name: build

# Build a versioned Linux CLI release tarball (see `make package`), the
# Pebble watchapp (see `make watchapp`), and the Android app (see `make
# android`) on every push/PR, plus on-demand via the Gitea "Run workflow"
# button. Runs inside build-image (see ../../build-image/Dockerfile,
# built/pushed via ../../build-image.sh and ../../upload-image.sh), which
# bundles the Pebble SDK and the Android SDK/NDK alongside the C
# toolchain. Unlike the CLI/Pebble build path, the Android build still
# needs network access at job runtime (Gradle/AGP/androidx dependency
# resolution) - see the root CLAUDE.md's Android section.
on:
  push:
  pull_request:
  workflow_dispatch:

jobs:
  build:
    # Runner defaults `run:` steps to `sh`, which doesn't understand
    # `set -o pipefail` used below — force bash explicitly.
    defaults:
      run:
        shell: bash
    # Must match a label your act_runner is registered with.
    runs-on: ubuntu-latest

    container:
      image: cr.ladkau.de/deck-in-a-dash/builder:latest
      credentials:
        username: ${{ secrets.REGISTRY_USER }}
        password: ${{ secrets.REGISTRY_PASSWORD }}

    steps:
      - uses: actions/checkout@v4
        with:
          # `make package`/`make watchapp`'s version comes from `git
          # describe --tags` - needs full history/tags, not
          # actions/checkout's default shallow single-commit clone.
          fetch-depth: 0

      - name: Preflight
        run: |
          set -euo pipefail
          command -v cc >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: no C compiler (cc) in PATH" >&2; exit 1; }
          command -v make >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: make not in PATH" >&2; exit 1; }
          command -v pebble >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: pebble not in PATH" >&2; exit 1; }
          command -v java >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: java not in PATH" >&2; exit 1; }
          [ -n "${ANDROID_HOME:-}" ] || { echo "PREFLIGHT FAIL: ANDROID_HOME not set" >&2; exit 1; }
          [ -n "${ANDROID_NDK_HOME:-}" ] || { echo "PREFLIGHT FAIL: ANDROID_NDK_HOME not set" >&2; exit 1; }

      - name: Build and test
        run: |
          set -euo pipefail
          make test
          make package
          make watchapp
          make android

      - name: Upload build artifact
        # v4 uses the newer @actions/artifact backend, which this Gitea
        # instance's artifact storage doesn't support (GHESNotSupportedError) — v3 works.
        uses: actions/upload-artifact@v3
        with:
          name: deck-in-a-dash
          path: dist/deck-in-a-dash-*-linux-*.tar.gz

      - name: Upload watchapp artifact
        uses: actions/upload-artifact@v3
        with:
          name: deck-in-a-dash-watchapp
          path: dist/deck-in-a-dash-*.pbw

      - name: Upload android artifact
        uses: actions/upload-artifact@v3
        with:
          name: deck-in-a-dash-android
          path: dist/deck-in-a-dash-*.apk

      - name: Publish to dl.ladkau.de
        # Uploads the tarball, .pbw, and .apk over SFTP instead of using
        # actions/upload-artifact (whose zip wrapping can't be disabled).
        # Only runs on push so PR builds don't publish.
        if: gitea.event_name == 'push'
        run: |
          set -euo pipefail
          TARBALL="$(ls dist/deck-in-a-dash-*-linux-*.tar.gz)"
          PBW="$(ls dist/deck-in-a-dash-*.pbw)"
          APK="$(ls dist/deck-in-a-dash-*.apk)"
          mkdir -p ~/.ssh
          echo "${{ secrets.DL_SFTP_KEY }}" > ~/.ssh/dl_sftp_key
          chmod 600 ~/.ssh/dl_sftp_key
          sftp -i ~/.ssh/dl_sftp_key -P 2223 \
            -o StrictHostKeyChecking=accept-new \
            uploader@dl.ladkau.de <<EOF
          -mkdir files/deck-in-a-dash
          put $TARBALL files/deck-in-a-dash/$(basename "$TARBALL")
          put $PBW files/deck-in-a-dash/$(basename "$PBW")
          put $APK files/deck-in-a-dash/$(basename "$APK")
          EOF