name: Build, Upload RootFS, and Push Docker Images, update changelog, update build info.

on:
  push:
    branches:
      - main
    paths-ignore:
      - '**/CHANGES.md'
      - '**/build-info.json'
      - '/sha256sums.txt'
  schedule:
    - cron: '0 12 * * 0'  # Sunday at noon UTC

env:
  REPO_URL: ${{ secrets.REPO_URL }}
  GIT_USERNAME: ${{ secrets.GIT_USERNAME }}
  GIT_EMAIL: ${{ secrets.GIT_EMAIL }}
  DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
  DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
  VERSIONS: "buster bullseye bookworm docker-build"

jobs:
  build-rootfs-archives:
    runs-on: docker-build
    steps:
      - name: Checkout source
        uses: actions/checkout@v3
      
      - name: Clean workspace tarballs before build
        run: |
          echo "[INFO] Cleaning old tarballs..."
          rm -f ./debian-*.tar.bz2
          rm -f ./rootfs-*.tar.bz2
          rm -f ./sha256sums.txt

      - name: Build all Debian rootfs versions sequentially
        run: |
          versions=($VERSIONS)

          for version in "${versions[@]}"; do
            echo "[INFO] Building $version..."
            docker build --build-arg VERSION=$version -t fithwum/debian-$version-base .

            docker run --rm --privileged \
              -v "$(pwd)":/output \
              fithwum/debian-$version-base \
              bash -euxc "
                DEBIAN_RELEASE='$version'
                ROOTFS_DIR='debian-${version}'

                echo '[INFO] Bootstrapping Debian $DEBIAN_RELEASE rootfs...'
                apt-get update
                apt-get install -y --no-install-recommends debootstrap bzip2

                debootstrap --verbose --variant=minbase --components=main,contrib,non-free --include=apt,ca-certificates --arch=amd64 \"\$DEBIAN_RELEASE\" \"\$ROOTFS_DIR\" http://deb.debian.org/debian/

                for dir in dev dev/pts proc sys; do
                  mount --bind \"/\$dir\" \"\$ROOTFS_DIR/\$dir\"
                done

                echo '[CHROOT] Configuring Debian system...'
                chroot \"\$ROOTFS_DIR\" /bin/bash -c \"
                  echo 'APT::Get::Assume-Yes \\\"true\\\";' > /etc/apt/apt.conf.d/10-assume_yes
                  apt-get update
                  apt-get upgrade
                  apt-get install --no-install-recommends software-properties-common bash wget curl nano locales
                  echo 'en_US.UTF-8 UTF-8' >> /etc/locale.gen
                  locale-gen
                  update-locale LANG=en_US.UTF-8
                  apt-get remove --purge --allow-remove-essential pinentry-curses whiptail kmod iptables iproute2 dmidecode || true
                  apt-get clean
                  apt-get install -f
                  find /var/lib/apt/lists/ -type f -delete
                \"

                echo '[INFO] Unmounting system directories (ignore errors)...'
                for dir in sys proc dev/pts dev; do
                  umount -lf \"\$ROOTFS_DIR/\$dir\" 2>/dev/null || true
                done

                echo '[INFO] Creating compressed base image...'
                TARBALL=\"/output/debian-\$DEBIAN_RELEASE.tar.bz2\"
                tar -cjf \"\$TARBALL\" -C \"\$ROOTFS_DIR\" .
                echo '[INFO] Tarball ready for CI to upload: \$TARBALL'
              "
            done

      - name: List output archives
        run: |
          echo "[INFO] Looking for tarballs in workspace..."
          find . -name '*.tar.bz2' -exec ls -lh {} \;

      # - name: Debug workspace contents
      #   run: |
      #     echo "Current directory:"
      #     pwd
      #     echo "Contents:"
      #     ls -R

  push-archives-to-repo:
    needs: build-rootfs-archives
    runs-on: docker-build
    outputs:
      archives_changed: ${{ steps.commit_archives.outputs.archives_changed }}
    steps:
      - name: Checkout source
        uses: actions/checkout@v3

