debian-base/.gitea/workflows/base-build.yml

name: Build, Upload RootFS, and Push Docker Images, update changelog, update build info.

on:
  push:
    branches:
      - main
    paths:
      - '.gitea/workflows/*.yml'
      - 'base-image-script/*.sh'
      - '!**/debian-*.tar.bz2'
      - '!/sha256sums.txt'
      - '!**/CHANGES.md'
      - '!**/build-info.json'
  schedule:
    - cron: '0 12 * * 0'  # Sunday at noon UTC

env:
  REPO_URL: ${{ secrets.REPO_URL }}
  GIT_USERNAME: ${{ secrets.GIT_USERNAME }}
  GIT_EMAIL: ${{ secrets.GIT_EMAIL }}
  GIT_PASSWORD: ${{ secrets.GIT_PASSWORD }}
  GIT_TOKEN: ${{ secrets.GIT_TOKEN }}
  GIT_CREDENTIAL: ${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}
  DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
  DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
  VERSIONS: "bullseye bookworm trixie"
  OUTPUT_DIR: ./output

jobs:
  # build-and-push-rootfs-archives:
  #   runs-on: vm-docker-build2
  #   outputs:
  #     archives_changed: ${{ steps.commit_archives.outputs.archives_changed }}
  #   steps:
  #     - name: Checkout source
  #       uses: actions/checkout@v3

  #     - name: Create output directory
  #       run: mkdir -p ./output

  #     - name: Build all Debian rootfs versions into volumes and extract
  #       run: |
  #         versions=($VERSIONS)
  #         for version in "${versions[@]}"; do
  #           echo "[INFO] Building $version..."
  #           volume_name="build_output_$version"
  #           docker volume create "$volume_name"

  #           docker build --build-arg VERSION=$version -t fithwum/debian-$version-base .

  #           docker run --rm --privileged \
  #             -v "$volume_name:/output" \
  #             -e VERSION="$version" \
  #             fithwum/debian-$version-base \
  #             bash -c "/scripts/bootstrap-rootfs.sh \"$version\""

  #           # Extract the output file from the volume
  #           container_id=$(docker create -v "$volume_name:/output" debian)
  #           mkdir -p ./output/$version
  #           docker cp "$container_id:/output/$version/debian-$version.tar.bz2" ./output/$version/
  #           docker rm "$container_id"
  #         done

  #     - name: Validate that archives exist for each version
  #       run: |
  #         IFS=' ' read -r -a versions <<< "$VERSIONS"
  #         for version in "${versions[@]}"; do
  #           path="./output/$version/debian-$version.tar.bz2"
  #           if [[ ! -f "$path" ]]; then
  #             echo "[ERROR] Missing archive: $path"
  #             exit 1
  #           else
  #             echo "[OK] Found: $path"
  #           fi
  #         done

  #     - name: Clone upload repo
  #       run: |
  #         GIT_CREDENTIAL="${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}"
  #         git clone --depth=1 "https://${{ env.GIT_USERNAME }}:${GIT_CREDENTIAL}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo

  #     - name: Clean old archives in upload-repo
  #       run: rm -rfv upload-repo/*/*.tar.bz2

  #     - name: Copy new archives to upload-repo
  #       run: |
  #         for filepath in ./output/*/debian-*.tar.bz2; do
  #           version_dir=$(basename "$(dirname "$filepath")")
  #           mkdir -p "upload-repo/$version_dir"
  #           cp "$filepath" "upload-repo/$version_dir/"
  #         done

  #     - name: Calculate and store sha256sums in upload-repo
  #       run: |
  #         cd upload-repo
  #         rm -f sha256sums.txt
  #         for tarball in */debian-*.tar.bz2; do
  #           echo "[INFO] Processing: $tarball"
  #           checksum=$(sha256sum "$tarball" | awk '{print $1}')
  #           echo "$checksum  $tarball" >> sha256sums.txt
  #         done
  #         echo "[INFO] SHA256 contents:"
  #         cat sha256sums.txt

