name: Build Packages

# Builds the seven Slackware .txz packages defined under packages/
# (podman, conmon, crun, netavark, aardvark-dns, passt, fuse-overlayfs)
# inside a Slackware container, verifies + consolidates their checksums, and
# uploads the result as a workflow artifact.
#
# Intentionally does NOT commit any built binary back to the repository —
# packages/**, *.txz, dist/ are all git-ignored (see .gitignore). Artifacts
# only ever leave this workflow via the "Upload build artifacts" step below
# (retained by GitHub Actions, not the repo) or, for tagged releases, via
# release.yml attaching them to a GitHub Release.
#
# See docs/ARCHITECTURE.md section 5 (Paketmanagement).

on:
  push:
    branches: [main]
    paths:
      - "packages/**"
      - "versions.env"
      - "scripts/**"
      - ".github/workflows/build-packages.yml"
  pull_request:
    paths:
      - "packages/**"
      - "versions.env"
      - "scripts/**"
      - ".github/workflows/build-packages.yml"
  workflow_dispatch:
    inputs:
      packages:
        description: >
          Space-separated package names to build (default: all seven).
          Example: "podman conmon"
        required: false
        default: ""
  workflow_call:
    outputs:
      artifact-name:
        description: "Name of the uploaded dist/ artifact"
        value: ${{ jobs.build.outputs.artifact-name }}

# Pin the Slackware build image by tag here. vbatts/slackware is a
# long-standing, widely used Slackware Docker image; swap this (and ideally
# pin by digest) if the project standardizes on a different/self-hosted
# base image. See scripts/ci/setup-slackware-buildenv.sh for how missing
# build dependencies are bootstrapped on top of whatever this image ships.
#
# vbatts/slackware:15.0 ships tar but NOT git (needed by actions/checkout)
# or any of git's runtime dependencies. The "Install git" step below pulls
# git and its missing shared libraries from Slackware's own official
# package mirror, pinned by exact filename + verified SHA256, before
# actions/checkout runs — see that step for the full dependency chain
# (found by trial: git needs libnghttp2, which needs nothing extra, but
# git also dlopens libbrotlidec and libsasl2 for HTTPS transport).
env:
  SLACKWARE_IMAGE: "vbatts/slackware:15.0"
  SLACKWARE_MIRROR: "http://slackware.osuosl.org/slackware64-15.0/slackware64"
  GIT_PKG: "d/git-2.35.1-x86_64-1.txz"
  GIT_PKG_SHA256: "502a8e921c13a3e89fa121d26e6e376bd927b05e5a2d1039c1bf815ab6ec535d"
  CA_CERTIFICATES_PKG: "n/ca-certificates-20211216-noarch-1.txz"
  CA_CERTIFICATES_PKG_SHA256: "e26e8e1371dd5f4f53978cef0449542e7e56b26d1813dcbc546159b551939a91"
  NGHTTP2_PKG: "n/nghttp2-1.46.0-x86_64-1.txz"
  NGHTTP2_PKG_SHA256: "cad5c7b38ae424b3f44b707637623f740da45a1d1f9938933dc472f931d2bddc"
  BROTLI_PKG: "l/brotli-1.0.9-x86_64-7.txz"
  BROTLI_PKG_SHA256: "f20e995cce0cf5c4f2575f94e87978e6e5f7d3923e847e3bca814e7c324bd474"
  CYRUS_SASL_PKG: "n/cyrus-sasl-2.1.27-x86_64-7.txz"
  CYRUS_SASL_PKG_SHA256: "b613130758ec952b8585e03f5174c924bc8bfc6d90aa6c53e7e73a30c6801b68"

jobs:
  build:
    name: Build .txz packages
    runs-on: ubuntu-latest
    container:
      image: ${{ env.SLACKWARE_IMAGE }}
    outputs:
      artifact-name: ${{ steps.artifact-name.outputs.value }}
    steps:
      - name: Install git (needed before actions/checkout can run)
        run: |
          set -eu
          command -v tar > /dev/null || (echo "!! base image is missing tar — see SLACKWARE_IMAGE in this workflow" && exit 1)

          cd /tmp
          for pkg in "$CA_CERTIFICATES_PKG" "$NGHTTP2_PKG" "$BROTLI_PKG" "$CYRUS_SASL_PKG" "$GIT_PKG"; do
            wget -q --tries=3 "$SLACKWARE_MIRROR/$pkg"
          done
          echo "${CA_CERTIFICATES_PKG_SHA256}  $(basename "$CA_CERTIFICATES_PKG")" | sha256sum -c -
          echo "${NGHTTP2_PKG_SHA256}  $(basename "$NGHTTP2_PKG")" | sha256sum -c -
          echo "${BROTLI_PKG_SHA256}  $(basename "$BROTLI_PKG")" | sha256sum -c -
          echo "${CYRUS_SASL_PKG_SHA256}  $(basename "$CYRUS_SASL_PKG")" | sha256sum -c -
          echo "${GIT_PKG_SHA256}  $(basename "$GIT_PKG")" | sha256sum -c -

          # installpkg has no dependency resolver (unlike slackpkg) — install
          # git's runtime libs first, then git itself.
          installpkg "$(basename "$CA_CERTIFICATES_PKG")"
          installpkg "$(basename "$NGHTTP2_PKG")"
          installpkg "$(basename "$BROTLI_PKG")"
          installpkg "$(basename "$CYRUS_SASL_PKG")"
          installpkg "$(basename "$GIT_PKG")"

          # ca-certificates ships individual certs under
          # /usr/share/ca-certificates/ — this builds the combined bundle
          # git needs to actually trust HTTPS remotes (without it, cloning
          # from a Gitea instance over HTTPS fails cert verification even
          # though the certs are installed).
          update-ca-certificates
          echo "GIT_SSL_CAINFO=/etc/ssl/certs/ca-certificates.crt" >> "$GITHUB_ENV"

          git --version

      - uses: actions/checkout@v4

      - name: Set up Slackware build environment
        run: scripts/ci/setup-slackware-buildenv.sh

      - name: Build packages
        run: scripts/build-packages.sh ${{ github.event.inputs.packages }}

      - name: Verify and consolidate checksums
        run: scripts/checksums.sh

      - name: Compute artifact name
        id: artifact-name
        run: echo "value=podman-packages-${{ github.sha }}" >> "$GITHUB_OUTPUT"

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.artifact-name.outputs.value }}
          path: |
            dist/*.txz
            dist/*.sha256
            dist/*.md5
            dist/CHECKSUMS.sha256
            dist/CHECKSUMS.md5
          if-no-files-found: error
          retention-days: 14