release.yml

name: Release

on:
  push:
    tags: ['v*']

permissions:
  contents: write
  actions: write

env:
  # ONNX Runtime version to bundle in the GitHub-Release .deb and .rpm packages.
  # The ort crate uses feature api-20, so the minimum supported ONNX Runtime is
  # 1.20; this bundled copy satisfies that floor. (The COPR RPM does not bundle
  # ORT — it depends on Fedora's system onnxruntime package via Packit.)
  ORT_VERSION: "1.20.1"

jobs:
  build:
    name: Build Release Binaries
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install system dependencies
        run: .github/workflows/scripts/install-ubuntu-deps.sh

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry and build
        uses: Swatinem/rust-cache@v2

      - name: Build release
        run: cargo build --release --workspace

      - name: Prepare artifacts
        run: |
          mkdir -p release
          cp target/release/facelock release/facelock-x86_64-linux-gnu
          cp target/release/libpam_facelock.so release/pam_facelock.so
          if [ -f target/release/facelock-polkit-agent ]; then
            cp target/release/facelock-polkit-agent release/facelock-polkit-agent-x86_64-linux-gnu
          fi
          cd release && sha256sum * > SHA256SUMS

      - name: Upload binary artifacts
        uses: actions/upload-artifact@v7
        with:
          name: release-binaries
          path: release/

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          # Publish the release with a PAT, not the default GITHUB_TOKEN.
          # Releases created by GITHUB_TOKEN do not trigger downstream
          # automation, so Packit's release trigger never fires and COPR
          # is never built. An empty/missing RELEASE_PAT falls back to
          # GITHUB_TOKEN, so this is safe before the secret is set.
          token: ${{ secrets.RELEASE_PAT }}
          files: |
            release/facelock-x86_64-linux-gnu
            release/pam_facelock.so
            release/facelock-polkit-agent-x86_64-linux-gnu
            release/SHA256SUMS
          generate_release_notes: true

  download-ort:
    name: Download ONNX Runtime
    runs-on: ubuntu-latest
    steps:
      - name: Download ONNX Runtime for bundling
        run: |
          set -euo pipefail
          curl -fsSL "https://github.com/microsoft/onnxruntime/releases/download/v${ORT_VERSION}/onnxruntime-linux-x64-${ORT_VERSION}.tgz" \
            | tar xz
          mkdir -p onnxruntime/lib
          cp "onnxruntime-linux-x64-${ORT_VERSION}/lib/libonnxruntime.so.${ORT_VERSION}" onnxruntime/lib/libonnxruntime.so
          test -s onnxruntime/lib/libonnxruntime.so
          echo "Bundled ORT size: $(du -h onnxruntime/lib/libonnxruntime.so | cut -f1)"

      - name: Upload ORT artifact
        uses: actions/upload-artifact@v7
        with:
          name: onnxruntime-bundle
          path: onnxruntime/

  build-deb:
    name: Build Debian Package
    runs-on: ubuntu-latest
    needs: [build, download-ort]
    steps:
      - uses: actions/checkout@v6

      - name: Install system dependencies
        run: .github/workflows/scripts/install-ubuntu-deps.sh

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo registry and build
        uses: Swatinem/rust-cache@v2

      - name: Build release
        run: cargo build --release --workspace

      - name: Download ORT bundle
        uses: actions/download-artifact@v8
        with:
          name: onnxruntime-bundle
          path: onnxruntime

      - name: Verify ORT bundle exists
        run: test -s onnxruntime/lib/libonnxruntime.so

      - name: Extract version from tag
        id: version
        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Build .deb package (legacy)
        run: .github/workflows/scripts/build-deb.sh "${{ steps.version.outputs.VERSION }}" "legacy"

      - name: Validate .deb contents
        run: .github/workflows/scripts/validate-deb.sh facelock_*.deb

      - name: Upload .deb artifact
        uses: actions/upload-artifact@v7
        with:
          name: release-deb-legacy
          path: facelock_*.deb

