBUILD
          # Pin the upstream .deb's sha256 so the build is integrity-checked.
          deb_url=$(grep -m1 '^_deb_url=' PKGBUILD | cut -d"'" -f2)
          curl -fsSL "$deb_url" -o /tmp/cato-client-install.deb
          deb_sha=$(sha256sum /tmp/cato-client-install.deb | cut -d' ' -f1)
          sed -i "s/^  'SKIP'$/  '${deb_sha}'/" PKGBUILD
          makepkg --printsrcinfo > .SRCINFO

      # makepkg refuses to run as root, so build as an unprivileged user.
      - name: Build package (makepkg)
        if: ${{ steps.ver.outputs.upstream != steps.ver.outputs.current }}
        run: |
          set -euo pipefail
          useradd -m builder
          echo 'builder ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
          chown -R builder .
          sudo -u builder makepkg -s --noconfirm
      - name: Upload built package as artifact
        if: ${{ steps.ver.outputs.upstream != steps.ver.outputs.current }}
        continue-on-error: true
        uses: https://gitea.com/actions/upload-artifact@v4
        with:
          name: cato-client-bin-${{ steps.ver.outputs.upstream }}
          path: '*.pkg.tar.zst'
          if-no-files-found: warn

      - name: Commit and push the version bump
        if: ${{ steps.ver.outputs.upstream != steps.ver.outputs.current }}
        env:
          UPSTREAM: ${{ steps.ver.outputs.upstream }}
          TOKEN:   ${{ env.GITEA_TOKEN }}
          SERVER:  ${{ env.GITEA_SERVER_URL }}
        run: |
          set -euo pipefail
          git config user.email "actions@tesserakt.pro"
          git config user.name  "Gitea Actions"
          git add PKGBUILD .SRCINFO
          git commit -m "cato-client-bin: bump to ${UPSTREAM}"
          # Push over HTTPS using the workflow token. If your instance rejects the
          # 'oauth2' username, switch to '${{ gitea.actor }}:${TOKEN}'.
          remote="https://oauth2:${TOKEN}@${SERVER#https://}/${{ gitea.repository }}.git"
          git push "${remote}" HEAD:${{ gitea.ref_name }}