neiam /neiam-devices

name: Package

# Packaging follows ppl's pipeline (cargo-deb / cargo-generate-rpm,
# stamped versions, publishing to the forge's registries), minus the
# parts that only make sense for a Rust binary: nothing here compiles.

on:
  push:
    branches: [ master ]
    tags: [ 'v*' ]
  pull_request:
    branches: [ master ]

env:
  CARGO_TERM_COLOR: always

jobs:
  package:
    # One runner, not ppl's per-arch matrix: every package here is
    # architecture-independent, and two runners would each upload the
    # same noarch filename -- the second one is refused with a 409.
    runs-on: arc-runner-set
    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@v4

      # Stdlib only, so the runner needs no numpy/Pillow. Catches a
      # render dropped in at the wrong size or a resolution added to one
      # theme and not the other.
      - name: Check the images
        run: python3 tools/standins.py --check

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2

      - name: Install the packaging tools
        run: |
          set -euo pipefail
          cargo install cargo-deb --locked
          cargo install cargo-generate-rpm --locked

      # Same scheme as ppl: `+dev.<stamp>` on branch builds so every
      # build is a distinct, later version; a tag publishes the bare
      # version. The first `version = ` in the root manifest is the
      # workspace version every package inherits.
      - name: Stamp the package version
        run: |
          set -euo pipefail
          base=$(grep -m1 '^version = ' Cargo.toml | cut -d'"' -f2)

          if [ "${GITHUB_REF_TYPE:-}" = "tag" ]; then
            version="$base"
          else
            version="$base+dev.$(date -u +%s)"
          fi

          echo "version: $version"
          sed -i "0,/^version = .*/s//version = \"$version\"/" Cargo.toml

      - name: Build Debian packages
        run: |
          set -euo pipefail
          cargo deb -p plymouth-theme-neiam --no-build --no-strip
          cargo deb -p sddm-theme-neiam --no-build --no-strip
          tools/deb-arch-all.sh target/debian/*.deb

      - name: Build RPM packages
        run: |
          set -euo pipefail
          cargo generate-rpm -p plymouth -a noarch
          cargo generate-rpm -p sddm -a noarch

      - name: Resolve the forge URL
        env:
          CI_FORGE_URL: ${{ vars.CI_FORGE_URL }}
        run: |
          set -euo pipefail
          forge_url=${CI_FORGE_URL:-${GITHUB_SERVER_URL:-}}

          case "${forge_url:-}" in
            "")
              echo "No forge URL available; not publishing."
              echo "PUBLISH=false" >> "$GITHUB_ENV"
              ;;
            *://github.com|*://github.com/*|*://www.github.com*)
              echo "Running on GitHub, which has no package registry here."
              echo "PUBLISH=false" >> "$GITHUB_ENV"
              ;;
            *)
              echo "publishing to $forge_url"
              echo "FORGE_URL=$forge_url" >> "$GITHUB_ENV"
              echo "PUBLISH=true" >> "$GITHUB_ENV"
              ;;
          esac

      - name: Publish the .debs and the .rpms to the forge
        if: github.event_name != 'pull_request' && env.PUBLISH == 'true'
        env:
          REPOSITORY: ${{ github.repository }}
          TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          for deb in target/debian/*.deb; do
            echo "publishing $deb"
            curl --fail-with-body -sS \
              -u "gitgud-actions:$TOKEN" \
              -H "Content-Type: application/vnd.debian.binary-package" \
              --data-binary "@$deb" \
              "$FORGE_URL/pkg/deb/$REPOSITORY/upload?dist=stable&component=main"
            echo
          done

          for rpm in target/generate-rpm/*.rpm; do
            echo "publishing $rpm"
            curl --fail-with-body -sS \
              -u "gitgud-actions:$TOKEN" \
              -H "Content-Type: application/x-rpm" \
              --data-binary "@$rpm" \
              "$FORGE_URL/pkg/rpm/$REPOSITORY/upload"
            echo
          done

      - name: How to install it
        if: github.event_name != 'pull_request' && env.PUBLISH == 'true'
        env:
          OWNER: ${{ github.repository_owner }}
        run: |
          cat <<EOF
          # Debian / Ubuntu
          curl -fsSL $FORGE_URL/pkg/_keys/deb/$OWNER | sudo tee /etc/apt/keyrings/$OWNER.asc >/dev/null
          echo "deb [signed-by=/etc/apt/keyrings/$OWNER.asc] $FORGE_URL/pkg/deb/$OWNER/_all stable main" | sudo tee /etc/apt/sources.list.d/$OWNER.list
          sudo apt update && sudo apt install plymouth-theme-neiam sddm-theme-neiam

          # Fedora / RHEL / openSUSE — /etc/yum.repos.d/$OWNER.repo
          [$OWNER]
          name=$OWNER
          baseurl=$FORGE_URL/pkg/rpm/$OWNER/_all
          enabled=1
          repo_gpgcheck=1
          # cargo-generate-rpm produces unsigned packages; the forge
          # signs the index, not what it was handed.
          gpgcheck=0
          gpgkey=$FORGE_URL/pkg/_keys/rpm/$OWNER
          EOF

      # Artifact storage is a GitHub feature; off GitHub these skip
      # rather than fail, as in ppl.
      - name: Upload Debian packages
        uses: actions/upload-artifact@v4
        if: ${{ startsWith(github.server_url, 'https://github.com') }}
        with:
          name: neiam-device-debs
          path: target/debian/*.deb

      - name: Upload RPM packages
        uses: actions/upload-artifact@v4
        if: ${{ startsWith(github.server_url, 'https://github.com') }}
        with:
          name: neiam-device-rpms
          path: target/generate-rpm/*.rpm