      - name: Upload .deb to release
        uses: softprops/action-gh-release@v3
        with:
          files: facelock_*.deb

  build-deb-tpm:
    name: Build Debian Package (TPM)
    runs-on: ubuntu-latest
    needs: [build, download-ort]
    container:
      image: debian:trixie-20260610
    steps:
      - uses: actions/checkout@v6

      - name: Install system dependencies
        run: |
          apt-get update
          apt-get install -y \
            build-essential \
            curl \
            pkg-config \
            libssl-dev \
            clang \
            libv4l-dev \
            libpam0g-dev \
            libxkbcommon-dev \
            libwayland-dev \
            libtss2-dev \
            libtss2-tcti-tabrmd-dev

      - name: Detect libtss2-esys package name and version
        id: tss
        run: |
          TSS_PKG=$(dpkg -l 'libtss2-esys*' 2>/dev/null | awk '/^ii/{print $2}' | head -1)
          TSS_VER=$(dpkg -l 'libtss2-esys*' 2>/dev/null | awk '/^ii/{print $3}' | head -1)
          if [ -z "$TSS_PKG" ]; then
            echo "ERROR: No libtss2-esys package found"
            exit 1
          fi
          echo "TSS_PKG=${TSS_PKG}" >> "$GITHUB_OUTPUT"
          echo "TSS_VER=${TSS_VER}" >> "$GITHUB_OUTPUT"
          echo "Found: ${TSS_PKG} ${TSS_VER}"

      - name: Install Rust toolchain
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - name: Build release with TPM
        run: |
          . "$HOME/.cargo/env"
          cargo build --release --workspace --features tpm

      - name: Download ORT bundle
        uses: actions/download-artifact@v8
        with:
          name: onnxruntime-bundle
          path: onnxruntime

      - name: Verify ORT bundle exists
        run: test -s onnxruntime/lib/libonnxruntime.so

      - name: Extract version from tag
        id: version
        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Build .deb package (TPM)
        run: |
          . "$HOME/.cargo/env"
          .github/workflows/scripts/build-deb.sh "${{ steps.version.outputs.VERSION }}" "tpm" "${{ steps.tss.outputs.TSS_PKG }} (>= ${{ steps.tss.outputs.TSS_VER }})"

      - name: Validate .deb contents
        run: .github/workflows/scripts/validate-deb.sh facelock_*.deb

      - name: Upload .deb artifact
        uses: actions/upload-artifact@v7
        with:
          name: release-deb-tpm
          path: facelock_*.deb

      - name: Upload .deb to release
        uses: softprops/action-gh-release@v3
        with:
          files: facelock_*.deb

  build-rpm:
    name: Build RPM Package
    runs-on: ubuntu-latest
    needs: [build, download-ort]
    container:
      image: fedora:latest
    steps:
      - uses: actions/checkout@v6

      - name: Install build dependencies
        run: |
          dnf install -y \
            rust cargo clang-devel \
            pam-devel libv4l-devel \
            rpm-build systemd-rpm-macros \
            gcc gcc-c++ \
            wayland-devel libxkbcommon-devel \
            tpm2-tss-devel

      - name: Download ORT bundle
        uses: actions/download-artifact@v8
        with:
          name: onnxruntime-bundle
          path: onnxruntime

      - name: Verify ORT bundle exists
        run: test -s onnxruntime/lib/libonnxruntime.so

      - name: Extract version from tag
        id: version
        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Build release
        run: cargo build --release --workspace --features tpm

      - name: Build RPM
        run: .github/workflows/scripts/build-rpm.sh "${{ steps.version.outputs.VERSION }}"

      - name: Copy RPM to workspace
        run: cp ~/rpmbuild/RPMS/x86_64/*.rpm ./ 2>/dev/null || cp ~/rpmbuild/RPMS/**/*.rpm ./ 2>/dev/null || true

