debian-base/.gitea/workflows/base-build.yml

name: Build, Upload RootFS, and Push Docker Images, update changelog, update build info.

on:
  push:
    branches:
      - main
    paths:
      - '.gitea/workflows/*.yml'
      - 'base-image-script/*.sh'
      - '!**/debian-*.tar.bz2'
      - '!/sha256sums.txt'
      - '!**/CHANGES.md'
      - '!**/build-info.json'
  schedule:
    - cron: '0 12 * * 0'  # Sunday at noon UTC

env:
  REPO_URL: ${{ secrets.REPO_URL }}
  GIT_USERNAME: ${{ secrets.GIT_USERNAME }}
  GIT_EMAIL: ${{ secrets.GIT_EMAIL }}
  GIT_PASSWORD: ${{ secrets.GIT_PASSWORD }}
  GIT_TOKEN: ${{ secrets.GIT_TOKEN }}
  GIT_CREDENTIAL: ${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}
  DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
  DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
  VERSIONS: "bullseye bookworm trixie"
  OUTPUT_DIR: ./output

jobs:
  docker-prune:
    name: Docker prune (${{ matrix.runner }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        runner:
          - vm-docker-build2
          - vm-docker-build2
    steps:
      - name: Prune unused Docker images
        run: |
          echo "[INFO] Pruning Docker images on ${{ matrix.runner }}..."
          docker image prune -a -f || true

  build-and-push-rootfs-archives:
    name: Build RootFS Archives (${{ matrix.version }})
    runs-on: vm-docker-build2
    needs: docker-prune
    strategy:
      fail-fast: false
      matrix:
        version: [bullseye, bookworm, trixie]
    steps:
      - name: Checkout source
        uses: actions/checkout@v3

      - name: Create output directory for version
        run: mkdir -p ./output/${{ matrix.version }}

      - name: Build rootfs Docker image
        run: |
          VERSION=${{ matrix.version }}
          docker build --build-arg VERSION="$VERSION" -t rootfs-$VERSION .

      - name: Run rootfs bootstrap in Docker volume
        run: |
          VERSION=${{ matrix.version }}
          OUTPUT_DIR=./output/$VERSION
          VOLUME_NAME="rootfs_output_$VERSION"

          # Create Docker volume
          docker volume create "$VOLUME_NAME"

          # Run bootstrap inside volume
          docker run --rm --privileged \
            -v "$VOLUME_NAME:/output" \
            -e VERSION="$VERSION" \
            rootfs-$VERSION \
            bash -c "/scripts/bootstrap-rootfs.sh $VERSION /output"

          # Extract tarball from Docker volume
          CONTAINER_ID=$(docker create -v "$VOLUME_NAME:/output" debian:bookworm)
          mkdir -p "$OUTPUT_DIR"
          docker cp "$CONTAINER_ID:/output/debian-$VERSION.tar.bz2" "$OUTPUT_DIR/"
          docker rm "$CONTAINER_ID"
          docker volume rm "$VOLUME_NAME"

          # Verify tarball exists
          TAR="$OUTPUT_DIR/debian-$VERSION.tar.bz2"
          if [[ ! -f "$TAR" ]]; then
            echo "[ERROR] Rootfs tarball missing: $TAR"
            ls -lh "$OUTPUT_DIR"
            exit 1
          else
            echo "[OK] Created $TAR"
          fi

      - name: Clone upload repo
        run: |
          GIT_CREDENTIAL="${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}"
          git clone --depth=1 "https://${{ env.GIT_USERNAME }}:${GIT_CREDENTIAL}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo

      - name: Copy new archive into upload repo
        run: |
          VERSION=${{ matrix.version }}
          mkdir -p "upload-repo/$VERSION"
          cp "./output/$VERSION/debian-$VERSION.tar.bz2" "upload-repo/$VERSION/"

      - name: Update sha256sums (per-version)
        run: |
          cd upload-repo
          VERSION=${{ matrix.version }}
          TAR="../output/$VERSION/debian-$VERSION.tar.bz2"
          SHA_FILE="$VERSION/sha256sums.txt"

          mkdir -p "$VERSION"

          if [[ ! -f "$TAR" ]]; then
            echo "[ERROR] Tarball not found at $TAR"
            ls -lh "../output/$VERSION/"
            exit 1
          fi

          # Calculate SHA256 and store in per-version file
          sha256sum "$TAR" > "$SHA_FILE"
          echo "[INFO] SHA256 for $VERSION stored in $SHA_FILE"

      - name: Commit and push if changed (matrix-safe)
        id: commit_archives
        run: |
          cd upload-repo
          git config user.name "${{ env.GIT_USERNAME }}"
          git config user.email "${{ env.GIT_EMAIL }}"

          VERSION=${{ matrix.version }}
          TEMP_BRANCH="tmp-update-$VERSION-$(date -u +%s)"