  #     - name: Commit and push files if changed
  #       id: commit_archives
  #       run: |
  #         cd upload-repo
  #         git config --global user.name "${{ env.GIT_USERNAME }}"
  #         git config --global user.email "${{ env.GIT_EMAIL }}"

  #         if git status --porcelain | grep .; then
  #           git add **/*.tar.bz2 sha256sums.txt || true
  #           git commit -m "Update base images and checksum on $(date -u +'%Y-%m-%dT%H:%M:%SZ') [skip ci]"
  #           git push
  #           echo "archives_changed=true" >> $GITHUB_OUTPUT
  #         else
  #           echo "[INFO] No changes to commit."
  #           echo "archives_changed=false" >> $GITHUB_OUTPUT
  #         fi

  build-rootfs:
    name: Build rootfs (${{ matrix.version }})
    runs-on: vm-docker-build2

    strategy:
      fail-fast: false
      matrix:
        version: [bullseye, bookworm, trixie]

    steps:
      - uses: actions/checkout@v3

      - name: Create output directory
        run: mkdir -p ${{ env.OUTPUT_DIR }}/${{ matrix.version }}

      - name: Build rootfs Docker image
        run: |
          VERSION=${{ matrix.version }}
          docker build \
            --build-arg VERSION="$VERSION" \
            -t rootfs-$VERSION .

      - name: Run rootfs bootstrap
        run: |
          VERSION=${{ matrix.version }}
          OUTPUT_DIR=${{ env.OUTPUT_DIR }}/$VERSION

          docker run --rm \
            -v "$PWD/$OUTPUT_DIR:/output" \
            rootfs-$VERSION \
            bash -c "/scripts/bootstrap-rootfs.sh $VERSION /output"

          # Verify tarball exists
          TAR="$OUTPUT_DIR/debian-$VERSION.tar.bz2"
          if [[ ! -f "$TAR" ]]; then
            echo "[ERROR] Rootfs tarball missing: $TAR"
            exit 1
          else
            echo "[OK] Created $TAR"
          fi

      - name: Clone upload repo
        run: |
          git clone --depth=1 \
            https://${GIT_USERNAME}:${GIT_TOKEN}@gitea.fithwum.tech/fithwum/debian-base.git upload

      - name: Update archive + sha256
        run: |
          VERSION=${{ matrix.version }}
          OUTPUT_DIR=${{ env.OUTPUT_DIR }}/$VERSION

          mkdir -p upload/$VERSION
          cp "$OUTPUT_DIR/debian-$VERSION.tar.bz2" upload/$VERSION/

          cd upload
          # Remove old checksum for this version
          sed -i "/debian-$VERSION.tar.bz2/d" sha256sums.txt 2>/dev/null || true
          # Add new checksum
          sha256sum "$VERSION/debian-$VERSION.tar.bz2" >> sha256sums.txt

      - name: Commit if changed
        run: |
          VERSION=${{ matrix.version }}

          cd upload
          git config user.name "$GIT_USERNAME"
          git config user.email "$GIT_EMAIL"

          if git status --porcelain | grep .; then
            git add "$VERSION/debian-$VERSION.tar.bz2" sha256sums.txt
            git commit -m "Update rootfs for $VERSION [skip ci]"
            git push
          else
            echo "[INFO] No changes for $VERSION"

  # build-and-push-docker-images:
  #   needs: build-and-push-rootfs-archives
  #   if: always()
  #   # if: needs.build-and-push-rootfs-archives.outputs.archives_changed == 'true'
  #   runs-on: vm-docker-build2
  #   steps:
  #     - name: Checkout source
  #       uses: actions/checkout@v3

  #     - name: Wait for archives to appear in upload repo
  #       run: |
  #         echo "[INFO] Waiting for archives to appear in upload-repo..."

