convertis/.github/workflows/plugins.yml

name: Plugin Releases

on:
  push:
    branches: ["main"]
    paths:
      - "plugins/**"

env:
  CARGO_TERM_COLOR: always

jobs:
  build-package-publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-unknown-linux-gnu
      - name: Install discovery tools
        run: |
          sudo apt-get update
          sudo apt-get install -y jq
      - name: Discover changed plugins
        id: plugins
        env:
          BEFORE: ${{ gitea.event.before }}
          AFTER: ${{ gitea.sha }}
        run: |
          packaging/changed-plugins.sh "$BEFORE" "$AFTER" > .plugin-release-plan.json
          jq . .plugin-release-plan.json
          echo "count=$(jq '.["include"] | length' .plugin-release-plan.json)" >> "$GITHUB_OUTPUT"
      - uses: Swatinem/rust-cache@v2
        if: steps.plugins.outputs.count != '0'
      - name: Test plugin
        if: steps.plugins.outputs.count != '0'
        run: |
          while IFS= read -r plugin; do
            manifest=$(jq -r '.manifest' <<<"$plugin")
            engine_version=$(jq -r '.engine_version' <<<"$plugin")
            echo "Testing $manifest for engine $engine_version"
            CONVERTIS_ENGINE_VERSION="$engine_version" \
              cargo test --locked --manifest-path "$manifest"
          done < <(jq -c '.["include"][]' .plugin-release-plan.json)
      - name: Build plugin
        if: steps.plugins.outputs.count != '0'
        run: |
          mkdir -p plugin-artifacts
          while IFS= read -r plugin; do
            manifest=$(jq -r '.manifest' <<<"$plugin")
            engine_version=$(jq -r '.engine_version' <<<"$plugin")
            library=$(jq -r '.library' <<<"$plugin")
            echo "Building $manifest for engine $engine_version"
            CONVERTIS_ENGINE_VERSION="$engine_version" \
              cargo build --release --locked --manifest-path "$manifest" --target x86_64-unknown-linux-gnu
            cp "target/x86_64-unknown-linux-gnu/release/$library" plugin-artifacts/
          done < <(jq -c '.["include"][]' .plugin-release-plan.json)
      - uses: actions/setup-go@v5
        if: steps.plugins.outputs.count != '0'
        with:
          go-version: stable
      - name: Install packaging tools
        if: steps.plugins.outputs.count != '0'
        run: |
          go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v2.47.0
          sudo apt-get update
          sudo apt-get install -y rpm
      - name: Build plugin packages
        if: steps.plugins.outputs.count != '0'
        run: |
          export PATH="$HOME/go/bin:$PATH"
          while IFS= read -r plugin; do
            manifest=$(jq -r '.manifest' <<<"$plugin")
            packaging/build-plugin-package.sh deb "$manifest" target/x86_64-unknown-linux-gnu/release dist
            packaging/build-plugin-package.sh rpm "$manifest" target/x86_64-unknown-linux-gnu/release dist
          done < <(jq -c '.["include"][]' .plugin-release-plan.json)
      - name: Import GPG key
        if: steps.plugins.outputs.count != '0'
        id: import-gpg
        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}
      - name: Sign and verify RPM
        if: steps.plugins.outputs.count != '0'
        env:
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: |
          passphrase_file=$(mktemp)
          public_key_file=$(mktemp)
          trap 'rm -f "$passphrase_file" "$public_key_file"' EXIT
          printf '%s' "$GPG_PASSPHRASE" > "$passphrase_file"
          chmod 600 "$passphrase_file"
          echo "%_signature gpg" > ~/.rpmmacros
          echo "%_gpg_name ${{ steps.import-gpg.outputs.keyid }}" >> ~/.rpmmacros
          echo "%_gpg_path $HOME/.gnupg" >> ~/.rpmmacros
          echo "%_gpg_passphrase_file $passphrase_file" >> ~/.rpmmacros
          echo '%__gpg_sign_cmd /usr/bin/gpg --batch --yes --pinentry-mode loopback --passphrase-file %{_gpg_passphrase_file} --no-verbose --no-armor --no-secmem-warning -u %{_gpg_name} -sbo %{__signature_filename} -- %{__plaintext_filename}' >> ~/.rpmmacros
          rpm --addsign dist/*.rpm
          gpg --armor --export "${{ steps.import-gpg.outputs.keyid }}" > "$public_key_file"
          sudo rpm --import "$public_key_file"
          rpm --checksig --verbose dist/*.rpm | grep -Eq '[Ss]ignature.*: OK'
      - uses: actions/upload-artifact@v3
        if: steps.plugins.outputs.count != '0'
        with:
          name: plugin-packages
          if-no-files-found: error
          path: |
            plugin-artifacts/*
            dist/*
      - name: Publish plugin packages to Gitea
        if: steps.plugins.outputs.count != '0'
        env:
          GITEA_URL: ${{ gitea.server_url }}
          GITEA_OWNER: ${{ gitea.repository_owner }}
          TOKEN: ${{ secrets.PACKAGE_PAT }}
        run: |
          for package in dist/*.rpm; do
            code=$(curl -sS -w '%{http_code}' -o /dev/null -u "${{ gitea.actor }}:$TOKEN" --upload-file "$package" "$GITEA_URL/api/packages/$GITEA_OWNER/rpm/upload")
            test "$code" = 201 || test "$code" = 409
          done
          for package in dist/*.deb; do
            code=$(curl -sS -w '%{http_code}' -o /dev/null -u "${{ gitea.actor }}:$TOKEN" --upload-file "$package" "$GITEA_URL/api/packages/$GITEA_OWNER/debian/pool/debian/main/upload")
            test "$code" = 201 || test "$code" = 409
          done