ci.yml

# Validate .deb builds on push/PR. Does not publish artifacts.
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Supply-chain hardening: default least privilege for all jobs.
permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  build-deb:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Install packaging tools
        run: sudo apt-get update && sudo apt-get install -y rsync dpkg-dev

      - name: Build .deb
        run: ./build-deb.sh

      - name: Verify package metadata
        run: |
          deb="$(ls -1 build/debian/streamdeck-openpnp_*_all.deb | head -1)"
          test -n "$deb"
          dpkg-deb -I "$deb" | grep -q 'Package: streamdeck-openpnp'
          dpkg-deb -I "$deb" | grep -q 'libnotify-bin'
          dpkg-deb -c "$deb" | grep -q './usr/bin/streamdeck-run'
          echo "Built: $deb ($(du -h "$deb" | cut -f1))"