  #         mkdir -p temp-check
  #         cd temp-check

  #         # Retry loop for cloning the upload-repo
  #         for i in {1..10}; do
  #           echo "[INFO] Attempt $i: Cloning upload-repo..."
  #           if git clone --depth=1 "https://${{ secrets.GIT_USERNAME }}:${{ secrets.GIT_TOKEN }}@gitea.fithwum.tech/fithwum/debian-base.git"; then
  #             break
  #           fi
  #           echo "[WARN] Clone failed. Retrying in 10 seconds..."
  #           sleep 10
  #         done

  #         if [ ! -d "debian-base" ]; then
  #           echo "[ERROR] Failed to clone upload-repo after retries."
  #           exit 1
  #         fi

  #         cd debian-base

  #         # Wait for all versions to show up
  #         missing_versions=()
  #         for version in $VERSIONS; do
  #           found=0
  #           for i in {1..30}; do
  #             if [[ -f "$version/debian-$version.tar.bz2" ]]; then
  #               found=1
  #               break
  #             else
  #               echo "[WAIT] $version not ready yet, sleeping 10s..."
  #               sleep 10
  #             fi
  #           done

  #           if [[ $found -eq 0 ]]; then
  #             missing_versions+=("$version")
  #           fi
  #         done

  #         if [[ ${#missing_versions[@]} -gt 0 ]]; then
  #           echo "[ERROR] Missing archives for: ${missing_versions[*]}"
  #           exit 1
  #         fi

  #     - name: Generate Dockerfiles per version (if missing)
  #       run: |
  #         for version in $VERSIONS; do
  #           mkdir -p "$version"
  #           DOCKERFILE_PATH="$version/Dockerfile"

  #           if [[ -f "$DOCKERFILE_PATH" ]]; then
  #             echo "[INFO] Skipping $DOCKERFILE_PATH (already exists)"
  #             continue
  #           fi

  #           printf '%s\n' \
  #             "FROM scratch" \
  #             "LABEL maintainer=\"fithwum\"" \
  #             "ADD debian-$version.tar.bz2 /" \
  #             "CMD [\"/bin/bash\"]" > "$DOCKERFILE_PATH"

  #           echo "[INFO] Created $DOCKERFILE_PATH"
  #         done

  #     - name: Set up Docker Buildx
  #       uses: docker/setup-buildx-action@v3

  #     - name: Log in to Gitea Registry
  #       run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login gitea.fithwum.tech -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin

  #     - name: Build and push Docker images
  #       run: |
  #         IMAGE_REGISTRY=gitea.fithwum.tech
  #         IMAGE_ORG=fithwum
  #         IMAGE_REPO=debian-base

  #         for TAG in $VERSIONS; do
  #           FULL_IMAGE="${IMAGE_REGISTRY}/${IMAGE_ORG}/${IMAGE_REPO}:${TAG}"
  #           echo "[INFO] Building and pushing $FULL_IMAGE"
  #           docker buildx build --platform linux/amd64 --push -t "$FULL_IMAGE" "./$TAG"
  #         done

  build-and-push-docker-images:
    name: Build & Push Docker Images (${{ matrix.version }})
    needs: build-and-push-rootfs-archives
    runs-on: vm-docker-build2
    strategy:
      fail-fast: false
      matrix:
        version: [bullseye, bookworm, trixie]

    steps:
      - name: Checkout source
        uses: actions/checkout@v3

      - name: Prepare Docker context
        run: |
          VERSION=${{ matrix.version }}
          CONTEXT_DIR="$VERSION"
          mkdir -p "$CONTEXT_DIR"
          echo "[INFO] Copying rootfs tarball into Docker context..."
          cp "./output/debian-$VERSION.tar.bz2" "$CONTEXT_DIR/"