      - name: Validate .rpm contents
        run: .github/workflows/scripts/validate-rpm.sh "$(ls *.rpm | head -1)"

      - name: Upload .rpm to release
        uses: softprops/action-gh-release@v3
        with:
          files: "*.rpm"

  build-nix:
    name: Validate Nix Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Nix
        uses: cachix/install-nix-action@v31
        with:
          nix_path: nixpkgs=channel:nixpkgs-unstable

      - name: Check flake
        run: nix flake check ./dist/nix --no-build
        continue-on-error: true

      - name: Build with Nix
        run: nix build ./dist/nix
        continue-on-error: true
        # Nix build may fail if onnxruntime hash changes.
        # This job validates the expression evaluates, not that
        # the build succeeds (which depends on nixpkgs state).

  publish-aur:
    name: Publish to AUR
    runs-on: ubuntu-latest
    needs: [build, build-deb, build-deb-tpm, build-rpm]
    if: ${{ !contains(github.ref_name, 'alpha') && !contains(github.ref_name, 'beta') && !contains(github.ref_name, 'rc') }}
    steps:
      - uses: actions/checkout@v6

      - name: Extract version from tag
        id: version
        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Compute source tarball checksum
        id: checksum
        run: |
          CHECKSUM=$(curl -sL "https://github.com/${{ github.repository }}/archive/${{ github.ref_name }}.tar.gz" | sha256sum | cut -d' ' -f1)
          echo "SHA256=${CHECKSUM}" >> "$GITHUB_OUTPUT"

      - name: Publish to AUR
        env:
          AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
        run: .github/workflows/scripts/publish-aur.sh "${{ steps.version.outputs.VERSION }}" "${{ steps.checksum.outputs.SHA256 }}"

  publish-apt:
    name: Publish APT Repository
    runs-on: ubuntu-latest
    needs: [build-deb, build-deb-tpm]
    if: ${{ !contains(github.ref_name, 'alpha') && !contains(github.ref_name, 'beta') && !contains(github.ref_name, 'rc') }}
    steps:
      - uses: actions/checkout@v6

      - name: Install tools
        run: sudo apt-get update && sudo apt-get install -y reprepro gnupg

      - name: Download TPM .deb artifact
        uses: actions/download-artifact@v8
        with:
          name: release-deb-tpm
          path: debs/tpm

      - name: Download legacy .deb artifact
        uses: actions/download-artifact@v8
        with:
          name: release-deb-legacy
          path: debs/legacy

      - name: Build APT repository
        env:
          APT_GPG_PRIVATE_KEY: ${{ secrets.APT_GPG_PRIVATE_KEY }}
          APT_GPG_PASSPHRASE: ${{ secrets.APT_GPG_PASSPHRASE }}
        run: |
          TPM_DEB=$(ls debs/tpm/facelock_*.deb)
          LEGACY_DEB=$(ls debs/legacy/facelock_*.deb)
          .github/workflows/scripts/publish-apt.sh "${TPM_DEB}" "${LEGACY_DEB}" "$(pwd)/apt-repo"

      - name: Package APT repo artifact
        run: |
          REPO_DIR="$(pwd)/apt-repo"
          # Remove reprepro internals (conf/, db/) — only ship dists/, pool/, and keyring
          tar -czf apt-repo.tar.gz -C "${REPO_DIR}" \
            --exclude='conf' --exclude='db' \
            dists pool tysmith-archive-keyring.gpg
          echo "APT repo tarball: $(du -h apt-repo.tar.gz | cut -f1)"

      - name: Upload APT repo to release
        uses: softprops/action-gh-release@v3
        with:
          files: apt-repo.tar.gz

  trigger-pages:
    name: Trigger Pages Rebuild
    runs-on: ubuntu-latest
    needs: [publish-apt]
    steps:
      - name: Trigger GitHub Pages workflow
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh workflow run pages.yml --repo "${{ github.repository }}"
          echo "Triggered Pages rebuild to include updated APT repository"