ci.yml

name: CI

on:
  push:
    branches:
      - master
      - feature/ci

    tags:
      - v[0-9]+.*
      - testing-ci.*

  pull_request:

jobs:
  lint:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v3

    - name: Install dependencies
      run: |
        sudo apt-get -y update
        sudo apt-get -y install libudev-dev

    - name: Install rust
      run: |
        rustup update stable && rustup default stable
        rustup component add clippy

    - name: Run clippy
      run: cargo clippy --all --all-features -- -Dwarnings

  test:
    name: Test
    runs-on: ubuntu-latest

    strategy:
      matrix:
        toolchain: [stable, nightly]

    steps:
    - name: Checkout code
      uses: actions/checkout@v3

    - name: Install dependencies
      run: |
        sudo apt-get -y update
        sudo apt-get -y install libudev-dev

    - name: Install rust
      run: rustup update ${{ matrix.toolchain }} && rustup default ${{ matrix.toolchain }}

    - name: Build
      run: cargo build --all

    - name: Test
      run: cargo test --all

  build-bin:
    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/')

    name: Build binary package
    runs-on: ubuntu-20.04
    needs: [lint, test]

    steps:
    - name: Checkout code
      uses: actions/checkout@v3

    - name: Install dependencies
      run: |
        sudo apt-get -y update
        sudo apt-get -y install libudev-dev

    - name: Install rust
      run: rustup update stable && rustup default stable

    - name: Build package
      run: ./pkg/bin/makebin

    - name: Prepare release
      run: mkdir release && mv pkg/bin/*.tar.xz release

    - name: Upload artifacts
      uses: actions/upload-artifact@v3
      with:
        name: binary-latest
        path: release

  build-deb:
    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/')

    name: Build deb package
    runs-on: ubuntu-20.04
    needs: [lint, test]

    steps:
    - name: Checkout code
      uses: actions/checkout@v3

    - name: Install dependencies
      run: |
        sudo apt-get -y update
        sudo apt-get -y install libudev-dev
        sudo apt-get -y install debhelper fakeroot dpkg-sig

    - name: Install rust
      run: rustup update stable && rustup default stable

    - name: Build package
      run: ./pkg/deb/makedeb

    - name: Sign package
      env:
        GPG_KEY_ID: 56C464BAAC421453
        GPG_KEY: ${{ secrets.LINUX_SURFACE_GPG_KEY }}
      run: |
        # import GPG key
        echo "$GPG_KEY" | base64 -d | gpg --import --no-tty --batch --yes
        export GPG_TTY=$(tty)

        # sign package
        cd pkg/deb && dpkg-sig -g "--batch --no-tty" --sign builder -k $GPG_KEY_ID ./*.deb

    - name: Prepare release
      run: mkdir release && mv pkg/deb/*.deb release

    - name: Upload artifacts
      uses: actions/upload-artifact@v3
      with:
        name: debian-latest
        path: release

  build-f38:
    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/')

    name: Build Fedora 38 package
    runs-on: ubuntu-latest
    needs: [lint, test]
    container:
      image: registry.fedoraproject.org/fedora:38
      options: --security-opt seccomp=unconfined

    steps:
    - name: Checkout code
      uses: actions/checkout@v3

    - name: Install build dependencies
      run: |
        dnf distro-sync -y
        dnf install -y rpmdevtools rpm-sign 'dnf-command(builddep)'
        dnf builddep -y pkg/fedora/surface-control.spec

    - name: Build package
      run: |
        cd pkg/fedora
        # Build the .rpm packages
        ./makerpm

    - name: Sign packages
      env:
        GPG_KEY_ID: 56C464BAAC421453
        GPG_KEY: ${{ secrets.LINUX_SURFACE_GPG_KEY }}
      run: |
        cd pkg/fedora/out/x86_64

        # import GPG key
        echo "$GPG_KEY" | base64 -d | gpg --import --no-tty --batch --yes

        # sign package
        rpm --resign *.rpm --define "_gpg_name $GPG_KEY_ID"

    - name: Upload artifacts
      uses: actions/upload-artifact@v3
      with:
        name: fedora-38-latest
        path: pkg/fedora/out/x86_64

  build-f37:
    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/')

    name: Build Fedora 37 package
    runs-on: ubuntu-latest
    needs: [lint, test]
    container:
      image: registry.fedoraproject.org/fedora:37
      options: --security-opt seccomp=unconfined

    steps:
    - name: Checkout code
      uses: actions/checkout@v3

    - name: Install build dependencies
      run: |
        dnf distro-sync -y
        dnf install -y rpmdevtools rpm-sign 'dnf-command(builddep)'
        dnf builddep -y pkg/fedora/surface-control.spec

    - name: Build package
      run: |
        cd pkg/fedora
        # Build the .rpm packages
        ./makerpm

    - name: Sign packages
      env:
        GPG_KEY_ID: 56C464BAAC421453
        GPG_KEY: ${{ secrets.LINUX_SURFACE_GPG_KEY }}
      run: |
        cd pkg/fedora/out/x86_64

        # import GPG key
        echo "$GPG_KEY" | base64 -d | gpg --import --no-tty --batch --yes

        # sign package
        rpm --resign *.rpm --define "_gpg_name $GPG_KEY_ID"

    - name: Upload artifacts
      uses: actions/upload-artifact@v3
      with:
        name: fedora-37-latest
        path: pkg/fedora/out/x86_64

  release:
    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/')

    name: Publish release
    needs: [build-bin, build-deb, build-f38, build-f37]
    runs-on: ubuntu-latest

    steps:
    - name: Download binary artifacts
      uses: actions/download-artifact@v3
      with:
        name: binary-latest
        path: binary-latest

