on:
  push:
    tags:
      - 'fedora-37-*'

name: Fedora 37

env:
  GPG_KEY_ID: 56C464BAAC421453

jobs:
  build:
    name: Build Kernel
    runs-on: ubuntu-latest
    container: registry.fedoraproject.org/fedora:37
    steps:
    - name: Checkout code
      uses: actions/checkout@v3

    - name: Install build dependencies
      run: |
        dnf distro-sync -y
        dnf install -y git make gcc flex bison bzip2 rpm-build
        dnf install -y rpmdevtools rpm-sign 'dnf-command(builddep)'

        # Install build dependencies
        dnf builddep -y kernel

        # Install additional build dependencies
        dnf install -y sbsigntools

    - name: Setup secureboot certificate
      env:
        SB_KEY: ${{ secrets.SURFACE_SB_KEY }}
      run: |
        # Install the surface secureboot certificate
        echo "$SB_KEY" | base64 -d > pkg/fedora/kernel-surface/secureboot/MOK.key
        cp pkg/keys/surface.crt pkg/fedora/kernel-surface/secureboot/MOK.crt

    - name: Build packages
      run: |
        cd pkg/fedora/kernel-surface

        # setup git
        git config --global user.email "surfacebot@users.noreply.github.com"
        git config --global user.name "surfacebot"

        # Build source RPM packages
        python3 build-linux-surface.py --mode srpm --ark-dir kernel-ark --outdir srpm

        # Remove the kernel-ark tree to get as much free disk space as possible
        rm -rf kernel-ark

        # Build binary RPM packages
        rpmbuild -rb --define "_rpmdir $PWD/out" srpm/*.src.rpm

    - name: Sign packages
      env:
        GPG_KEY: ${{ secrets.LINUX_SURFACE_GPG_KEY }}
      run: |
        cd pkg/fedora/kernel-surface/out/x86_64

        # import GPG key
        echo "$GPG_KEY" | base64 -d | gpg --import --no-tty --batch --yes

        # sign packages
        rpm --resign *.rpm --define "_gpg_name $GPG_KEY_ID"

    - name: Upload artifacts
      uses: actions/upload-artifact@v3
      with:
        name: fedora-37-latest
        path: pkg/fedora/kernel-surface/out/x86_64

  release:
    name: Publish release
    needs: [build]
    runs-on: ubuntu-latest
    steps:
    - name: Download artifacts
      uses: actions/download-artifact@v3
      with:
        name: fedora-37-latest
        path: fedora-37-latest

    - name: Upload assets
      uses: svenstaro/upload-release-action@v2
      with:
        repo_token: ${{ secrets.LINUX_SURFACE_BOT_TOKEN }}
        file: ./*-latest/*
        tag: ${{ github.ref }}
        overwrite: true
        file_glob: true

  repo:
    name: Update package repository
    needs: [release]
    runs-on: ubuntu-latest
    container: registry.fedoraproject.org/fedora:37
    steps:
    - name: Install dependencies
      run: |
        dnf install -y git findutils

    - name: Download artifacts
      uses: actions/download-artifact@v3
      with:
        name: fedora-37-latest
        path: fedora-37-latest

    - name: Update repository
      env:
        SURFACEBOT_TOKEN: ${{ secrets.LINUX_SURFACE_BOT_TOKEN }}
        BRANCH_STAGING: u/staging
        GIT_REF: ${{ github.ref }}
      run: |
        repo="https://surfacebot:${SURFACEBOT_TOKEN}@github.com/linux-surface/repo.git"

        # clone package repository
        git clone -b "${BRANCH_STAGING}" "${repo}" repo

        # copy packages
        cp fedora-37-latest/* repo/fedora/f37
        cd repo/fedora/f37

        # parse git tag from ref
        GIT_TAG=$(echo $GIT_REF | sed 's|^refs/tags/||g')

        # convert packages into references
        for pkg in $(find . -name '*.rpm'); do
          echo "linux-surface:$GIT_TAG/$(basename $pkg)" > $pkg.blob
          rm $pkg
        done

        # set git identity
        git config --global user.email "surfacebot@users.noreply.github.com"
        git config --global user.name "surfacebot"

        # commit and push
        update_branch="${BRANCH_STAGING}-$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)"
        git checkout -b "${update_branch}"
        git add .
        git commit -m "Update Fedora 37 kernel"
        git push --set-upstream origin "${update_branch}"