name: Create Release and Publish Assets

on:
  push:
    tags:
      - 'v*.*.*' # Trigger on version tags like v1.0.0, v1.2.3, etc.

jobs:
  create_gh_release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    permissions:
      contents: write # Required to create releases and upload assets
    outputs:
      pkg_name: ${{ steps.get_version.outputs.pkg_name }}
      version: ${{ steps.get_version.outputs.version }}
      tag_name: ${{ github.ref_name }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Get version from tag
        id: get_version
        # Example: v1.0.0 -> 1.0.0
        run: |
          export PKG_NAME=$(grep -A 10 '\[package\]' Cargo.toml | grep '^name *=' | sed 's/name *= *"\(.*\)"/\1/')
          echo "pkg_name=${PKG_NAME}" >> $GITHUB_OUTPUT
          echo "version=${GITHUB_REF_NAME#v}" >> $GITHUB_OUTPUT

      - name: Create GitHub Release
        id: create_release_step
        env:
          PKG_NAME: ${{ steps.get_version.outputs.pkg_name }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.get_version.outputs.version }}
        run: |
          gh release create ${{ github.ref_name }} \
            --title "Release ${{ github.ref_name }}" \
            --notes "Automated release for ${{ env.PKG_NAME }} version ${{ env.VERSION }}.
          See CHANGELOG.md for details (if available).
          Assets will be uploaded by subsequent jobs." \
            --draft=false \
            --prerelease=false

  build_and_upload_source_archive:
    name: Build and Upload Source Archive
    runs-on: ubuntu-latest
    needs: create_gh_release
    permissions:
      contents: write # Required to upload assets (read permission is implicit for checkout)
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Required by git archive to correctly use the tag

      - name: Create source archive
        id: create_source_archive
        env:
          PKG_NAME: ${{ needs.create_gh_release.outputs.pkg_name }}
          VERSION: ${{ needs.create_gh_release.outputs.version }}
          TAG_NAME: ${{ needs.create_gh_release.outputs.tag_name }}
        run: |
          ARCHIVE_NAME="${{ env.PKG_NAME }}-${VERSION}.tar.gz"
          # Create archive from the tagged commit, ensuring it extracts to a versioned directory
          git archive --format=tar.gz --prefix="${{ env.PKG_NAME }}-${VERSION}/" -o "${ARCHIVE_NAME}" "${TAG_NAME}"
          echo "archive_path=${PWD}/${ARCHIVE_NAME}" >> $GITHUB_OUTPUT
          echo "Created archive: ${ARCHIVE_NAME}"
          if [ -z "${PWD}/${ARCHIVE_NAME}" ]; then
            echo "::error::Archive path is empty. Check if the archive was created successfully."
            exit 1
          fi
          ls -lh "${ARCHIVE_NAME}"
          exit 0

      - name: Upload source archive to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ARCHIVE_PATH: ${{ steps.create_source_archive.outputs.archive_path }}
        run: |
          gh release upload ${{ needs.create_gh_release.outputs.tag_name }} "${{ env.ARCHIVE_PATH }}"

  build_debian_packages:
    name: Build Debian Package (${{ matrix.arch }})
    runs-on: ${{ matrix.runs-on }}
    needs: create_gh_release
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            runs-on: ubuntu-latest
            container_image: debian:trixie
          - arch: arm64
            runs-on: ubuntu-24.04-arm
            container_image: debian:trixie
    container:
      image: ${{ matrix.container_image }}
    steps:
      - name: Install build dependencies
        run: |
          apt-get update
          apt-get install -y --no-install-recommends \
            build-essential \
            debhelper \
            dpkg-dev \
            pkg-config \
            libssl-dev \
            libpam0g-dev \
            git \
            ca-certificates \
            curl \
            gh

      - name: Install Rust via rustup
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path
          . "$HOME/.cargo/env"
          rustup update stable
          rustup toolchain install stable

      - uses: actions/checkout@v4

      - name: Build Debian Package for ${{ matrix.arch }}
        run: |
          . "$HOME/.cargo/env"
          rm -rf package-build
          mkdir -p package-build
          ls -1 | grep -v package-build | xargs -I {} cp -r --no-preserve=mode {} package-build/
          cd package-build
          dpkg-buildpackage -b -uc -us

