# Modified by vii from komaruworld/mocktail. See README "About this fork".
name: Flatpak

on:
  push:
    tags: ['v*']
  pull_request:
    paths:
      - '.github/workflows/flatpak.yml'
      - '.gitmodules'
      - 'CMakeLists.txt'
      - 'LICENSE'
      - 'assets/screenshots/**'
      - 'cmake/**'
      - 'config/**'
      - 'include/**'
      - 'packaging/flatpak/**'
      - 'packaging/icons/**'
      - 'packaging/io.github.CoderDayton.nightcap.desktop'
      - 'packaging/io.github.CoderDayton.nightcap.metainfo.xml'
      - 'packaging/io.github.CoderDayton.nightcap.svg'
      - 'scripts/assemble_flatpak_pages.sh'
      - 'site/**'
      - 'src/**'
      - 'stubs/**'
      - 'third_party/**'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: flatpak-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  flatpak:
    name: Flatpak build
    runs-on: ubuntu-24.04
    timeout-minutes: 120
    # The signing key lives in the release environment, which only main and
    # v* tags may use. Builds that do not publish run without it.
    environment: ${{ (startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')) && 'release' || '' }}
    env:
      # Publish on release tags and on manual runs from main. Pull requests
      # only verify that the manifest still builds.
      MOCKTAIL_PUBLISH: ${{ startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') }}
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          submodules: recursive

      - name: Install Flatpak builder
        shell: bash
        run: |
          sudo apt-get update
          sudo apt-get install --yes flatpak flatpak-builder gnupg
          flatpak remote-add --user --if-not-exists flathub \
            https://dl.flathub.org/repo/flathub.flatpakrepo

      - name: Build Flatpak repository and bundle
        shell: bash
        env:
          FLATPAK_GPG_PRIVATE_KEY: ${{ secrets.FLATPAK_GPG_PRIVATE_KEY }}
          FLATPAK_GPG_KEY_ID: ${{ secrets.FLATPAK_GPG_KEY_ID }}
        run: |
          set -Eeuo pipefail
          # The manifest builds the local checkout from refs/heads/main.
          git update-ref refs/heads/main "$GITHUB_SHA"
          builder_signing=()
          bundle_keys=()
          if [[ "$MOCKTAIL_PUBLISH" == true ]]; then
            [[ -n "$FLATPAK_GPG_PRIVATE_KEY" && \
               -n "$FLATPAK_GPG_KEY_ID" ]]
            install -d -m 0700 "$RUNNER_TEMP/nightcap-gnupg"
            printf '%s' "$FLATPAK_GPG_PRIVATE_KEY" | \
              gpg --batch --homedir "$RUNNER_TEMP/nightcap-gnupg" --import
            gpg --batch --homedir "$RUNNER_TEMP/nightcap-gnupg" \
              --export "$FLATPAK_GPG_KEY_ID" >nightcap-flatpak.gpg
            builder_signing=(
              "--gpg-sign=$FLATPAK_GPG_KEY_ID"
              "--gpg-homedir=$RUNNER_TEMP/nightcap-gnupg"
            )
            bundle_keys=(--gpg-keys=nightcap-flatpak.gpg)
          fi
          flatpak-builder \
            --arch=x86_64 \
            --jobs=4 \
            --user \
            --install-deps-from=flathub \
            --disable-rofiles-fuse \
            --force-clean \
            --default-branch=stable \
            --repo=repo \
            "${builder_signing[@]}" \
            build-flatpak-ci \
            packaging/flatpak/io.github.CoderDayton.nightcap.json
          if [[ "$MOCKTAIL_PUBLISH" == true ]]; then
            flatpak build-update-repo \
              --generate-static-deltas \
              --static-delta-jobs=2 \
              --prune \
              --gpg-sign="$FLATPAK_GPG_KEY_ID" \
              --gpg-homedir="$RUNNER_TEMP/nightcap-gnupg" \
              repo
          fi
          flatpak build-bundle \
            --arch=x86_64 \
            "${bundle_keys[@]}" \
            repo \
            Nightcap-x86_64.flatpak \
            io.github.CoderDayton.nightcap \
            stable
          if [[ "$MOCKTAIL_PUBLISH" == true ]]; then
            ./scripts/assemble_flatpak_pages.sh \
              repo Nightcap-x86_64.flatpak nightcap-flatpak.gpg public
          fi

      - name: Upload Flatpak
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: Nightcap-x86_64-flatpak
          path: Nightcap-x86_64.flatpak
          if-no-files-found: error
          retention-days: 14

      - name: Configure GitHub Pages
        if: env.MOCKTAIL_PUBLISH == 'true'
        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0

      - name: Upload GitHub Pages repository
        if: env.MOCKTAIL_PUBLISH == 'true'
        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: public

  deploy-pages:
    name: Publish Flatpak repository
    if: startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
    needs: flatpak
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - name: Deploy GitHub Pages
        id: deployment
        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

  release:
    name: Attach bundle to GitHub release
    if: startsWith(github.ref, 'refs/tags/v')
    needs: flatpak
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: write
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download Flatpak
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: Nightcap-x86_64-flatpak
          path: release

      - name: Upload to release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -Eeuo pipefail
          tag="${GITHUB_REF_NAME}"
          (cd release && sha256sum Nightcap-x86_64.flatpak > Nightcap-x86_64.flatpak.sha256)
          ./scripts/release_notes.sh "$tag" > release/notes.md
          # The Release workflow creates the same release; whichever job
          # arrives second sees "already exists" and continues.
          if ! gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            gh release create "$tag" --repo "$GITHUB_REPOSITORY" \
              --title "Nightcap $tag" --notes-file release/notes.md ||
              gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null
          fi
          gh release edit "$tag" --repo "$GITHUB_REPOSITORY" \
            --title "Nightcap $tag" --notes-file release/notes.md
          gh release upload "$tag" --repo "$GITHUB_REPOSITORY" --clobber \
            release/Nightcap-x86_64.flatpak \
            release/Nightcap-x86_64.flatpak.sha256