name: Build and Release

# Reusable workflow called by create-release-tag.yml after the tag is pushed.
# Builds the .deb, signs it, and publishes a GitHub Release.
# Can also be triggered manually via workflow_dispatch for re-runs.

on:
  workflow_call:
    inputs:
      tag:
        description: "The vX.Y.Z tag that was just pushed"
        required: true
        type: string
  workflow_dispatch:
    inputs:
      tag:
        description: "The vX.Y.Z tag to release (e.g. v1.0.2)"
        required: true
        type: string

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.tag }}
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract version from changelog
        id: version
        run: |
          VERSION=$(grep -m1 '(' debian/changelog | sed 's/.*(\(.*\)).*/\1/')
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "tag=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"

      - name: Install build dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y devscripts debhelper build-essential

      - name: Import GPG key
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
        run: |
          echo "$GPG_PRIVATE_KEY" | gpg --batch --import

      - name: Inject version into Config.pm
        env:
          BUILD_VERSION: ${{ steps.version.outputs.version }}
        run: |
          perl -i -pe 'BEGIN { $v = $ENV{BUILD_VERSION} }
            s/(our \$VERSION\s*=\s*'"'"')[^'"'"']*'"'"';/${1}$v'"'"';/
          ' src/modules/node_info/files/Config.pm

      - name: Generate dynamic debian rules
        run: |
          bash build/gen-rules.sh >> debian/rules

      - name: Build deb package
        run: |
          dpkg-buildpackage -us -uc -b
          ls -lh ../pve-mod_*.deb

      - name: Sign deb package
        env:
          GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
        run: |
          DEB=$(ls ../pve-mod_*.deb)
          gpg --batch --armor --detach-sign --local-user "$GPG_KEY_ID" -o "${DEB}.asc" "$DEB"
          gpg --verify "${DEB}.asc" "$DEB"

      - name: Generate and sign checksums
        env:
          GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
        run: |
          DEB=$(ls ../pve-mod_*.deb)
          sha256sum "$DEB" > /tmp/SHA256SUMS
          gpg --batch --armor --detach-sign --local-user "$GPG_KEY_ID" \
            -o /tmp/SHA256SUMS.asc /tmp/SHA256SUMS

      - name: Extract release notes from changelog
        id: notes
        run: |
          awk '
            /^pve-mod \(/ { if (found) exit; found=1; next }
            found && /^ --/ { exit }
            found { print }
          ' debian/changelog | grep '^\s*\*' | sed 's/^\s*\* /- /' > /tmp/notes.md
          [[ -s /tmp/notes.md ]] || echo "- Automated release." > /tmp/notes.md

      - name: Collect release assets
        id: assets
        run: |
          DEB=$(ls ../pve-mod_*.deb)
          echo "deb=$DEB" >> "$GITHUB_OUTPUT"
          echo "deb_asc=${DEB}.asc" >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG:      ${{ steps.version.outputs.tag }}
          DEB:      ${{ steps.assets.outputs.deb }}
          DEB_ASC:  ${{ steps.assets.outputs.deb_asc }}
        run: |
          ASSETS="$DEB $DEB_ASC /tmp/SHA256SUMS /tmp/SHA256SUMS.asc"

          gh release create "$TAG" \
            --title "pve-mod $TAG" \
            --notes-file /tmp/notes.md \
            $ASSETS