      - name: Clone upload repo
        run: |
          git clone "https://${{ env.GIT_USERNAME }}:${{ secrets.GIT_TOKEN || secrets.GIT_PASSWORD }}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo

      - name: Clean old archives in upload-repo
        run: rm -rf upload-repo/*/*.tar.bz2

      - name: Copy new archives to upload-repo
        run: |
          found=$(find . -name '*.tar.bz2')
          if [ -z "$found" ]; then
            echo "[WARNING] No .tar.bz2 archive found!"
            exit 1
          fi

          for filepath in $found; do
            version_dir=$(dirname "$filepath")
            mkdir -p upload-repo/"$version_dir"
            cp "$filepath" upload-repo/"$version_dir"/
          done

      - name: Calculate and store sha256sums in upload-repo
        run: |
          cd upload-repo
          echo "[INFO] Calculating sha256sums..."
          rm -f sha256sums.txt
          for tarball in */debian-*.tar.bz2; do
            echo "[INFO] Processing: $tarball"
            checksum=$(sha256sum "$tarball" | awk '{print $1}')
            echo "$checksum  $tarball" >> sha256sums.txt
          done

          echo "[INFO] SHA256 contents:"
          cat sha256sums.txt

      - name: Commit and push files if changed
        id: commit_archives
        run: |
          cd upload-repo
          git config --global user.name "${{ env.GIT_USERNAME }}"
          git config --global user.email "${{ env.GIT_EMAIL }}"

          if git status --porcelain | grep .; then
            git add **/*.tar.bz2 sha256sums.txt || true
            git commit -m "Update base images and checksum on $(date -u +'%Y-%m-%dT%H:%M:%SZ')"
            git push
            echo "archives_changed=true" >> $GITHUB_OUTPUT
          else
            echo "[INFO] No changes to commit."
            echo "archives_changed=false" >> $GITHUB_OUTPUT
          fi

  build-and-push-docker-images:
    needs: push-archives-to-repo
    if: needs.push-archives-to-repo.outputs.archives_changed == 'true'
    runs-on: docker-build
    steps:
      - name: Checkout source
        uses: actions/checkout@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Gitea Registry
        run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login gitea.fithwum.tech -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin

      - name: Build and push Docker images
        run: |
          IMAGE_REGISTRY=gitea.fithwum.tech
          IMAGE_ORG=fithwum
          IMAGE_REPO=debian-base

          for TAG in $VERSIONS; do
            FULL_IMAGE="${IMAGE_REGISTRY}/${IMAGE_ORG}/${IMAGE_REPO}:${TAG}"
            echo "[INFO] Building and pushing $FULL_IMAGE"
            docker buildx build --platform linux/amd64 --push -t "$FULL_IMAGE" "./$TAG"
          done

  generate-changelogs:
    needs: build-and-push-docker-images
    runs-on: docker-build
    steps:
      - name: Checkout source
        uses: actions/checkout@v3

      - name: Clone upload repo
        run: git clone https://${{ secrets.GIT_USERNAME }}:${{ secrets.GIT_TOKEN }}@gitea.fithwum.tech/fithwum/debian-base.git upload-repo

      - name: Generate per-version changelogs
        run: |
          cd upload-repo
          for version in $VERSIONS; do
            echo "[INFO] Updating changelog for $version"

            changelog="$version/CHANGES.md"
            mkdir -p "$(dirname "$changelog")"
            touch "$changelog"

            infofile="$version/build-info.json"
            last_commit=""
            if [ -f "$infofile" ]; then
              last_commit=$(jq -r '.commit' "$infofile")
            fi

            echo -e "\n## $(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> "$changelog"
            if [ -n "$last_commit" ]; then
              git log "${last_commit}..HEAD" --pretty=format:"- %s (%an)" | head -n 10 >> "$changelog"
            else
              git log -n 10 --pretty=format:"- %s (%an)" >> "$changelog"
            fi
          done

