name: Build
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    env:
      STACK_ROOT: ${{ github.workspace }}/.stack-root
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Stack
        run: |
          curl -sSL https://get.haskellstack.org/ | sh

      - name: Cache Stack
        uses: actions/cache@v4
        with:
          path: .stack-root
          key: stack-v2-${{ runner.os }}-${{ hashFiles('stack.yaml', 'package.yaml') }}
          restore-keys: stack-v2-${{ runner.os }}-

      - name: Build
        run: |
          mkdir -p build
          stack build --copy-bins --local-bin-path ./build

      - name: Compress with UPX
        run: |
          UPX_VERSION="5.1.1"
          UPX_ARCHIVE="upx-${UPX_VERSION}-amd64_linux.tar.xz"
          UPX_DIR="/tmp/upx-${UPX_VERSION}-amd64_linux"
          if [ ! -x "${UPX_DIR}/upx" ]; then
            curl -fsSL "https://github.com/upx/upx/releases/download/v${UPX_VERSION}/${UPX_ARCHIVE}" \
              | tar -xJ -C /tmp
          fi
          ${UPX_DIR}/upx build/converge

      - name: Build Arch package
        run: |
          # Build the package inside an Arch Linux container.
          # Pipe workspace via stdin to avoid Docker-in-Docker volume mount issues.
          # All build output goes to stderr (visible in logs); only the package
          # tar goes to stdout so it can be captured cleanly.
          tar cf - --exclude=.stack-root --exclude=.stack-work . | \
            docker run --rm -i -w /build archlinux:latest bash -c "
              mkdir -p /build &&
              cd /build &&
              tar xf - &&
              pacman -Syu --noconfirm >&2 &&
              pacman -S --noconfirm git fakeroot debugedit >&2 &&
              useradd -m build &&
              chown -R build:build . &&
              runuser -u build -- makepkg --noconfirm --nodeps --nocheck >&2 &&
              tar cf /dev/stdout converge-*.pkg.tar.zst
            " > /tmp/packages.tar
          tar xf /tmp/packages.tar
          echo "pkgfile=$(ls converge-[0-9]*.pkg.tar.zst)" >> "$GITHUB_ENV"

      - name: Publish to Arch repo
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        env:
          SSH_AUTH_SOCK: /dev/null
        run: |
          # Set up SSH
          mkdir -p "$HOME/.ssh"
          echo "${{ secrets.ARCH_REPO_SSH_KEY }}" > "$HOME/.ssh/id_ed25519"
          chmod 600 "$HOME/.ssh/id_ed25519"
          ssh-keyscan -H "${{ vars.ARCH_REPO_HOST }}" >> "$HOME/.ssh/known_hosts" 2>/dev/null

          PKGFILE="${{ env.pkgfile }}"
          echo "Uploading $PKGFILE to ${{ vars.ARCH_REPO_HOST }}..."

          # Upload the package
          scp -v -i "$HOME/.ssh/id_ed25519" \
            "$PKGFILE" \
            "${{ vars.ARCH_REPO_USER }}@${{ vars.ARCH_REPO_HOST }}:${{ vars.ARCH_REPO_PATH }}/"

          # Add to repo database
          ssh -v -i "$HOME/.ssh/id_ed25519" \
            "${{ vars.ARCH_REPO_USER }}@${{ vars.ARCH_REPO_HOST }}" \
            "cd '${{ vars.ARCH_REPO_PATH }}' && \
             repo-add '${{ vars.ARCH_REPO_DB }}' '$PKGFILE' && \
             rm -f '$PKGFILE.old'"

      - name: Upload artifact
        uses: actions/upload-artifact@v3
        with:
          name: converge
          path: build/converge