      - name: Generate Dockerfile
        run: |
          VERSION=${{ matrix.version }}
          DOCKERFILE="$VERSION/Dockerfile"
          if [[ ! -f "$DOCKERFILE" ]]; then
            printf '%s\n' \
              "FROM scratch" \
              "LABEL maintainer=\"fithwum\"" \
              "ADD debian-$VERSION.tar.bz2 /" \
              "CMD [\"/bin/bash\"]" > "$DOCKERFILE"
            echo "[INFO] Created Dockerfile for $VERSION"
          else
            echo "[INFO] Dockerfile exists for $VERSION"
          fi

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Gitea Registry
        run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login gitea.fithwum.tech -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin

      - name: Build & Push Docker Image
        run: |
          VERSION=${{ matrix.version }}
          IMAGE_REGISTRY=gitea.fithwum.tech
          IMAGE_ORG=fithwum
          IMAGE_REPO=debian-base
          FULL_IMAGE="$IMAGE_REGISTRY/$IMAGE_ORG/$IMAGE_REPO:$VERSION"

          # Skip build if image already exists with same digest
          if docker pull "$FULL_IMAGE" >/dev/null 2>&1; then
            EXISTING_DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' "$FULL_IMAGE")
            NEW_DIGEST=$(sha256sum "./$VERSION/debian-$VERSION.tar.bz2" | awk '{print $1}')
            if [[ "$EXISTING_DIGEST" == *"$NEW_DIGEST"* ]]; then
              echo "[INFO] Docker image for $VERSION is up-to-date, skipping build."
              exit 0
            fi
          fi

          echo "[INFO] Building and pushing Docker image: $FULL_IMAGE"
          docker buildx build --platform linux/amd64 --push -t "$FULL_IMAGE" "./$VERSION"

  generate-changelogs:
    needs: build-and-push-rootfs-archives
    runs-on: vm-docker-build2
    steps:
      - name: Checkout source
        uses: actions/checkout@v3

      - name: Create temporary changelog workspace
        run: mkdir changelogs

      - name: Clone upload repo
        run: |
          GIT_CREDENTIAL="${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}"
          git clone --depth=3 "https://${{ env.GIT_USERNAME }}:${GIT_CREDENTIAL}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo

      - name: Generate changelogs from git log
        run: |
          for version in $VERSIONS; do
            echo "[INFO] Generating changelog for $version"
            changelog="changelogs/$version/CHANGES.md"
            mkdir -p "$(dirname "$changelog")"

            echo -e "## $(date -u +'%Y-%m-%dT%H:%M:%SZ')\n" >> "$changelog"
            git log -n 3 --pretty=format:"- %h %ad %s (%an)" --date=short >> "$changelog"
          done

      - name: Copy generated changelogs into repo
        run: |
          for version in $VERSIONS; do
            mkdir -p "upload-repo/$version"
            cp "changelogs/$version/CHANGES.md" "upload-repo/$version/CHANGES.md"
          done

      - name: Commit and push changelogs if changed
        run: |
          cd upload-repo
          git config user.name "${{ env.GIT_USERNAME }}"
          git config user.email "${{ env.GIT_EMAIL }}"

          if git status --porcelain | grep .; then
            git add */CHANGES.md
            git commit -m "Update changelogs on $(date -u +'%Y-%m-%dT%H:%M:%SZ')" --no-verify
            git push
          else
            echo "[INFO] No changelog changes to commit."
          fi

  generate-build-info:
    needs: build-and-push-docker-images
    runs-on: vm-docker-build2
    steps:
    - name: Checkout source
      uses: actions/checkout@v3

    - name: Prepare temporary build-info workspace
      run: mkdir -p buildinfo

    - name: Clone upload repo
      run: |
        GIT_CREDENTIAL="${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}"
        git clone --depth=1 "https://${{ env.GIT_USERNAME }}:${GIT_CREDENTIAL}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo

