name: Release

on:
  push:
    tags:
      - 'v*'

jobs:
  build:
    name: Build and upload release tarball
    runs-on: codeberg-small
    container: archlinux:latest

    steps:
      - name: Create resolv.conf
        run: |
          set -ex
          echo 'nameserver 8.8.8.8' >/etc/resolv.conf
          echo 'nameserver 8.8.4.4' >>/etc/resolv.conf

      - name: Install dependencies
        run: pacman --noconfirm -Syu && pacman --needed --noconfirm -S nodejs jq curl tea base-devel gnupg gzip bzip2 xz git autoconf automake nasm curl mtools llvm clang lld github-cli

      - name: Import GPG public key
        run: gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 05D29860D0A0668AAEFB9D691F3C021BECA23821

      - name: Import GPG private key
        run: echo "$MINTSUKI_PRIVATE_KEY" | gpg --batch --import
        env:
          MINTSUKI_PRIVATE_KEY: ${{ secrets.MINTSUKI_PRIVATE_KEY }}

      - name: Checkout code
        uses: https://code.forgejo.org/actions/checkout@v6

      - name: Package release tarball
        run: |
          set -e
          ./bootstrap
          ./configure
          make dist
          mkdir dist-output
          mv limine-*.tar.* dist-output/

      - name: Sign release tarball
        run: |
          set -e
          for f in dist-output/*; do
            gpg --batch --default-key 05D29860D0A0668AAEFB9D691F3C021BECA23821 --detach-sign $f
          done

      - name: Release
        uses: https://code.forgejo.org/actions/forgejo-release@v2.7.3
        with:
          direction: upload
          hide-archive-link: true
          release-dir: dist-output
          release-notes: |
            Changelog can be found [here](https://codeberg.org/Limine/Limine/src/tag/${{ forge.ref_name }}/ChangeLog).

            Binary release can be found [here](https://codeberg.org/Limine/Limine/src/tag/${{ forge.ref_name }}-binary).

            Tarballs are signed using key ID `05D29860D0A0668AAEFB9D691F3C021BECA23821` which can be obtained from a keyserver such as `keyserver.ubuntu.com`.

            Import the public key with:
            ```bash
            gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 05D29860D0A0668AAEFB9D691F3C021BECA23821
            ```

            In order to verify the tarball with the given signature, do:
            ```bash
            gpg --verify <tarball sig file> <associated tarball>
            ```

      - name: GitHub mirror release
        env:
          GITHUB_TOKEN: ${{ secrets.MINTSUKI_GH_TOKEN }}
        run: |
          set -e
          cat >release_notes.txt <<'EOF'
          Changelog can be found [here](https://github.com/limine-bootloader/limine/blob/${{ forge.ref_name }}/ChangeLog).

          Binary release can be found [here](https://github.com/limine-bootloader/limine/tree/${{ forge.ref_name }}-binary).

          Tarballs are signed using key ID `05D29860D0A0668AAEFB9D691F3C021BECA23821` which can be obtained from a keyserver such as `keyserver.ubuntu.com`.

          Import the public key with:
          ```bash
          gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 05D29860D0A0668AAEFB9D691F3C021BECA23821
          ```

          In order to verify the tarball with the given signature, do:
          ```bash
          gpg --verify <tarball sig file> <associated tarball>
          ```
          EOF
          gh release create "${{ forge.ref_name }}" \
            --repo "limine-bootloader/limine" \
            --title "${{ forge.ref_name }}" \
            --notes-file "release_notes.txt" \
            dist-output/*