          # Create temporary branch
          git checkout -b "$TEMP_BRANCH"

          # Stage only this version's files
          git add "$VERSION/debian-$VERSION.tar.bz2" "$VERSION/sha256sums.txt"

          # Check if anything changed
          if git diff --cached --quiet; then
            echo "[INFO] No changes to commit for $VERSION"
            echo "archives_changed=false" >> $GITEA_OUTPUT
            exit 0
          fi

          git commit -m "Update base image and checksum for $VERSION on $(date -u +'%Y-%m-%dT%H:%M:%SZ') [skip ci]"

          # Push temp branch to remote
          git push origin "$TEMP_BRANCH"

          # Switch back to main and rebase onto remote main
          git checkout main
          git fetch origin main
          git rebase origin/main

          # Merge temp branch
          git merge --no-ff --no-edit "$TEMP_BRANCH"

          # Push main safely
          git push origin main

          # Delete temporary branch
          git push origin --delete "$TEMP_BRANCH" || true
          echo "archives_changed=true" >> $GITEA_OUTPUT

  build-and-push-docker-images:
    name: Build & Push Docker Images (${{ matrix.version }})
    needs:
      - docker-prune
      - build-and-push-rootfs-archives
    if: ${{ needs.build-and-push-rootfs-archives.result == 'success' }}
    runs-on: vm-docker-build2
    strategy:
      fail-fast: false
      matrix:
        version: [bullseye, bookworm, trixie]

    steps:
      - name: Checkout source
        uses: actions/checkout@v3

      - name: Fetch rootfs tarball from upload repo
        run: |
          VERSION=${{ matrix.version }}
          git clone --depth=1 "https://${{ env.GIT_USERNAME }}:${{ secrets.GIT_TOKEN }}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo
          mkdir -p "./output/$VERSION"
          if [[ ! -f "upload-repo/$VERSION/debian-$VERSION.tar.bz2" ]]; then
            echo "[ERROR] Rootfs tarball not found in upload-repo for $VERSION"
            exit 1
          fi
          cp "upload-repo/$VERSION/debian-$VERSION.tar.bz2" "./output/$VERSION/"

      - name: Prepare Docker context
        run: |
          VERSION=${{ matrix.version }}
          CONTEXT_DIR="$VERSION"
          mkdir -p "$CONTEXT_DIR"
          cp "./output/$VERSION/debian-$VERSION.tar.bz2" "$CONTEXT_DIR/"

      - name: Generate Dockerfile
        run: |
          VERSION=${{ matrix.version }}
          DOCKERFILE="$VERSION/Dockerfile"
          if [[ ! -f "$DOCKERFILE" ]]; then
            printf '%s\n' \
              "FROM scratch" \
              "LABEL maintainer=\"fithwum\"" \
              "ADD debian-$VERSION.tar.bz2 /" \
              "CMD [\"/bin/bash\"]" > "$DOCKERFILE"
            echo "[INFO] Created Dockerfile for $VERSION"
          else
            echo "[INFO] Dockerfile exists for $VERSION"
          fi

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Gitea Registry
        run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login gitea.fithwum.tech -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin

      - name: Build & Push Docker Image
        run: |
          VERSION=${{ matrix.version }}
          IMAGE_REGISTRY=gitea.fithwum.tech
          IMAGE_ORG=fithwum
          IMAGE_REPO=debian-base
          FULL_IMAGE="$IMAGE_REGISTRY/$IMAGE_ORG/$IMAGE_REPO:$VERSION"

          TAR="./output/$VERSION/debian-$VERSION.tar.bz2"
          if [[ ! -f "$TAR" ]]; then
            echo "[ERROR] Rootfs tarball missing: $TAR"
            exit 1
          fi

          echo "[INFO] Building and pushing Docker image: $FULL_IMAGE"
          docker buildx build --platform linux/amd64 --push -t "$FULL_IMAGE" "./$VERSION"

  generate-changelogs:
    needs: build-and-push-docker-images
    runs-on: vm-docker-build2
    steps:
      - name: Checkout source
        uses: actions/checkout@v3

      - name: Create temporary changelog workspace
        run: mkdir changelogs

      - name: Clone upload repo
        run: |
          GIT_CREDENTIAL="${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}"
          git clone --depth=3 "https://${{ env.GIT_USERNAME }}:${GIT_CREDENTIAL}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo

      - name: Generate changelogs from git log
        run: |
          for version in $VERSIONS; do
            echo "[INFO] Generating changelog for $version"
            changelog="changelogs/$version/CHANGES.md"
            mkdir -p "$(dirname "$changelog")"

            echo -e "## $(date -u +'%Y-%m-%dT%H:%M:%SZ')\n" >> "$changelog"
            git log -n 3 --pretty=format:"- %h %ad %s (%an)" --date=short >> "$changelog"
          done

      - name: Copy generated changelogs into repo
        run: |
          for version in $VERSIONS; do
            mkdir -p "upload-repo/$version"
            cp "changelogs/$version/CHANGES.md" "upload-repo/$version/CHANGES.md"
          done

