linux-surface.yml

on:
  push:
    tags:
      - 'linux_surface-*'

env:
  GPG_KEY_ID: 56C464BAAC421453

jobs:
  build:
    name: Build Linux kernel package
    runs-on: ubuntu-24.04-arm
    container: pkgforge/archlinux

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Install build dependencies
      run: |
        # Install makepkg deps
        pacman --noconfirm -Syu
        pacman --noconfirm -S sudo binutils fakeroot base-devel git   \
                              xmlto docbook-xsl kmod inetutils bc dtc \
                              python

        # Fix permissions (can't makepkg as root)
        echo "nobody ALL=(ALL) NOPASSWD: /usr/bin/pacman" >> /etc/sudoers

    - name: Build Package
      run: |
        cd linux-surface

        # Fix permissions (can't makepkg as root)
        chown -R nobody .

        # Package compression settings (Matches latest Arch)
        export PKGEXT='.pkg.tar.zst'
        export COMPRESSZST=(zstd -c -T0 --ultra -20 -)
        export MAKEFLAGS="-j2"

        # Build
        runuser -u nobody -- makepkg -f --syncdeps --skippgpcheck --noconfirm

    - name: Prepare release
      run: |
        mkdir release
        mv linux-surface/*.pkg.tar.zst release

    - name: Sign packages
      env:
        GPG_KEY: ${{ secrets.LINUX_SURFACE_GPG_KEY }}
      run: |
        cd release

        # import GPG key
        echo "$GPG_KEY" | base64 -d | gpg --import --no-tty --batch --yes
        export GPG_TTY=$(tty)

        # sign packages
        ls *.pkg.tar.zst | xargs -L1 gpg --detach-sign --batch --no-tty -u $GPG_KEY_ID

    - name: Upload artifacts
      uses: actions/upload-artifact@v4
      with:
        name: linux-surface-aarch64-latest
        path: release
  
  release:
    name: Publish release
    needs: [build]
    runs-on: ubuntu-latest

    steps:
    - name: Download artifacts
      uses: actions/download-artifact@v4
      with:
        name: linux-surface-aarch64-latest
        path: linux-surface-aarch64-latest

    - name: Upload assets
      uses: svenstaro/upload-release-action@v2
      with:
        repo_token: ${{ secrets.LINUX_SURFACE_BOT_TOKEN }}
        file: ./*-latest/*
        tag: ${{ github.ref }}
        overwrite: true
        file_glob: true

  repo:
    name: Update package repository
    needs: [release]
    runs-on: ubuntu-latest
    container: archlinux

    steps:
    - name: Install dependencies
      run: |
        pacman -Syu --noconfirm
        pacman -S --noconfirm base-devel git

    - name: Download artifacts
      uses: actions/download-artifact@v4
      with:
        name: linux-surface-aarch64-latest
        path: linux-surface-aarch64-latest

    - name: Update repository
      env:
        SURFACEBOT_TOKEN: ${{ secrets.LINUX_SURFACE_BOT_TOKEN }}
        BRANCH_STAGING: u/staging
        GIT_REF: ${{ github.ref }}
      run: |
        repo="https://surfacebot:${SURFACEBOT_TOKEN}@github.com/linux-surface/repo.git"

        # clone package repository
        git clone -b "${BRANCH_STAGING}" "${repo}" repo

        # copy packages
        mkdir -p repo/arch-aarch64
        cp -a linux-surface-aarch64-latest/. repo/arch-aarch64/
        cd repo/arch-aarch64

        # parse git tag from ref
        GIT_TAG=$(echo $GIT_REF | sed 's|^refs/tags/||g')

        # convert packages into references
        for pkg in $(find . -name '*.pkg.tar.zst'); do
          echo "aarch64-packages:$GIT_TAG/$(basename $pkg)" > $pkg.blob
          rm $pkg
        done

        # set git identity
        git config --global user.email "surfacebot@users.noreply.github.com"
        git config --global user.name "surfacebot"

        # commit and push
        update_branch="${BRANCH_STAGING}-$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)"
        git switch -c "${update_branch}"
        git add .
        git commit -m "Update Arch Linux AArch64 kernel"
        git push --set-upstream origin "${update_branch}"