build-package.yml

name: Build Beszel Agent IPK/APK

on:
  workflow_dispatch:
    inputs:
      force_build:
        description: 'Build even if versions match'
        type: boolean
        default: false
  push:
    branches:
      - master
    paths:
      - 'beszel-agent/**'
  pull_request:
    branches:
      - master
    paths:
      - 'beszel-agent/**'
  schedule:
    - cron: '0 2 * * 0'

env:
  UPSTREAM_REPO: 'henrygd/beszel'
  PACKAGE_NAME: 'beszel-agent'

jobs:
  validate-versions:
    runs-on: ubuntu-latest
    outputs:
      latest_upstream_version: ${{ steps.validate.outputs.latest_upstream_version }}
      should_build: ${{ steps.validate.outputs.should_build }}
    steps:
      - name: Validate versions
        id: validate
        run: |
          set -euo pipefail

          LATEST_UPSTREAM=$(curl -s "https://api.github.com/repos/$UPSTREAM_REPO/releases/latest" | jq -r .tag_name)
          echo "Latest upstream Beszel: $LATEST_UPSTREAM"

          LATEST_REPO=$(curl -s "https://api.github.com/repos/${{ github.repository }}/releases/latest" | jq -r .tag_name)
          echo "Latest repo release: $LATEST_REPO"

          REPO_VERSION=${LATEST_REPO%%-*}
          echo "Repo base version: $REPO_VERSION"

          if [ "$LATEST_UPSTREAM" != "$REPO_VERSION" ] || [ "${{ inputs.force_build }}" = "true" ]; then
            echo "New version detected! Building $REPO_VERSION -> $LATEST_UPSTREAM"
            echo "latest_upstream_version=$LATEST_UPSTREAM" >> $GITHUB_OUTPUT
            echo "should_build=true" >> $GITHUB_OUTPUT
          else
            echo "Versions match: $LATEST_UPSTREAM == $REPO_VERSION. No build needed."
            echo "should_build=false" >> $GITHUB_OUTPUT
          fi

  build:
    needs: validate-versions
    if: needs.validate-versions.outputs.should_build == 'true'
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.prepare.outputs.tag }}
    strategy:
      fail-fast: false
      matrix:
        arch:
          - aarch64_cortex-a53
          - aarch64_cortex-a72
          - aarch64_generic
          - arm_cortex-a7_neon-vfpv4
          - arm_cortex-a9
          - mipsel_24kc
          - mips_24kc
          - x86_64
        branch:
          - openwrt-24.10
          - 25.12.0-rc5
        include:
          - { branch: openwrt-24.10, package_type: ipk }
          - { branch: 25.12.0-rc5,   package_type: apk }
    container:
      image: openwrt/sdk:${{ matrix.arch }}-${{ matrix.branch }}
      options: --user root
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Cache SDK downloads
        uses: actions/cache@v4
        with:
          path: /builder/dl
          key: openwrt-dl-${{ matrix.branch }}-${{ matrix.arch }}-${{ needs.validate-versions.outputs.latest_upstream_version }}-${{ hashFiles('beszel-agent/Makefile') }}

      - name: Setup SDK
        working-directory: /builder
        run: HOME=/builder ./setup.sh

      - name: Prepare build
        id: prepare
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail

          TAG="${{ needs.validate-versions.outputs.latest_upstream_version }}"
          echo "Latest version: $TAG"

          case "${{ matrix.arch }}" in
            aarch64_*) GOARCH="arm64" ;;
            arm_*) GOARCH="arm" ;;
            mipsel_*) GOARCH="mipsle" ;;
            mips_*) GOARCH="mips" ;;
            x86_64) GOARCH="amd64" ;;
            *)
              echo "Unknown architecture: ${{ matrix.arch }}" >&2
              exit 1
              ;;
          esac

          echo "Go architecture: $GOARCH"

          CHECKSUMS_URL="https://github.com/$UPSTREAM_REPO/releases/download/$TAG/beszel_${TAG#v}_checksums.txt"
          HASH=$(wget -qO- "$CHECKSUMS_URL" | grep " beszel-agent_linux_${GOARCH}.tar.gz\$" | cut -d' ' -f1)
          if [ -z "$HASH" ]; then
            echo "Failed to get checksum from $CHECKSUMS_URL" >&2
            exit 1
          fi
          echo "Tarball SHA256: $HASH"

          echo "tag=$TAG" >> $GITHUB_OUTPUT
          echo "goarch=$GOARCH" >> $GITHUB_OUTPUT
          echo "hash=$HASH" >> $GITHUB_OUTPUT
          echo "version=${TAG#v}" >> $GITHUB_OUTPUT
          echo "Building version: $TAG for arch: $GOARCH"

      - name: Install dependencies
        working-directory: /builder
        run: apt update && apt install -y upx-ucl

      - name: Prepare package structure
        working-directory: /builder
        env:
          VERSION: ${{ steps.prepare.outputs.version }}
        run: |
          set -euo pipefail
          cp -r $GITHUB_WORKSPACE/beszel-agent package/beszel-agent
          echo "=== Package structure ==="
          ls -laR package/beszel-agent/files/

