name: Plugin Releases

on:
  push:
    branches: ["main"]
    paths:
      - "plugins/**"

env:
  CARGO_TERM_COLOR: always

jobs:
  detect:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.plugins.outputs.matrix }}
      count: ${{ steps.plugins.outputs.count }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: dtolnay/rust-toolchain@stable
      - name: Install discovery tools
        run: |
          sudo apt-get update
          sudo apt-get install -y jq
      - name: Discover changed plugins
        id: plugins
        env:
          BEFORE: ${{ gitea.event.before }}
          AFTER: ${{ gitea.sha }}
        run: |
          matrix=$(packaging/changed-plugins.sh "$BEFORE" "$AFTER")
          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
          echo "count=$(jq '.include | length' <<<"$matrix")" >> "$GITHUB_OUTPUT"

  build-package-publish:
    needs: detect
    if: needs.detect.outputs.count != '0'
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.detect.outputs.matrix) }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-unknown-linux-gnu
      - uses: Swatinem/rust-cache@v2
      - name: Test plugin
        env:
          CONVERTIS_ENGINE_VERSION: ${{ matrix.engine_version }}
        run: cargo test --locked --manifest-path "${{ matrix.manifest }}"
      - name: Build plugin
        env:
          CONVERTIS_ENGINE_VERSION: ${{ matrix.engine_version }}
        run: cargo build --release --locked --manifest-path "${{ matrix.manifest }}" --target x86_64-unknown-linux-gnu
      - uses: actions/setup-go@v5
        with:
          go-version: stable
      - name: Install packaging tools
        run: |
          go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v2.47.0
          sudo apt-get update
          sudo apt-get install -y rpm
      - name: Build plugin packages
        run: |
          export PATH="$HOME/go/bin:$PATH"
          packaging/build-plugin-package.sh deb "${{ matrix.manifest }}" target/x86_64-unknown-linux-gnu/release dist
          packaging/build-plugin-package.sh rpm "${{ matrix.manifest }}" target/x86_64-unknown-linux-gnu/release dist
      - name: Import GPG key
        id: import-gpg
        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}
      - name: Sign and verify RPM
        env:
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: |
          passphrase_file=$(mktemp)
          public_key_file=$(mktemp)
          trap 'rm -f "$passphrase_file" "$public_key_file"' EXIT
          printf '%s' "$GPG_PASSPHRASE" > "$passphrase_file"
          chmod 600 "$passphrase_file"
          echo "%_signature gpg" > ~/.rpmmacros
          echo "%_gpg_name ${{ steps.import-gpg.outputs.keyid }}" >> ~/.rpmmacros
          echo "%_gpg_path $HOME/.gnupg" >> ~/.rpmmacros
          echo "%_gpg_passphrase_file $passphrase_file" >> ~/.rpmmacros
          echo '%__gpg_sign_cmd /usr/bin/gpg --batch --yes --pinentry-mode loopback --passphrase-file %{_gpg_passphrase_file} --no-verbose --no-armor --no-secmem-warning -u %{_gpg_name} -sbo %{__signature_filename} -- %{__plaintext_filename}' >> ~/.rpmmacros
          rpm --addsign dist/*.rpm
          gpg --armor --export "${{ steps.import-gpg.outputs.keyid }}" > "$public_key_file"
          sudo rpm --import "$public_key_file"
          rpm --checksig --verbose dist/*.rpm | grep -Eq '[Ss]ignature.*: OK'
      - uses: actions/upload-artifact@v3
        with:
          name: ${{ matrix.package }}-${{ matrix.version }}
          if-no-files-found: error
          path: |
            target/x86_64-unknown-linux-gnu/release/${{ matrix.library }}
            dist/*
      - name: Publish plugin packages to Gitea
        env:
          GITEA_URL: ${{ gitea.server_url }}
          GITEA_OWNER: ${{ gitea.repository_owner }}
          TOKEN: ${{ secrets.PACKAGE_PAT }}
        run: |
          for package in dist/*.rpm; do
            code=$(curl -sS -w '%{http_code}' -o /dev/null -u "${{ gitea.actor }}:$TOKEN" --upload-file "$package" "$GITEA_URL/api/packages/$GITEA_OWNER/rpm/upload")
            test "$code" = 201 || test "$code" = 409
          done
          for package in dist/*.deb; do
            code=$(curl -sS -w '%{http_code}' -o /dev/null -u "${{ gitea.actor }}:$TOKEN" --upload-file "$package" "$GITEA_URL/api/packages/$GITEA_OWNER/debian/pool/debian/main/upload")
            test "$code" = 201 || test "$code" = 409
          done