cd.yml

on:
  push:
    branches: [main]
    paths-ignore:
      - '**.md'
      - 'LICENSE*'
      - '.git*'
      - '.envrc'
      - 'garnix.yaml'
      - '.github/workflows/ci.yml'
    tags: [v*]
  workflow_dispatch:

jobs:
  pwa:
    if: github.ref == 'refs/heads/main' && !startsWith(github.ref, 'refs/tags/v')
    timeout-minutes: 15
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    permissions:
      contents: read
      pages: write
      id-token: write
    steps:
    - uses: actions/checkout@v6
      with:
        lfs: true
    - uses: cachix/install-nix-action@v31
      with:
        github_access_token: ${{ secrets.GITHUB_TOKEN }}
        extra_nix_config: |
          extra-substituters = https://cache.garnix.io
          extra-trusted-public-keys = cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g=
    - uses: DeterminateSystems/magic-nix-cache-action@v13
    - run: sleep 5 #  Sleep hoping Garnix evaluation will start after
    - uses: lewagon/wait-on-check-action@v1.5.0
      with:
        ref: ${{ github.event.pull_request.head.sha || github.sha }}
        check-regexp: 'Evaluate flake.nix'
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        fail-on-no-checks: false
        allowed-conclusions: success,failure,cancelled,skipped,timed_out,neutral
    - uses: lewagon/wait-on-check-action@v1.5.0
      with:
        ref: ${{ github.event.pull_request.head.sha || github.sha }}
        check-regexp: 'package web.*'
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        fail-on-no-checks: false
        allowed-conclusions: success,failure,cancelled,skipped,timed_out,neutral
    - run: nix build .#web -o dist
    - uses: actions/upload-pages-artifact@v4
      with: { path: ./dist/LogOut }
    - uses: actions/deploy-pages@v4
      id: deployment

  android-release:
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: write # Required by 'gh release'
      checks: read    # Required by wait-on-check-action
      statuses: read  # Required by wait-on-check-action
    steps:
    - uses: actions/checkout@v6
      with:
        lfs: true
    - uses: cachix/install-nix-action@v31
      with:
        github_access_token: ${{ secrets.GITHUB_TOKEN }}
        extra_nix_config: |
          extra-substituters = https://cache.garnix.io
          extra-trusted-public-keys = cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g=
    - uses: DeterminateSystems/magic-nix-cache-action@v13
    - run: sleep 5 #  Sleep hoping Garnix evaluation will start after
    - uses: lewagon/wait-on-check-action@v1.5.0
      with:
        ref: ${{ github.event.pull_request.head.sha || github.sha }}
        check-regexp: 'Evaluate flake.nix'
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        fail-on-no-checks: false
        allowed-conclusions: success,failure,cancelled,skipped,timed_out,neutral
    - uses: lewagon/wait-on-check-action@v1.5.0
      with:
        ref: ${{ github.event.pull_request.head.sha || github.sha }}
        check-regexp: 'devShell.*linux.*'
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        fail-on-no-checks: false
        allowed-conclusions: success,failure,cancelled,skipped,timed_out,neutral
    - uses: timheuer/base64-to-file@v1.2.4
      with:
        fileName: 'logout.jks'
        encodedString: ${{ secrets.ANDROID_KEYSTORE_B64 }}
      id: keystore
    - run: nix run .#androidBuild
      env:
        ANDROID_KEYSTORE_PATH: ${{ steps.keystore.outputs.filePath }}
        ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
    - name: Publish Semantically Versionned Release
      run: |
        TAG=${GITHUB_REF#refs/tags/}
        gh release create "$TAG" *.apk --title "$TAG" --notes "Release $TAG"
      env:
        GH_TOKEN: ${{ github.token }}

  check-tag:
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    outputs:
      is_tagged: ${{ steps.check.outputs.is_tagged }}
    steps:
    - uses: actions/checkout@v6
    - id: check
      run: |
        if git describe --tags --exact-match HEAD >/dev/null 2>&1; then
          echo "is_tagged=true" >> $GITHUB_OUTPUT
        else
          echo "is_tagged=false" >> $GITHUB_OUTPUT
        fi
  android-prerelease:
    needs: check-tag
    if: github.ref == 'refs/heads/main' && needs.check-tag.outputs.is_tagged == 'false'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: write # Required by 'gh release'
      checks: read    # Required by wait-on-check-action
      statuses: read  # Required by wait-on-check-action
    steps:
    - uses: actions/checkout@v6
      with:
        lfs: true
    - uses: cachix/install-nix-action@v31
      with:
        github_access_token: ${{ secrets.GITHUB_TOKEN }}
        extra_nix_config: |
          extra-substituters = https://cache.garnix.io
          extra-trusted-public-keys = cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g=
    - uses: DeterminateSystems/magic-nix-cache-action@v13
    - run: sleep 5 #  Sleep hoping Garnix evaluation will start after
    - uses: lewagon/wait-on-check-action@v1.5.0
      with:
        ref: ${{ github.event.pull_request.head.sha || github.sha }}
        check-regexp: 'Evaluate flake.nix'
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        fail-on-no-checks: false
        allowed-conclusions: success,failure,cancelled,skipped,timed_out,neutral
    - uses: lewagon/wait-on-check-action@v1.5.0
      with:
        ref: ${{ github.event.pull_request.head.sha || github.sha }}
        check-regexp: 'devShell.*linux.*'
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        fail-on-no-checks: false
        allowed-conclusions: success,failure,cancelled,skipped,timed_out,neutral
    - uses: timheuer/base64-to-file@v1.2.4
      with:
        fileName: 'logout.jks'
        encodedString: ${{ secrets.ANDROID_KEYSTORE_B64 }}
      id: keystore
    - run: nix run .#androidBuild
      env:
        ANDROID_KEYSTORE_PATH: ${{ steps.keystore.outputs.filePath }}
        ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
    - name: Publish Timestamped Pre-release # If no SemVer tag on last commit
      run: |
        NOW=$(date -u +"%Y-%m-%d")
        read -r OLD_TAG CREATED_AT <<< "$(gh release list \
          --json tagName,createdAt,isPrerelease --limit 1 \
          --jq '.[]|select(.isPrerelease == true)|"\(.tagName) \(.createdAt)"')"
        if [ -z "$CREATED_AT" ] ||
          [ "$(date -d "$CREATED_AT" +%s)" -le "$(date -d '2 days ago' +%s)" ]
        then
          gh release create "pre-$NOW" *.apk --prerelease \
            --title "$NOW" --notes "Automated pre-release for $NOW"
        fi
      env:
        GH_TOKEN: ${{ github.token }}

  cleanup:
    if: github.ref == 'refs/heads/main' && !startsWith(github.ref, 'refs/tags/v')
    timeout-minutes: 5
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
    - uses: actions/checkout@v6
    - run: | # Cleanup rolling releases > 7 days or < 12 hours
        gh release list --json tagName,createdAt,isPrerelease --limit 100 \
          --jq '.[]|select(.isPrerelease == true)|"\(.tagName) \(.createdAt)"' \
        | while read -r OLD_TAG CREATED_AT; do
          TIMESTAMP=$(date -d "$CREATED_AT" +%s)
          if [ "$TIMESTAMP" -lt "$(date -d '14 days ago' +%s)" ]; then
            gh release delete "$OLD_TAG" --yes --cleanup-tag
          fi
        done
      env:
        GH_TOKEN: ${{ github.token }}