    - name: Download Debian artifacts
      uses: actions/download-artifact@v3
      with:
        name: debian-latest
        path: debian-latest

    - name: Download Fedora 38 artifacts
      uses: actions/download-artifact@v3
      with:
        name: fedora-38-latest
        path: fedora-38-latest

    - name: Download Fedora 37 artifacts
      uses: actions/download-artifact@v3
      with:
        name: fedora-37-latest
        path: fedora-37-latest

    - name: Upload assets
      uses: svenstaro/upload-release-action@v2
      with:
        repo_token: ${{ secrets.GITHUB_TOKEN }}
        file: ./*-latest/*
        tag: ${{ github.ref }}
        overwrite: true
        file_glob: true

  repo-deb:
    name: Update Debian package repository
    needs: [release]
    runs-on: ubuntu-latest
    container: debian:sid
    steps:
    - name: Install dependencies
      run: |
        apt-get update
        apt-get install -y git

    - name: Download artifacts
      uses: actions/download-artifact@v3
      with:
        name: debian-latest
        path: debian-latest

    - name: Update repository
      env:
        SURFACEBOT_TOKEN: ${{ secrets.LINUX_SURFACE_BOT_TOKEN }}
        BRANCH_STAGING: u/staging
        GIT_REF: ${{ github.ref }}
      run: |
        repo="https://surfacebot:${SURFACEBOT_TOKEN}@github.com/linux-surface/repo.git"

        # clone package repository
        git clone -b "${BRANCH_STAGING}" "${repo}" repo

        # copy packages
        cp debian-latest/* repo/debian/
        cd repo/debian

        # parse git tag from ref
        GIT_TAG=$(echo $GIT_REF | sed 's|^refs/tags/||g')

        # convert packages into references
        for pkg in $(find . -name '*.deb'); do
          echo "surface-control:$GIT_TAG/$(basename $pkg)" > $pkg.blob
          rm $pkg
        done

        # set git identity
        git config --global user.email "surfacebot@users.noreply.github.com"
        git config --global user.name "surfacebot"

        # commit and push
        update_branch="${BRANCH_STAGING}-$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)"
        git switch -c "${update_branch}"
        git add .
        git commit -m "Update Debian surface-control"
        git push --set-upstream origin "${update_branch}"

  repo-f38:
    name: Update Fedora 38 package repository
    needs: [release]
    runs-on: ubuntu-latest
    container:
      image: registry.fedoraproject.org/fedora:38
      options: --security-opt seccomp=unconfined
    steps:
    - name: Install dependencies
      run: |
        dnf install -y git findutils

    - name: Download artifacts
      uses: actions/download-artifact@v3
      with:
        name: fedora-38-latest
        path: fedora-38-latest

    - name: Update repository
      env:
        SURFACEBOT_TOKEN: ${{ secrets.LINUX_SURFACE_BOT_TOKEN }}
        BRANCH_STAGING: u/staging
        GIT_REF: ${{ github.ref }}
      run: |
        repo="https://surfacebot:${SURFACEBOT_TOKEN}@github.com/linux-surface/repo.git"

        # clone package repository
        git clone -b "${BRANCH_STAGING}" "${repo}" repo

        # copy packages
        cp fedora-38-latest/* repo/fedora/f38
        cd repo/fedora/f38

        # parse git tag from ref
        GIT_TAG=$(echo $GIT_REF | sed 's|^refs/tags/||g')

        # convert packages into references
        for pkg in $(find . -name '*.rpm'); do
          echo "surface-control:$GIT_TAG/$(basename $pkg)" > $pkg.blob
          rm $pkg
        done

        # set git identity
        git config --global user.email "surfacebot@users.noreply.github.com"
        git config --global user.name "surfacebot"

        # commit and push
        update_branch="${BRANCH_STAGING}-$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)"
        git checkout -b "${update_branch}"
        git add .
        git commit -m "Update Fedora 38 surface-control"
        git push --set-upstream origin "${update_branch}"

  repo-f37:
    name: Update Fedora 37 package repository
    needs: [release]
    runs-on: ubuntu-latest
    container:
      image: registry.fedoraproject.org/fedora:37
      options: --security-opt seccomp=unconfined
    steps:
    - name: Install dependencies
      run: |
        dnf install -y git findutils

    - name: Download artifacts
      uses: actions/download-artifact@v3
      with:
        name: fedora-37-latest
        path: fedora-37-latest

    - name: Update repository
      env:
        SURFACEBOT_TOKEN: ${{ secrets.LINUX_SURFACE_BOT_TOKEN }}
        BRANCH_STAGING: u/staging
        GIT_REF: ${{ github.ref }}
      run: |
        repo="https://surfacebot:${SURFACEBOT_TOKEN}@github.com/linux-surface/repo.git"

        # clone package repository
        git clone -b "${BRANCH_STAGING}" "${repo}" repo

        # copy packages
        cp fedora-37-latest/* repo/fedora/f37
        cd repo/fedora/f37

        # parse git tag from ref
        GIT_TAG=$(echo $GIT_REF | sed 's|^refs/tags/||g')

        # convert packages into references
        for pkg in $(find . -name '*.rpm'); do
          echo "surface-control:$GIT_TAG/$(basename $pkg)" > $pkg.blob
          rm $pkg
        done

        # set git identity
        git config --global user.email "surfacebot@users.noreply.github.com"
        git config --global user.name "surfacebot"

        # commit and push
        update_branch="${BRANCH_STAGING}-$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)"
        git checkout -b "${update_branch}"
        git add .
        git commit -m "Update Fedora 37 surface-control"
        git push --set-upstream origin "${update_branch}"