      - name: Build package
        working-directory: /builder
        env:
          VERSION: ${{ steps.prepare.outputs.version }}
          GOARCH: ${{ steps.prepare.outputs.goarch }}
        run: |
          set -euo pipefail
          echo "CONFIG_PACKAGE_beszel-agent=m" >> .config
          make defconfig
          make package/beszel-agent/compile V=s -j$(nproc) BUILD_LOG=1 \
            BESZEL_VERSION="$VERSION" \
            BESZEL_GOARCH="$GOARCH" \
            BESZEL_HASH="${{ steps.prepare.outputs.hash }}"

      - name: Collect artifacts
        env:
          ARCH: ${{ matrix.arch }}
          BRANCH: ${{ matrix.branch }}
          PKG_TYPE: ${{ matrix.package_type }}
        run: |
          set -euo pipefail
          echo "=== Searching for package files ==="
          find /builder/bin/packages -name "beszel-agent*.$PKG_TYPE" -ls || true

          mkdir -p $GITHUB_WORKSPACE/pkg-output
          find /builder/bin/packages -name "beszel-agent*.$PKG_TYPE" | while read f; do
            filename=$(basename "$f")
            if [[ "$PKG_TYPE" == "apk" ]]; then
              filename="${filename%.apk}_${ARCH}.apk"
            fi
            cp "$f" "$GITHUB_WORKSPACE/pkg-output/$filename"
          done

          cd $GITHUB_WORKSPACE/pkg-output
          echo "=== Files in pkg-output ==="
          ls -la

          PKG_COUNT=$(ls beszel-agent*.$PKG_TYPE 2>/dev/null | wc -l)
          if [[ $PKG_COUNT -eq 0 ]]; then
            echo "ERROR: No $PKG_TYPE file found!" >&2
            exit 1
          fi
          echo "Found $PKG_COUNT $PKG_TYPE file(s)"

          VERSION_DIR="${BRANCH/openwrt-}/$ARCH"
          mkdir -p "$VERSION_DIR"
          mv *.$PKG_TYPE "$VERSION_DIR/"
          cd "$VERSION_DIR"
          sha256sum *.$PKG_TYPE > SHA256SUMS

          cd $GITHUB_WORKSPACE/pkg-output
          tar -cvf $GITHUB_WORKSPACE/pkg-$BRANCH-$ARCH.tar "$VERSION_DIR"

      - name: Validate package
        env:
          ARCH: ${{ matrix.arch }}
          BRANCH: ${{ matrix.branch }}
          PKG_TYPE: ${{ matrix.package_type }}
        run: |
          set -euo pipefail
          VERSION_DIR="${BRANCH/openwrt-}/$ARCH"
          cd pkg-output/$VERSION_DIR

          echo "=== Validating packages in $VERSION_DIR ==="
          for pkg in *.$PKG_TYPE; do
            size=$(stat -c%s "$pkg")
            if [[ $size -lt 10000 ]]; then
              echo "ERROR: $pkg is too small ($size bytes)" >&2
              exit 1
            fi
            echo "✓ $pkg size: $size bytes"
          done

          sha256sum -c SHA256SUMS
          echo "✓ Package validation passed"

      - name: Upload packages
        if: success()
        uses: actions/upload-artifact@v4
        with:
          name: pkg-${{ matrix.branch }}-${{ matrix.arch }}
          path: |
            pkg-output/**/*.${{ matrix.package_type }}
            pkg-output/**/SHA256SUMS
          if-no-files-found: error
          retention-days: 30

  gh-pages:
    needs: [validate-versions, build]
    if: needs.validate-versions.outputs.should_build == 'true'
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: pkg-*

      - name: Prepare files
        run: |
          mkdir public
          find . -name 'pkg-*.tar' -exec tar -C ./public -xvf {} \;

      - name: Deploy to GH pages
        uses: peaceiris/actions-gh-pages@v4
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          user_name: 'github-actions[bot]'
          user_email: 'github-actions[bot]@users.noreply.github.com'
          full_commit_message: 'Beszel Agent ${{ needs.build.outputs.tag }}'
          force_orphan: true

  release:
    needs: [validate-versions, build, gh-pages]
    if: needs.validate-versions.outputs.should_build == 'true'
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: pkg-*

      - name: Prepare files
        run: |
          find . -name "pkg-openwrt-*.tar" \
            -exec tar -xvf {} --wildcards "*.ipk" --wildcards "*.apk" \;

      - name: Upload release assets
        uses: softprops/action-gh-release@v2
        with:
          fail_on_unmatched_files: true
          tag_name: ${{ needs.validate-versions.outputs.latest_upstream_version }}
          name: ${{ needs.validate-versions.outputs.latest_upstream_version }}
          target_commitish: gh-pages
          body: |
            ### Beszel Agent ${{ needs.validate-versions.outputs.latest_upstream_version }}

            `IPK` - OpenWrt 24.10
            `APK` - OpenWrt 25.12
          files: |
            ./**/*.ipk
            ./**/*.apk