name: Build
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    env:
      STACK_ROOT: ${{ github.workspace }}/.stack-root
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Stack
        run: |
          curl -sSL https://get.haskellstack.org/ | sh

      - name: Cache Stack
        uses: actions/cache@v4
        with:
          path: .stack-root
          key: stack-v2-${{ runner.os }}-${{ hashFiles('stack.yaml', 'package.yaml') }}
          restore-keys: stack-v2-${{ runner.os }}-

      - name: Build
        run: |
          mkdir -p build
          stack build --copy-bins --local-bin-path ./build

      - name: Compress with UPX
        run: |
          UPX_VERSION="5.1.1"
          UPX_ARCHIVE="upx-${UPX_VERSION}-amd64_linux.tar.xz"
          UPX_DIR="/tmp/upx-${UPX_VERSION}-amd64_linux"
          if [ ! -x "${UPX_DIR}/upx" ]; then
            curl -fsSL "https://github.com/upx/upx/releases/download/v${UPX_VERSION}/${UPX_ARCHIVE}" \
              | tar -xJ -C /tmp
          fi
          ${UPX_DIR}/upx build/converge

      - name: Build Arch package
        run: |
          # Build the package inside an Arch Linux container
          # (PKGBUILD detects build/converge as pre-built binary)
          docker run --rm \
            -v "$PWD:$PWD" \
            -w "$PWD" \
            archlinux:latest \
            bash -c 'pacman -Syu --noconfirm && pacman -S --noconfirm git && useradd -m build && chown -R build:build . && su build -c "makepkg --noconfirm --nodeps"'
          echo "pkgfile=$(ls converge-*.pkg.tar.zst)" >> "$GITHUB_ENV"

      - name: Publish to Arch repo
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        env:
          SSH_AUTH_SOCK: /dev/null
        run: |
          set -euo pipefail

          # Set up SSH
          mkdir -p "$HOME/.ssh"
          echo "${{ secrets.ARCH_REPO_SSH_KEY }}" > "$HOME/.ssh/id_ed25519"
          chmod 600 "$HOME/.ssh/id_ed25519"
          ssh-keyscan -H "${{ secrets.ARCH_REPO_HOST }}" >> "$HOME/.ssh/known_hosts" 2>/dev/null

          PKGFILE="${{ env.pkgfile }}"

          # Upload the package
          scp -i "$HOME/.ssh/id_ed25519" \
            "$PKGFILE" \
            "${{ secrets.ARCH_REPO_USER }}@${{ secrets.ARCH_REPO_HOST }}:${{ secrets.ARCH_REPO_PATH }}/"

          # Add to repo database
          ssh -i "$HOME/.ssh/id_ed25519" \
            "${{ secrets.ARCH_REPO_USER }}@${{ secrets.ARCH_REPO_HOST }}" \
            "cd '${{ secrets.ARCH_REPO_PATH }}' && \
             repo-add '${{ secrets.ARCH_REPO_DB }}' '$PKGFILE' && \
             rm -f '$PKGFILE.old'"

      - name: Upload artifact
        uses: actions/upload-artifact@v3
        with:
          name: converge
          path: build/converge