    - name: Copy sha256sums.txt
      run: |
        if [[ -f upload-repo/sha256sums.txt ]]; then
          cp upload-repo/sha256sums.txt buildinfo/
        else
          echo "[ERROR] sha256sums.txt missing in upload-repo!"
          exit 1
        fi

    - name: Generate build-info.json files
      run: |
        human_size() {
          local b=$1
          local d=''
          local s=0
          local S=(B KB MB GB TB)
          while ((b >= 1024 && s < ${#S[@]}-1)); do
            d=$((b % 1024))
            b=$((b / 1024))
            s=$((s + 1))
          done
          printf "%s%s\n" "$b" "${S[$s]}"
        }

        cd buildinfo
        for version in $VERSIONS; do
          echo "[INFO] Generating build-info.json for $version"
          mkdir -p "$version"
          infofile="$version/build-info.json"

          image="gitea.fithwum.tech/fithwum/debian-base:$version"
          
          # Pull image before inspecting to ensure metadata is available
          if ! docker pull "$image"; then
            echo "[WARN] Failed to pull $image — setting fields to 'unknown/0'"
            digest="unknown"
            size_bytes=0
          else
            digest=$(docker inspect --format='{{if .RepoDigests}}{{index .RepoDigests 0}}{{else}}unknown{{end}}' "$image" 2>/dev/null || echo "unknown")
            size_bytes=$(docker image inspect "$image" --format='{{.Size}}' 2>/dev/null || echo "0")
            size_bytes=${size_bytes//[^0-9]/}
            if [[ -z "$size_bytes" ]]; then size_bytes=0; fi
          fi

          size_human=$(human_size "$size_bytes")

          # Load SHA256 from file if available
          TARBALL_NAME="debian-$version.tar.bz2"
          SHA256_LINE=$(grep -F "$TARBALL_NAME" sha256sums.txt || true)
          if [[ -z "$SHA256_LINE" ]]; then
            echo "[WARN] SHA256 for $TARBALL_NAME not found!"
            SHA256="unknown"
          else
            SHA256=$(echo "$SHA256_LINE" | awk '{print $1}')
            echo "[INFO] SHA256 for $TARBALL_NAME: $SHA256"
          fi

          jq -n \
            --arg version "$version" \
            --arg commit "$(git rev-parse HEAD)" \
            --arg build_time "$(date -u +'%Y-%m-%dT%H:%M:%SZ')" \
            --arg image_tag "$image" \
            --arg digest "$digest" \
            --arg image_size "$size_human" \
            --argjson image_size_bytes "$size_bytes" \
            --arg sha256 "$SHA256" \
            '{
              version: $version,
              commit: $commit,
              build_time: $build_time,
              image_tag: $image_tag,
              digest: $digest,
              image_size: $image_size,
              image_size_bytes: $image_size_bytes,
              rootfs_sha256: $sha256
            }' > "$infofile"
        done

    - name: Clone upload repo
      run: |
        rm -rf upload-repo
        GIT_CREDENTIAL="${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}"
        git clone --depth=1 "https://${{ env.GIT_USERNAME }}:${GIT_CREDENTIAL}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo

    - name: Copy build-info.json into repo
      run: |
        for version in $VERSIONS; do
          mkdir -p "upload-repo/$version"
          cp "buildinfo/$version/build-info.json" "upload-repo/$version/build-info.json"
        done

    - name: Commit and push build-info if changed
      run: |
        cd upload-repo
        git config --global user.name "${{ env.GIT_USERNAME }}"
        git config --global user.email "${{ env.GIT_EMAIL }}"

        if git status --porcelain | grep .; then
          git add */build-info.json
          git commit -m "Update build-info on $(date -u +'%Y-%m-%dT%H:%M:%SZ')"
          git push

          for version in $VERSIONS; do
            TAG="build-$version"
            git tag -d "$TAG" 2>/dev/null || true
            git tag "$TAG"
            git push origin "$TAG" --force
          done
        else
          echo "[INFO] No build-info changes to commit."
        fi