      - name: Commit and push changelogs if changed
        run: |
          cd upload-repo
          git config user.name "${{ env.GIT_USERNAME }}"
          git config user.email "${{ env.GIT_EMAIL }}"

          if git status --porcelain | grep .; then
            git add */CHANGES.md
            git commit -m "Update changelogs on $(date -u +'%Y-%m-%dT%H:%M:%SZ')" --no-verify
            git push
          else
            echo "[INFO] No changelog changes to commit."
          fi

  generate-build-info:
    needs: generate-changelogs
    runs-on: vm-docker-build2
    steps:
    - name: Checkout source
      uses: actions/checkout@v3

    - name: Prepare temporary build-info workspace
      run: mkdir -p buildinfo

    - name: Clone upload repo
      run: |
        GIT_CREDENTIAL="${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}"
        git clone --depth=1 "https://${{ env.GIT_USERNAME }}:${GIT_CREDENTIAL}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo

    - name: Generate build-info.json files
      run: |
        human_size() {
          local b=$1
          local d=''
          local s=0
          local S=(B KB MB GB TB)
          while ((b >= 1024 && s < ${#S[@]}-1)); do
            d=$((b % 1024))
            b=$((b / 1024))
            s=$((s + 1))
          done
          printf "%s%s\n" "$b" "${S[$s]}"
        }

        cd buildinfo
        for version in $VERSIONS; do
          echo "[INFO] Generating build-info.json for $version"
          mkdir -p "$version"
          infofile="$version/build-info.json"

          image="gitea.fithwum.tech/fithwum/debian-base:$version"
          
          # Pull image before inspecting to ensure metadata is available
          if ! docker pull "$image"; then
            echo "[WARN] Failed to pull $image — setting fields to 'unknown/0'"
            digest="unknown"
            size_bytes=0
          else
            digest=$(docker inspect --format='{{if .RepoDigests}}{{index .RepoDigests 0}}{{else}}unknown{{end}}' "$image" 2>/dev/null || echo "unknown")
            size_bytes=$(docker image inspect "$image" --format='{{.Size}}' 2>/dev/null || echo "0")
            size_bytes=${size_bytes//[^0-9]/}
            if [[ -z "$size_bytes" ]]; then size_bytes=0; fi
          fi

          size_human=$(human_size "$size_bytes")

          # Load SHA256 from file if available
          TARBALL_NAME="debian-$version.tar.bz2"
          TARBALL_PATH="../upload-repo/$version/$TARBALL_NAME"
          SHA_FILE="../upload-repo/$version/sha256sums.txt"

          SHA256="unknown"

          if [[ -f "$TARBALL_PATH" ]]; then
            echo "[INFO] Found tarball for $version: $TARBALL_NAME"

            if [[ ! -f "$SHA_FILE" ]]; then
              echo "[ERROR] sha256sums.txt missing for $version but tarball exists"
              exit 1
            fi

            SHA256_LINE=$(grep -F "$TARBALL_NAME" "$SHA_FILE" || true)

            if [[ -z "$SHA256_LINE" ]]; then
              echo "[ERROR] SHA256 entry missing for $TARBALL_NAME in $SHA_FILE"
              exit 1
            fi

            SHA256=$(echo "$SHA256_LINE" | awk '{print $1}')
            echo "[INFO] SHA256 for $TARBALL_NAME: $SHA256"
          else
            echo "[INFO] No tarball for $version — skipping SHA256 enforcement"
          fi

          jq -n \
            --arg version "$version" \
            --arg commit "$(git rev-parse HEAD)" \
            --arg build_time "$(date -u +'%Y-%m-%dT%H:%M:%SZ')" \
            --arg image_tag "$image" \
            --arg digest "$digest" \
            --arg image_size "$size_human" \
            --argjson image_size_bytes "$size_bytes" \
            --arg sha256 "$SHA256" \
            '{
              version: $version,
              commit: $commit,
              build_time: $build_time,
              image_tag: $image_tag,
              digest: $digest,
              image_size: $image_size,
              image_size_bytes: $image_size_bytes,
              rootfs_sha256: $sha256
            }' > "$infofile"
        done

    - name: Clone upload repo
      run: |
        rm -rf upload-repo
        GIT_CREDENTIAL="${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}"
        git clone --depth=1 "https://${{ env.GIT_USERNAME }}:${GIT_CREDENTIAL}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo

    - name: Copy build-info.json into repo
      run: |
        for version in $VERSIONS; do
          mkdir -p "upload-repo/$version"
          cp "buildinfo/$version/build-info.json" "upload-repo/$version/build-info.json"
        done

    - name: Commit and push build-info if changed
      run: |
        cd upload-repo
        git config --global user.name "${{ env.GIT_USERNAME }}"
        git config --global user.email "${{ env.GIT_EMAIL }}"

        if git status --porcelain | grep .; then
          git add */build-info.json
          git commit -m "Update build-info on $(date -u +'%Y-%m-%dT%H:%M:%SZ')"
          git push

          for version in $VERSIONS; do
            TAG="build-$version"
            git tag -d "$TAG" 2>/dev/null || true
            git tag "$TAG"
            git push origin "$TAG" --force
          done
        else
          echo "[INFO] No build-info changes to commit."
        fi