      - name: Commit and push changelogs if changed
        run: |
          cd upload-repo
          git config user.name "${{ secrets.GIT_USERNAME }}"
          git config user.email "${{ secrets.GIT_EMAIL }}"

          if git status --porcelain | grep .; then
            git add */CHANGES.md
            git commit -m "Update changelogs on $(date -u +'%Y-%m-%dT%H:%M:%SZ')" --no-verify
            git push
          else
            echo "[INFO] No changelog changes to commit."
          fi

  generate-build-info:
    needs: generate-changelogs
    runs-on: docker-build
    steps:
      - name: Checkout source
        uses: actions/checkout@v3

      - name: Clone upload repo
        run: |
          git clone "https://${{ secrets.GIT_USERNAME }}:${{ secrets.GIT_TOKEN }}@gitea.fithwum.tech/fithwum/debian-base.git" upload-repo

      - name: Copy checksum file into workspace
        run: cp ../sha256sums.txt upload-repo/

      - name: Generate build-info.json per version
        run: |
          human_size() {
            local b=$1
            local d=''
            local s=0
            local S=(B KB MB GB TB)
            while ((b >= 1024 && s < ${#S[@]}-1)); do
              d=$((b % 1024))
              b=$((b / 1024))
              s=$((s + 1))
            done
            printf "%s%s\n" "$b" "${S[$s]}"
          }

          cd upload-repo
          for version in $VERSIONS; do
            echo "[INFO] Generating build-info.json for $version"
            mkdir -p "$version"
            infofile="$version/build-info.json"

            image="gitea.fithwum.tech/fithwum/debian-base:$version"

            digest=$(docker inspect --format='{{if .RepoDigests}}{{index .RepoDigests 0}}{{else}}unknown{{end}}' "$image" 2>/dev/null || echo "unknown")
            size_bytes=$(docker image inspect "$image" --format='{{.Size}}' 2>/dev/null || echo "0")

            size_bytes=${size_bytes//[^0-9]/}
            if [[ -z "$size_bytes" ]]; then size_bytes=0; fi

            size_human=$(human_size "$size_bytes")
            
            # Load SHA256 from file if available
            SHA256=$(grep "/$version/rootfs-$version.tar.bz2" ../sha256sums.txt | awk '{print $1}')
            if [[ -z "$SHA256" ]]; then
              SHA256="unknown"
            fi

            jq -n \
              --arg version "$version" \
              --arg commit "$(git rev-parse HEAD)" \
              --arg build_time "$(date -u +'%Y-%m-%dT%H:%M:%SZ')" \
              --arg image_tag "$image" \
              --arg digest "$digest" \
              --arg image_size "$size_human" \
              --argjson image_size_bytes "$size_bytes" \
              --arg sha256 "$SHA256" \
              '{
                version: $version,
                commit: $commit,
                build_time: $build_time,
                image_tag: $image_tag,
                digest: $digest,
                image_size: $image_size,
                image_size_bytes: $image_size_bytes,
                rootfs_sha256: $sha256
              }' > "$infofile"


      - name: Commit and push build-info if changed
        run: |
          cd upload-repo
          git config --global user.name "${{ env.GIT_USERNAME }}"
          git config --global user.email "${{ env.GIT_EMAIL }}"

          if git status --porcelain | grep .; then
            git add */build-info.json
            git commit -m "Update build-info on $(date -u +'%Y-%m-%dT%H:%M:%SZ')"
            git push

            # Tag the commit for each version
            for version in $VERSIONS; do
              TAG="build-$version"
              # Delete local tag if exists
              git tag -d "$TAG" 2>/dev/null || true
              # Create tag on current HEAD
              git tag "$TAG"
              # Push tag to remote (force in case tag exists)
              git push origin "$TAG" --force
            done
          else
            echo "[INFO] No build-info changes to commit."
          fi