copr-ci.yml

---
name: CI Copr Call
permissions: {}

on:
  workflow_call:
    inputs:
      copr_pr_webhook_token:
        description: 'Copr PR webhook key. This should not be secret if you want it to work for PRs from forks.'
        required: true
        type: string
      github_org_owner:
        description: 'GitHub organization owner. This will prevent user forks from triggering the workflow.'
        required: true
        type: string
      copr_ownername:
        description: 'User or group name.'
        required: true
        type: string
      auto_update_package:
        description: 'Automatically create/update a package in Copr.'
        required: false
        type: boolean
        default: true
      job_timeout:
        description: 'Job timeout in minutes.'
        required: false
        type: number
        default: 90
    secrets:
      COPR_BETA_WEBHOOK_TOKEN:
        description: 'Copr beta webhook token. This should be a secret.'
        required: true
      COPR_STABLE_WEBHOOK_TOKEN:
        description: 'Copr stable webhook token. This should be a secret.'
        required: true
      COPR_CLI_CONFIG:
        description: 'Copr CLI configuration file. See https://copr.fedorainfracloud.org/api'
        required: true

env:
  INPUTS_AUTO_UPDATE_PACKAGE: ${{ inputs.auto_update_package }}
  INPUTS_COPR_PR_WEBHOOK_TOKEN: ${{ inputs.copr_pr_webhook_token }}
  INPUTS_COPR_OWNERNAME: ${{ inputs.copr_ownername }}
  INPUTS_GITHUB_ORG_OWNER: ${{ inputs.github_org_owner }}
  INPUTS_JOB_TIMEOUT: ${{ inputs.job_timeout }}
  SECRETS_COPR_BETA_WEBHOOK_TOKEN: ${{ secrets.COPR_BETA_WEBHOOK_TOKEN }}
  SECRETS_COPR_STABLE_WEBHOOK_TOKEN: ${{ secrets.COPR_STABLE_WEBHOOK_TOKEN }}
  SECRETS_COPR_CLI_CONFIG: ${{ secrets.COPR_CLI_CONFIG }}
  PACKAGE_NAME: ${{ github.event.repository.name }}
  GH_EVENT_ACTION: ${{ github.event.action }}
  GH_EVENT_NAME: ${{ github.event_name }}
  GH_EVENT_NUMBER: ${{ github.event.number }}

jobs:
  package-init:
    name: Setup
    container: fedora:latest
    env:
      BASE_URL: https://copr.fedorainfracloud.org/api_3
      SOURCE_TYPE_TEXT: "custom"
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: Debug inputs
        run: |
          echo "inputs:"
          echo "copr_pr_webhook_token: ${INPUTS_COPR_PR_WEBHOOK_TOKEN}"
          echo "github_org_owner: ${INPUTS_GITHUB_ORG_OWNER}"
          echo "copr_ownername: ${INPUTS_COPR_OWNERNAME}"
          echo "auto_update_package: ${INPUTS_AUTO_UPDATE_PACKAGE}"
          echo "job_timeout: ${INPUTS_JOB_TIMEOUT}"

      - name: Test secrets
        id: test_secrets
        if: >
          github.repository_owner == inputs.github_org_owner &&
          inputs.auto_update_package == true
        run: |
          # return if secrets.COPR_CLI_CONFIG is empty
          if [[ -z "${SECRETS_COPR_CLI_CONFIG}" ]]; then
            echo "Copr CLI configuration file is empty. Exiting..."

            # if a pull request exit with 0
            if [[ "${GITHUB_EVENT_NAME}" = "pull_request" ]]; then
              echo "SKIP_REMAINING_JOBS=true" >> "${GITHUB_OUTPUT}"
            else
              exit 1
            fi
          else
            mkdir -p ~/.config
            echo "${SECRETS_COPR_CLI_CONFIG}" > ~/.config/copr
          fi

      - name: Install dependencies
        if: steps.test_secrets.outputs.SKIP_REMAINING_JOBS != 'true'
        run: |
          dnf install -y \
            copr-cli \
            jq

      - name: create packages
        if: steps.test_secrets.outputs.SKIP_REMAINING_JOBS != 'true'
        run: |
          projects=(
            "pulls"
            "beta"
            "stable"
          )

