name: AUR Nightly (kst4contest-git)

on:
  workflow_run:
    workflows: ["Nightly Runtime Artifacts"]
    types: [completed]
  workflow_dispatch:

permissions:
  contents: read

env:
  AUR_SSH_DIR: /tmp/aur-ssh

jobs:
  update-aur-git:
    if: >-
      github.event_name == 'workflow_dispatch' ||
      github.event.workflow_run.conclusion == 'success'

    runs-on: ubuntu-latest

    container:
      image: archlinux:latest

    steps:
      - name: Install dependencies
        run: |
          pacman -Sy --noconfirm git openssh base-devel
          useradd -m builder

      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Mark workspace as safe Git directory
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Compute pkgver
        id: ver
        run: |
          BASE=$(grep -m1 '<version>' pom.xml \
            | sed 's/.*<version>\(.*\)<\/version>.*/\1/' \
            | sed 's/[-.]nightly//')

          GIT_PKGVER="${BASE}.r$(git rev-list --count HEAD).g$(git rev-parse --short HEAD)"

          echo "Computed pkgver: ${GIT_PKGVER}"
          echo "pkgver=${GIT_PKGVER}" >> "$GITHUB_OUTPUT"

      - name: Update PKGBUILD
        env:
          PKGVER: ${{ steps.ver.outputs.pkgver }}
        run: |
          sed -i "s/^pkgver=.*/pkgver=${PKGVER}/" \
            packaging/aur/kst4contest-git/PKGBUILD

      - name: Generate .SRCINFO
        run: |
          cp -r packaging/aur/kst4contest-git /tmp/kst4contest-git
          chown -R builder:builder /tmp/kst4contest-git

          su builder -c \
            "cd /tmp/kst4contest-git && makepkg --printsrcinfo > .SRCINFO"

          cp /tmp/kst4contest-git/.SRCINFO \
            packaging/aur/kst4contest-git/.SRCINFO

          echo "Generated .SRCINFO:"
          cat packaging/aur/kst4contest-git/.SRCINFO

      - name: Set up and verify AUR SSH
        env:
          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
        run: |
          mkdir -p "${AUR_SSH_DIR}"

          printf '%s\n' "${AUR_SSH_PRIVATE_KEY}" \
            > "${AUR_SSH_DIR}/aur_ed25519"

          sed -i 's/\r$//' "${AUR_SSH_DIR}/aur_ed25519"
          chmod 600 "${AUR_SSH_DIR}/aur_ed25519"

          ssh-keygen -y \
            -f "${AUR_SSH_DIR}/aur_ed25519" \
            > /dev/null

          ssh-keyscan \
            -T 10 \
            -t ed25519 \
            aur.archlinux.org \
            > "${AUR_SSH_DIR}/known_hosts"

          if [ ! -s "${AUR_SSH_DIR}/known_hosts" ]; then
            echo "::error::No SSH host key was received from aur.archlinux.org."
            exit 1
          fi

          echo "Received AUR host-key fingerprint:"
          ssh-keygen -lf "${AUR_SSH_DIR}/known_hosts"

          if ! ssh-keygen -lf "${AUR_SSH_DIR}/known_hosts" \
            | grep -Fq "SHA256:RFzBCUItH9LZS0cKB5UE6ceAYhBD5C8GeOBip8Z11+4"; then
            echo "::error::The AUR SSH host-key fingerprint does not match the official fingerprint."
            exit 1
          fi

          printf '%s\n' \
            "Host aur.archlinux.org" \
            "  HostName aur.archlinux.org" \
            "  User aur" \
            "  IdentityFile ${AUR_SSH_DIR}/aur_ed25519" \
            "  IdentitiesOnly yes" \
            "  StrictHostKeyChecking yes" \
            "  UserKnownHostsFile ${AUR_SSH_DIR}/known_hosts" \
            > "${AUR_SSH_DIR}/config"

          chmod 600 "${AUR_SSH_DIR}/config"
          chmod 600 "${AUR_SSH_DIR}/known_hosts"

      - name: Push package metadata to AUR
        env:
          GIT_SSH_COMMAND: ssh -F /tmp/aur-ssh/config
        run: |
          git config --global user.email "philipp@wagnersnetz.de"
          git config --global user.name "Philipp Wagner"

          AUR_DIR="/tmp/aur/kst4contest-git"

          mkdir -p "$(dirname "${AUR_DIR}")"

          git -c init.defaultBranch=master clone \
            "ssh://aur@aur.archlinux.org/kst4contest-git.git" \
            "${AUR_DIR}"

          cp packaging/aur/kst4contest-git/PKGBUILD \
            "${AUR_DIR}/PKGBUILD"

          cp packaging/aur/kst4contest-git/.SRCINFO \
            "${AUR_DIR}/.SRCINFO"

          git -C "${AUR_DIR}" add PKGBUILD .SRCINFO

          if git -C "${AUR_DIR}" diff --cached --quiet; then
            echo "kst4contest-git: package metadata is already current."
          else
            git -C "${AUR_DIR}" commit \
              -m "Update pkgver to ${{ steps.ver.outputs.pkgver }}"

            git -C "${AUR_DIR}" push origin HEAD:master

            echo "kst4contest-git: successfully pushed to AUR."
          fi