Axis_Cam_Tailscale/.github/workflows/build.yml

---
# Upstream release -> build -> DRAFT release holding unsigned .eap files.
# Signing is manual (Axis has no signing API); ../acap-sign.sh uploads the
# signed packages and publishes the release. The acap-ops repo notifies.
name: Build

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: "0 3 * * *"
  workflow_dispatch:
    inputs:
      version:
        description: "Version to build. Empty resolves from upstream."
        required: false
      force:
        description: "Rebuild and re-cut the draft even if unchanged."
        type: boolean
        default: false

permissions:
  contents: write

concurrency:
  group: acap-release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  check:
    runs-on: ubuntu-latest
    outputs:
      build: ${{ steps.decide.outputs.build }}
      release: ${{ steps.decide.outputs.release }}
      version: ${{ steps.decide.outputs.version }}
      upstream: ${{ steps.decide.outputs.upstream }}
    steps:
      - uses: actions/checkout@v7
      - id: decide
        env:
          GH_TOKEN: ${{ github.token }}
          INPUT_VERSION: ${{ github.event.inputs.version }}
          INPUT_FORCE: ${{ github.event.inputs.force }}
          EVENT_NAME: ${{ github.event_name }}
        run: ./ci/resolve-version.sh

  build:
    needs: check
    if: needs.check.outputs.build == 'true'
    runs-on: ubuntu-latest
    env:
      VERSION: ${{ needs.check.outputs.version }}
      UPSTREAM_VERSION: ${{ needs.check.outputs.upstream }}
    steps:
      - uses: actions/checkout@v7

      - name: Apply version and upstream pins
        run: ./ci/apply-version.sh "$VERSION" "$UPSTREAM_VERSION"

      # Repos without a tests/run.sh simply skip this.
      - name: Run unit tests
        run: |
          set -euo pipefail
          if [ -x tests/run.sh ] || [ -f tests/run.sh ]; then
            sudo apt-get update
            sudo apt-get install -y --no-install-recommends pkg-config libglib2.0-dev
            sh tests/run.sh
          else
            echo "no tests/run.sh, skipping"
          fi

      - name: Build packages
        run: ./ci/build-packages.sh

      - name: Verify packages
        run: |
          set -euo pipefail
          shopt -s nullglob
          packages=(releases/*.eap)
          if [ ${#packages[@]} -eq 0 ]; then
            echo "no .eap produced" >&2
            exit 1
          fi
          for package in "${packages[@]}"; do
            echo "== $package"
            tar tzf "$package" >/dev/null
          done

      - uses: actions/upload-artifact@v7
        with:
          name: packages
          path: releases/*.eap
          if-no-files-found: error

      # Unstripped binaries for symbolising a crash from a shipped (stripped)
      # package. Not a release asset: they are only useful while debugging.
      - uses: actions/upload-artifact@v7
        with:
          name: debug-symbols
          path: debug/
          if-no-files-found: ignore

      # Only after a successful build, so a failed upstream jump leaves main clean.
      - name: Commit version bump
        if: needs.check.outputs.release == 'true' && github.event_name != 'pull_request'
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          # Packages are already uploaded as an artifact; removing them here
          # keeps build output out of the commit regardless of .gitignore.
          rm -rf releases
          git add -A
          if git diff --cached --quiet; then
            echo "nothing to commit"
            exit 0
          fi
          git commit -m "Update to $VERSION"
          # The remote can move while a long build runs, so rebase and retry.
          for attempt in 1 2 3; do
            if git push; then
              exit 0
            fi
            echo "push rejected, rebasing (attempt $attempt)"
            git pull --rebase --autostash origin main
          done
          echo "could not push the version bump" >&2
          exit 1

  release:
    needs: [check, build]
    if: needs.check.outputs.release == 'true' && github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    env:
      VERSION: ${{ needs.check.outputs.version }}
      GH_TOKEN: ${{ github.token }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: main
          fetch-depth: 0

      - uses: actions/download-artifact@v8
        with:
          name: packages
          path: releases

      # Stays a DRAFT: unsigned packages must never reach users, and an
      # already-published release must never be overwritten with unsigned ones.
      - name: Create or refresh draft release
        run: |
          set -euo pipefail
          tag="v$VERSION"
          ./ci/release-notes.sh "$VERSION" "${{ needs.check.outputs.upstream }}" > /tmp/notes.md
          cat /tmp/notes.md
          if gh release view "$tag" --json isDraft --jq '.isDraft' 2>/dev/null | grep -qx true; then
            gh release upload "$tag" releases/*.eap --clobber
            gh release edit "$tag" --notes-file /tmp/notes.md
          elif gh release view "$tag" >/dev/null 2>&1; then
            echo "release $tag is already published; refusing to touch it" >&2
            exit 1
          else
            gh release create "$tag" releases/*.eap \
              --draft \
              --title "Tailscale VPN $VERSION" \
              --notes-file /tmp/notes.md
          fi