# Build Linux packages from the pre-built xrpld and validator-keys artifacts:
#
#   - one job per distro, taken from "package_configs" in linux.json
#   - each job runs in that distro's container, which is what decides DEB or RPM
#   - with 'publish: true' a job also uploads what it built
#     (see package/publish_pkg.sh)
#
# Only linux/amd64 is supported; the runner is hardcoded in the job below.
name: Package

on:
  workflow_call:
    inputs:
      publish:
        description: "Whether to publish the packages after building them."
        required: false
        type: boolean
        default: false
      nexus_url:
        description: "The base URL of the Nexus instance hosting the deb and rpm repositories."
        required: false
        type: string
        default: https://packages.xrplf.org

    secrets:
      remote_username:
        description: "The username of a Nexus account with write access to the repositories."
        required: false
      remote_password:
        description: "The password or token for that Nexus account."
        required: false
      signing_key:
        description: "Armoured PGP private key used to sign the RPMs. Required when publishing."
        required: false

defaults:
  run:
    shell: bash

env:
  BUILD_DIR: build

jobs:
  generate-matrix:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.generate.outputs.matrix }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.13"

      - name: Generate packaging matrix
        id: generate
        working-directory: .github/scripts/strategy-matrix
        run: ./generate.py --packaging >>"${GITHUB_OUTPUT}"

  package:
    needs: [generate-matrix]
    if: ${{ github.event.repository.visibility == 'public' || startsWith(github.ref, 'refs/tags/') }}
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
    name: "${{ matrix.xrpld_artifact_name }}"
    permissions:
      contents: read
    runs-on: ["self-hosted", "Linux", "X64", "heavy"]
    container: ${{ matrix.image }}
    timeout-minutes: 30

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download pre-built xrpld binary
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ matrix.xrpld_artifact_name }}
          path: ${{ env.BUILD_DIR }}

      - name: Download pre-built validator-keys binary
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ matrix.validator_keys_artifact_name }}
          path: ${{ env.BUILD_DIR }}

      - name: Make binaries executable
        run: chmod +x "${BUILD_DIR}/xrpld" "${BUILD_DIR}/validator-keys"

      - name: Determine release info
        id: release_info
        uses: ./.github/actions/release-info

      - name: Build package
        env:
          PKG_RELEASE: ${{ steps.release_info.outputs.pkg_release }}
          PKG_CHANNEL: ${{ steps.release_info.outputs.channel }}
        run: ./package/build_pkg.sh

      # Before the upload, so the artifact and the published package are the
      # same bytes. DEBs are not signed, so the key is never set on that job.
      - name: Sign RPM
        if: ${{ inputs.publish && matrix.distro == 'rhel' }}
        env:
          PKG_SIGNING_KEY: ${{ secrets.signing_key }}
        run: ./package/sign_rpm.sh "${BUILD_DIR}"

      - name: Upload package artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ matrix.xrpld_artifact_name }}-pkg
          path: |
            ${{ env.BUILD_DIR }}/debbuild/*.deb
            ${{ env.BUILD_DIR }}/debbuild/*.ddeb
            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/*.rpm
          if-no-files-found: error

      - name: Publish package
        if: ${{ inputs.publish }}
        env:
          CHANNEL: ${{ steps.release_info.outputs.channel }}
          NEXUS_URL: ${{ inputs.nexus_url }}
          NEXUS_USERNAME: ${{ secrets.remote_username }}
          NEXUS_PASSWORD: ${{ secrets.remote_password }}
        run: ./package/publish_pkg.sh "${CHANNEL}" "${BUILD_DIR}"