          # download the latest copr-ci.sh script
          if [[ "${GITHUB_REPOSITORY}" = "LizardByte/copr-ci" ]]; then
            # use the version from the same ref
            ref="${GITHUB_REF}"
          else
            ref="master"  # default to master branch
          fi
          curl \
            -fsS \
            --retry 3 \
            "https://raw.githubusercontent.com/lizardbyte/copr-ci/${ref}/copr-ci.sh" \
            -o copr-ci.sh

          # set parameters for package creation
          script="copr-ci.sh"

          builddeps="git jq python3 rpmlint"
          resultdir=""
          chroot="fedora-latest-x86_64"

          for project in "${projects[@]}"; do
            # check if 404 on get package (package does not exist)
            url_query="ownername=${INPUTS_COPR_OWNERNAME}&projectname=${project}&packagename=${PACKAGE_NAME}"
            url="${BASE_URL}/package?${url_query}"
            status_code=$(curl --write-out '%{http_code}' --silent --output /dev/null "${url}")

            if [[ "$status_code" == 404 ]]; then
              echo "Creating package for ${project}..."
              command="add-package-custom"
            else
              echo "Editing package for ${project}..."
              command="edit-package-custom"
            fi

            copr-cli \
              ${command} \
              --script "${script}" \
              --script-builddeps "${builddeps}" \
              --script-resultdir "${resultdir}" \
              --script-chroot "${chroot}" \
              --name "${PACKAGE_NAME}" \
              --timeout $((60 * INPUTS_JOB_TIMEOUT)) \
              "${project}"

          done

  build:
    name: Build
    if: github.repository_owner == inputs.github_org_owner
    container: fedora:latest
    environment:
      name: >-
        ${{
          github.event_name == 'release' &&
          format('copr-{0}', github.event.action == 'prereleased' && 'beta' || 'stable') ||
          null
        }}
      url: >-
        ${{
          github.event_name == 'release' &&
          format(
            'https://copr.fedorainfracloud.org/coprs/{0}/{1}/build/{2}',
            inputs.copr_ownername,
            github.event.action == 'prereleased' && 'beta' || 'stable',
            steps.build.outputs.BUILD_ID
          ) ||
          null
        }}
    env:
      ENV_BASE_URL: https://copr.fedorainfracloud.org/coprs/${{ inputs.copr_ownername }}
    needs: package-init
    outputs:
      BUILD_ID: ${{ steps.build.outputs.BUILD_ID }}
      BUILD_ID_ALT: ${{ steps.chroots.outputs.BUILD_ID_ALT }}
      BUILD_CHANNEL: ${{ steps.get-properties.outputs.BUILD_CHANNEL }}
      BUILD_CANCEL: ${{ steps.build.outcome == 'cancelled' }}
      BUILD_SUCCESS: ${{ steps.build.outcome == 'success' }}
      CHROOTS: ${{ steps.chroots.outputs.CHROOTS }}
      CHROOTS_MATRIX: ${{ steps.chroots.outputs.CHROOTS_MATRIX }}
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: Install dependencies
        run: |
          dnf install -y \
            copr-cli \
            git \
            jq

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Set git safe directory
        run: git config --global --add safe.directory '*'

      - name: Get properties
        id: get-properties
        run: |
          # package name = repository name
          package=${PACKAGE_NAME}
          copr_base="https://copr.fedorainfracloud.org/webhooks/custom-dir/${INPUTS_COPR_OWNERNAME}"

          # release and released type
          if [[ "${GH_EVENT_NAME}" = "release" ]]; then
            if [[ "${GH_EVENT_ACTION}" = "prereleased" ]]; then
              BUILD_CHANNEL="beta"
              COPR_PUSH_WEBHOOK="${copr_base}/${BUILD_CHANNEL}/${SECRETS_COPR_BETA_WEBHOOK_TOKEN}/${package}/"
            elif [[ "${GH_EVENT_ACTION}" = "released" ]]; then
              BUILD_CHANNEL="stable"
              COPR_PUSH_WEBHOOK="${copr_base}/${BUILD_CHANNEL}/${SECRETS_COPR_STABLE_WEBHOOK_TOKEN}/${package}/"
            fi
          elif [[ "${GH_EVENT_NAME}" = "pull_request" ]]; then
            BUILD_CHANNEL="pulls:pr:${GH_EVENT_NUMBER}"
            COPR_PR_WEBHOOK="${copr_base}/${BUILD_CHANNEL}/${INPUTS_COPR_PR_WEBHOOK_TOKEN}/${package}/"
          fi

