InstanceBrick--nightcap/.github/workflows/flatpak.yml

name: Flatpak

on:
  workflow_run:
    workflows: [Native packages]
    types: [completed]
  pull_request:
    paths:
      - '.github/workflows/flatpak.yml'
      - '.gitmodules'
      - 'CMakeLists.txt'
      - 'LICENSE'
      - 'assets/screenshots/**'
      - 'cmake/**'
      - 'config/**'
      - 'include/**'
      - 'packaging/flatpak/**'
      - 'packaging/discord-join.html'
      - 'packaging/icons/**'
      - 'packaging/space.bigrat.mocktail.desktop'
      - 'packaging/space.bigrat.mocktail.metainfo.xml'
      - 'packaging/space.bigrat.mocktail.svg'
      - 'scripts/assemble_flatpak_pages.sh'
      - 'scripts/assemble_native_repositories.sh'
      - 'site/**'
      - 'src/**'
      - 'stubs/**'
      - 'third_party/**'
  workflow_dispatch:

permissions:
  actions: read
  contents: read

concurrency:
  group: flatpak-${{ github.event.workflow_run.head_sha || github.ref }}
  cancel-in-progress: true

jobs:
  flatpak:
    name: Flatpak build
    if: >-
      github.event_name != 'workflow_run' ||
      (github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event != 'pull_request' &&
      github.event.workflow_run.head_branch == 'main')
    runs-on: ubuntu-24.04
    timeout-minutes: 120
    env:
      MOCKTAIL_PUBLISH: ${{ (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_branch == 'main') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') }}
      MOCKTAIL_SOURCE_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
          submodules: recursive

      - name: Download package repositories
        if: env.MOCKTAIL_PUBLISH == 'true'
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -Eeuo pipefail
          run_id="${{ github.event.workflow_run.id }}"
          if [[ -z "$run_id" ]]; then
            run_id="$(gh run list \
              --workflow packages.yml \
              --branch main \
              --event push \
              --status success \
              --limit 1 \
              --json databaseId \
              --jq '.[0].databaseId')"
          fi
          [[ -n "$run_id" ]]
          gh run download "$run_id" \
            --name Mocktail-native-repositories \
            --dir native-repositories
          [[ -d native-repositories/apt && \
             -d native-repositories/rpm && \
             -d native-repositories/downloads && \
             -s native-repositories/mocktail-packages.gpg ]]

      - name: Install Flatpak builder
        shell: bash
        run: |
          sudo apt-get update
          sudo apt-get install --yes flatpak flatpak-builder gnupg
          flatpak remote-add --user --if-not-exists flathub \
            https://dl.flathub.org/repo/flathub.flatpakrepo

      - name: Build Flatpak repository and bundle
        shell: bash
        env:
          FLATPAK_GPG_PRIVATE_KEY: ${{ secrets.FLATPAK_GPG_PRIVATE_KEY }}
          FLATPAK_GPG_KEY_ID: ${{ secrets.FLATPAK_GPG_KEY_ID }}
        run: |
          set -Eeuo pipefail
          git update-ref refs/heads/main "$MOCKTAIL_SOURCE_SHA"
          builder_signing=()
          bundle_keys=()
          if [[ "$MOCKTAIL_PUBLISH" == true ]]; then
            [[ -n "$FLATPAK_GPG_PRIVATE_KEY" && \
               -n "$FLATPAK_GPG_KEY_ID" ]]
            install -d -m 0700 "$RUNNER_TEMP/mocktail-gnupg"
            printf '%s' "$FLATPAK_GPG_PRIVATE_KEY" | \
              gpg --batch --homedir "$RUNNER_TEMP/mocktail-gnupg" --import
            gpg --batch --homedir "$RUNNER_TEMP/mocktail-gnupg" \
              --export "$FLATPAK_GPG_KEY_ID" >mocktail-flatpak.gpg
            builder_signing=(
              "--gpg-sign=$FLATPAK_GPG_KEY_ID"
              "--gpg-homedir=$RUNNER_TEMP/mocktail-gnupg"
            )
            bundle_keys=(--gpg-keys=mocktail-flatpak.gpg)
          fi
          flatpak-builder \
            --arch=x86_64 \
            --jobs=4 \
            --user \
            --install-deps-from=flathub \
            --disable-rofiles-fuse \
            --force-clean \
            --default-branch=stable \
            --repo=repo \
            "${builder_signing[@]}" \
            build-flatpak-ci \
            packaging/flatpak/space.bigrat.mocktail.json
          if [[ "$MOCKTAIL_PUBLISH" == true ]]; then
            flatpak build-update-repo \
              --generate-static-deltas \
              --static-delta-jobs=2 \
              --prune \
              --gpg-sign="$FLATPAK_GPG_KEY_ID" \
              --gpg-homedir="$RUNNER_TEMP/mocktail-gnupg" \
              repo
          fi
          flatpak build-bundle \
            --arch=x86_64 \
            "${bundle_keys[@]}" \
            repo \
            Mocktail-x86_64.flatpak \
            space.bigrat.mocktail \
            stable
          if [[ "$MOCKTAIL_PUBLISH" == true ]]; then
            ./scripts/assemble_flatpak_pages.sh \
              repo Mocktail-x86_64.flatpak mocktail-flatpak.gpg \
              public native-repositories
          fi

      - name: Upload Flatpak
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: Mocktail-x86_64-flatpak
          path: Mocktail-x86_64.flatpak
          if-no-files-found: error
          retention-days: 14

      - name: Configure GitHub Pages
        if: env.MOCKTAIL_PUBLISH == 'true'
        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0

      - name: Upload GitHub Pages repository
        if: env.MOCKTAIL_PUBLISH == 'true'
        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: public

  deploy-pages:
    name: Publish Flatpak repository
    if: >-
      (github.event_name == 'workflow_run' &&
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event != 'pull_request' &&
      github.event.workflow_run.head_branch == 'main') ||
      (github.event_name == 'workflow_dispatch' &&
      github.ref == 'refs/heads/main')
    needs: flatpak
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - name: Deploy GitHub Pages
        id: deployment
        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0