action.yml

name: "Build Sarde Site"
description: "Install Sarde and build a static site for deployment"
branding:
  icon: "file-text"
  color: "blue"

inputs:
  path:
    description: "Path to the Sarde project root (where sarde.yaml lives)"
    required: false
    default: "."
  version:
    description: "Sarde version to install (e.g. v1.0.0). Defaults to latest."
    required: false
    default: "latest"
  build-args:
    description: "Additional arguments passed to sarde build"
    required: false
    default: ""
  upload-pages-artifact:
    description: "Upload dist/ as a GitHub Pages artifact. Set to false for non-Pages deployments."
    required: false
    default: "true"

runs:
  using: "composite"
  steps:
    - name: Install Sarde
      shell: bash
      # Inputs are passed through env rather than interpolated into the script,
      # so a value containing shell metacharacters cannot execute as code.
      env:
        SARDE_VERSION: ${{ inputs.version }}
        GITHUB_TOKEN: ${{ github.token }}
      run: |
        set -euo pipefail

        if [ "$SARDE_VERSION" = "latest" ]; then
          curl -sSfL https://raw.githubusercontent.com/getsarde/sarde/main/install.sh | sh
        else
          # Archive names must match the name_template in sarde's
          # .goreleaser.yaml, which is {{ .ProjectName }}_{{ .Os }}_{{ .Arch }}
          # using Go's lowercase GOOS/GOARCH. Using uname output verbatim
          # (Linux_x86_64) produces a name that was never published, and the
          # download 404s.
          case "$(uname -s)" in
            Linux)  OS="linux" ;;
            Darwin) OS="darwin" ;;
            *) echo "::error::unsupported OS: $(uname -s)" >&2; exit 1 ;;
          esac

          case "$(uname -m)" in
            x86_64|amd64)  ARCH="amd64" ;;
            aarch64|arm64) ARCH="arm64" ;;
            *) echo "::error::unsupported architecture: $(uname -m)" >&2; exit 1 ;;
          esac

          ARCHIVE="sarde_${OS}_${ARCH}.tar.gz"
          BASE="https://github.com/getsarde/sarde/releases/download/${SARDE_VERSION}"
          TMPDIR=$(mktemp -d)
          trap 'rm -rf "$TMPDIR"' EXIT

          if ! curl -sSfL -o "${TMPDIR}/${ARCHIVE}" "${BASE}/${ARCHIVE}"; then
            echo "::error::could not download ${ARCHIVE} for ${SARDE_VERSION}." >&2
            echo "Check that the release exists and publishes ${OS}/${ARCH}." >&2
            exit 1
          fi

          # Verify the checksum, matching what install.sh does on the latest path.
          if curl -sSfL -o "${TMPDIR}/checksums.txt" "${BASE}/checksums.txt"; then
            (cd "$TMPDIR" && grep "$ARCHIVE" checksums.txt | sha256sum -c --quiet)
          else
            echo "::warning::no checksums.txt for ${SARDE_VERSION}, skipping verification" >&2
          fi

          INSTALL_DIR="/usr/local/bin"
          if [ ! -w "$INSTALL_DIR" ]; then
            INSTALL_DIR="${HOME}/.local/bin"
            mkdir -p "$INSTALL_DIR"
          fi

          tar xzf "${TMPDIR}/${ARCHIVE}" -C "$INSTALL_DIR" sarde
          chmod +x "${INSTALL_DIR}/sarde"
        fi

        # Both paths fall back to ~/.local/bin when /usr/local/bin is not
        # writable. GITHUB_PATH only affects later steps, so export it here too
        # or the version check below fails in that fallback case.
        if ! command -v sarde >/dev/null 2>&1; then
          export PATH="${HOME}/.local/bin:$PATH"
          echo "${HOME}/.local/bin" >> "$GITHUB_PATH"
        fi

        echo "Installed $(sarde version)"

    - name: Build site
      shell: bash
      working-directory: ${{ inputs.path }}
      # Unquoted on purpose so multiple arguments still split into words, but
      # routed through env so the value cannot break out of the command.
      env:
        SARDE_BUILD_ARGS: ${{ inputs.build-args }}
      run: sarde build $SARDE_BUILD_ARGS

    - name: Upload Pages artifact
      if: inputs.upload-pages-artifact == 'true'
      uses: actions/upload-pages-artifact@v3
      with:
        path: ${{ inputs.path }}/dist