          {
            echo "BUILD_CHANNEL=${BUILD_CHANNEL}"
            echo "COPR_PUSH_WEBHOOK=${COPR_PUSH_WEBHOOK}"
            echo "COPR_PR_WEBHOOK=${COPR_PR_WEBHOOK}"
          } >> "${GITHUB_ENV}"

          echo "BUILD_CHANNEL=${BUILD_CHANNEL}"
          echo "COPR_PUSH_WEBHOOK=${COPR_PUSH_WEBHOOK}"
          echo "COPR_PR_WEBHOOK=${COPR_PR_WEBHOOK}"

          # Output for other jobs
          echo "BUILD_CHANNEL=${BUILD_CHANNEL}" >> "${GITHUB_OUTPUT}"

      - name: Build
        id: build
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          curl \
            -fsS \
            --retry 3 \
            "https://raw.githubusercontent.com/reenignearcher/copr-ci-tooling/patch-1/copr-gh-actions-submit" > submit
            # TODO: https://github.com/praiskup/copr-ci-tooling/pull/1
            # "https://raw.githubusercontent.com/praiskup/copr-ci-tooling/main/copr-gh-actions-submit"

          # if a PR number is added the script will use the PR webhook, otherwise it will use the push webhook
          if [[ -n "${PR_NUMBER}" ]]; then
            echo "Using PR webhook for build submission..."
            bash submit "${PR_NUMBER}"
          else
            echo "Using push webhook for build submission..."
            bash submit
          fi

      - name: Get chroots
        id: chroots
        if: always()
        env:
          BUILD_ID: ${{ steps.build.outputs.BUILD_ID }}
        run: |
          # get chroots and prefixed build_id
          build_url="https://copr.fedorainfracloud.org/api_3/build/${BUILD_ID}"
          data=$(curl -fsS --retry 3 "${build_url}")

          # Extract build_id from source_package.url (matches the last path segment after 'srpm-builds/')
          build_id_alt=$(echo "${data}" | jq -r '.source_package.url' | sed -E 's#.*/srpm-builds/([0-9]+)/.*#\1#')
          echo "build_id_alt: ${build_id_alt}"

          # Extract chroots
          chroots=$(echo "${data}" | jq -r '.chroots[]')
          echo "chroots:"
          echo "${chroots}"

          # Create matrix JSON array
          chroots_matrix=$(echo "${chroots}" | jq -R -s -c 'split("\n") | map(select(length > 0))')
          echo "chroots_matrix: ${chroots_matrix}"

          {
            echo "BUILD_ID_ALT=${build_id_alt}"
            echo "CHROOTS<<EOF"  # use heredoc for multiline output
            echo "${chroots}"
            echo "EOF"
            echo "CHROOTS_MATRIX=${chroots_matrix}"
          } >> "${GITHUB_OUTPUT}"

      - name: Cancel Copr build
        if: >-
          always() &&
          steps.build.outcome == 'cancelled' &&
          github.secret_source
        env:
          BUILD_ID: ${{ steps.build.outputs.BUILD_ID }}
        run: |
          mkdir -p ~/.config
          echo "${SECRETS_COPR_CLI_CONFIG}" > ~/.config/copr

          copr-cli \
            cancel \
            "${BUILD_ID}"

  logs:
    name: Get logs
    if: always() && needs.build.outputs.BUILD_ID != ''
    container: fedora:latest
    env:
      BUILD_CHANNEL: ${{ needs.build.outputs.BUILD_CHANNEL }}
      BUILD_ID: ${{ needs.build.outputs.BUILD_ID }}
      BUILD_ID_ALT: ${{ needs.build.outputs.BUILD_ID_ALT }}
      CHROOTS: ${{ needs.build.outputs.CHROOTS }}
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Install dependencies
        run: |
          dnf install -y \
            jq