      - name: Upload Debian package to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ needs.create_gh_release.outputs.tag_name }}
        run: |
          git config --global --add safe.directory /__w/rust-socksd/rust-socksd
          # Find the .deb file in the workspace root (parent of package-build)
          DEB_PATH=$(find . -maxdepth 1 -name "*_${{ matrix.arch }}.deb" -print -quit)
          if [ -z "$DEB_PATH" ]; then
            echo "::error::Could not find .deb package for ${{ matrix.arch }}"
            ls -l
            exit 1
          fi
          echo "Found deb package: $DEB_PATH"
          gh release upload ${{ env.TAG_NAME }} "$DEB_PATH"

  build_debian_armhf_package:
    name: Build Debian Package (armhf)
    runs-on: ubuntu-latest
    needs: create_gh_release
    permissions:
      contents: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # 1. Install QEMU static binaries so Docker can run ARM containers
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm,arm64

      # 2. Run the build inside an armhf Debian container with proper platform support
      - name: Build Debian package
        run: |
          docker run --rm \
            --platform linux/arm/v7 \
            -v ${{ github.workspace }}:/workspace \
            -w /workspace \
            debian:trixie \
            /bin/bash -c "
              # Update and install build dependencies (matching amd64 build)
              apt-get update &&
              apt-get install -y --no-install-recommends \
                build-essential \
                debhelper \
                dpkg-dev \
                pkg-config \
                libssl-dev \
                libpam0g-dev \
                devscripts \
                equivs \
                git \
                ca-certificates \
                curl

              # Install Rust via rustup
              curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path
              . \$HOME/.cargo/env
              rustup update stable
              rustup toolchain install stable

              # Automatically install dependencies listed in debian/control
              mk-build-deps --install --remove --tool='apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends -y' debian/control

              # Build the package (unsigned source, unsigned changes, binary-only)
              dpkg-buildpackage -us -uc -b

              # Move the resulting .deb files into a specific folder for uploading
              mkdir -p /workspace/output
              mv ../*.deb /workspace/output/ || true
            "

      # 3. Upload the compiled .deb file to the release
      - name: Upload armhf package to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ needs.create_gh_release.outputs.tag_name }}
        run: |
          # Find the .deb file
          DEB_FILE=$(find output -name "*_armhf.deb" -o -name "*_arm*.deb" | head -1)
          if [ -z "$DEB_FILE" ]; then
            echo "::error::Could not find .deb package for armhf"
            ls -la output/ || true
            exit 1
          fi
          echo "Found deb package: $DEB_FILE"
          gh release upload "$TAG_NAME" "$DEB_FILE"

  aur_publish:
    name: "Publish Arch Linux source package to AUR"
    permissions:
      contents: read
    needs:
      - create_gh_release
      - build_and_upload_source_archive
    if: '!github.event.prerelease'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2

      - name: Install dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends git gettext-base

      - name: Generate PKGBUILD
        env:
          PKG_NAME: ${{ needs.create_gh_release.outputs.pkg_name }}
          PKG_VERSION: ${{ needs.create_gh_release.outputs.version }}
          TAG_NAME: ${{ needs.create_gh_release.outputs.tag_name }}
          PKGBUILD_TEMPLATE_PATH: ./AUR/PKGBUILD.in
          PKGBUILD_PATH: ./AUR/PKGBUILD
        run: |
          echo "Generating PKGBUILD at $PKGBUILD_PATH"
          /usr/bin/envsubst '${PKG_NAME} ${PKG_VERSION}' < "$PKGBUILD_TEMPLATE_PATH" > "$PKGBUILD_PATH"
          echo ""
          cat "$PKGBUILD_PATH"

      - name: Publish AUR package
        uses: KSXGitHub/github-actions-deploy-aur@v4.1.1
        with:
          pkgname: ${{ needs.create_gh_release.outputs.pkg_name }}
          pkgbuild: ./AUR/PKGBUILD
          assets: |
            ./AUR/*.install
          commit_username: ${{ secrets.AUR_USERNAME }}
          commit_email: ${{ secrets.AUR_EMAIL }}
          ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
          commit_message: Update AUR package
          ssh_keyscan_types: rsa,ecdsa,ed25519