deb-package.yml

name: Deploy Debian package to GitHub Release
on:
  workflow_dispatch:
  push:
    tags:
      - "[0-9]*"

jobs:
  build:
    runs-on: ubuntu-latest
    container:
      image: debian:trixie
    permissions:
      contents: write
    steps:
    - uses: actions/checkout@v4
      with:
        path: ${{ github.event.repository.name }}
    - name: Install dependencies
      run: |
        apt-get -y update
        apt-get -y install asciidoctor bash-completion build-essential debhelper devscripts pkgconf shellcheck
    - name: Setup GPG
      env:
        GPG_PRIVATE_KEY: ${{ secrets.PGP_PRIVATE_KEY_BLOCK }}
      run: |
        echo "$GPG_PRIVATE_KEY" | gpg --batch --import
        mv /usr/bin/gpg /usr/bin/gpg.real
        cat <<EOF >/usr/bin/gpg
        #!/bin/bash
        exec /usr/bin/gpg.real --no-tty --batch --pinentry-mode=loopback --passphrase-fd=0 "\$@"
        EOF
        chmod +x /usr/bin/gpg
    - name: Build package
      env:
        GPG_PRIVATE_KEY_PASSPHRASE: ${{ secrets.PGP_PRIVATE_KEY_PASSPHRASE }}
      run: |
        cd ${{ github.event.repository.name }}
        echo "$GPG_PRIVATE_KEY_PASSPHRASE" | dpkg-buildpackage --force-sign --sign-keyid="${{ vars.PGP_KEY_NAME }}" --sign-backend=gpg
        cd ..
        for i in ${{ github.event.repository.name }}*.deb; do echo "$GPG_PRIVATE_KEY_PASSPHRASE" | gpg --detach-sign --no-armor "$i"; done
    - name: Lint package
      run: |
        lintian ${{ github.event.repository.name }}*.dsc ${{ github.event.repository.name }}*.deb
    - name: Create release
      uses: softprops/action-gh-release@v2
      if: github.ref_type == 'tag'
      with:
        files: |
          ${{ github.event.repository.name }}*.dsc
          ${{ github.event.repository.name }}*.deb
          ${{ github.event.repository.name }}*.sig