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Add problem matchers
        run: |
          # add default matchers
          mkdir -p .github/matchers

          # download the latest rpmlint.json matcher
          if [[ ! "${{ github.repository }}" = "LizardByte/copr-ci" ]]; then
            # not in copr-ci repo, so download the rpmlint.json
            ref="master"  # default to master branch
            curl \
              -fsS \
              --retry 3 \
              "https://raw.githubusercontent.com/lizardbyte/copr-ci/${ref}/.github/matchers/rpmlint.json" \
              -o ".github/matchers/rpmlint.json"
          fi
          echo "::add-matcher::.github/matchers/rpmlint.json"

          # repo specific matchers
          if [[ -f ".github/matchers/copr-ci.json" ]]; then
            echo "Found copr-ci.json matcher, adding it..."
            echo "::add-matcher::.github/matchers/copr-ci.json"
          fi

      - name: Logs
        run: |
          package=${PACKAGE_NAME}
          base_url="https://download.copr.fedorainfracloud.org/results/${INPUTS_COPR_OWNERNAME}/${BUILD_CHANNEL}"

          # Array of "name|url" pairs
          logs=(
            "source_builder|${base_url}/srpm-builds/${BUILD_ID_ALT}/builder-live.log.gz"
            "source_backend|${base_url}/srpm-builds/${BUILD_ID_ALT}/backend.log.gz"
            "import|https://copr-dist-git.fedorainfracloud.org/per-task-logs/${BUILD_ID}.log"
          )

          for chroot in ${CHROOTS}; do
            logs+=("builder_${chroot}|${base_url}/${chroot}/${BUILD_ID_ALT}-${package}/builder-live.log.gz")
            logs+=("backend_${chroot}|${base_url}/${chroot}/${BUILD_ID_ALT}-${package}/backend.log.gz")
          done

          error=0
          for entry in "${logs[@]}"; do
            name="${entry%%|*}"
            url="${entry#*|}"
            set +e
            echo "::group::Logs - ${name}"
            [[ "${url}" == *.gz ]] && \
              (curl -fsSL --retry 3 "${url}" | gunzip -c) || \
              curl -fsSL --retry 3 "${url}" || {
                echo "Failed to download logs from ${url}"
                error=1
              }
            echo "::endgroup::"
            set -e
          done

          exit ${error}

  artifacts:
    name: Artifacts (${{ matrix.chroot }})
    if: always() && needs.build.outputs.BUILD_SUCCESS == 'true'
    container: fedora:latest
    strategy:
      fail-fast: false
      matrix:
        chroot: ${{ fromJson(needs.build.outputs.CHROOTS_MATRIX) }}
    env:
      BUILD_ID: ${{ needs.build.outputs.BUILD_ID }}
      CHROOT: ${{ matrix.chroot }}
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Install dependencies
        run: |
          dnf install -y \
            copr-cli \
            nodejs \
            zip

      - name: Setup gh actions artifact client
        id: download-build-client
        uses: lhotari/gh-actions-artifact-client@ef03990878cb292d789ee6c36b5bbc8369aa30ed  # v2

      - name: Download and upload artifacts
        id: download-build
        run: |
          mkdir -p artifacts
          cd artifacts

          echo "==> Downloading artifacts for chroot: ${CHROOT}"
          copr-cli \
            --debug \
            download-build \
            --chroot "${CHROOT}" \
            --dest . \
            --rpms \
            "${BUILD_ID}"

          # Log the download size
          download_size=$(du -sh "${CHROOT}" 2>/dev/null | cut -f1 || echo "unknown")
          echo "==> Download size for chroot ${CHROOT}: ${download_size}"

          find . -type f -name "*.rpm" ! -name "*.src.rpm" | while read -r file; do
            name=build-$(basename "$file")
            echo "==> Uploading $name, file: $file"
            zip -j - "$file" | gh-actions-artifact-client.js upload "${name}" --retentionDays=7
          done

  conclude:
    needs: artifacts
    permissions: {}
    runs-on: ubuntu-latest
    steps:
      - name: Conclude
        run: echo "All tests passed"