name: Publish Linux Repos

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag (e.g. v0.18.1). Leave empty for latest."
        required: false
        type: string
  workflow_run:
    workflows: ["Release"]
    types:
      - completed

permissions:
  contents: read

jobs:
  publish-repos:
    if: >
      github.repository == 'zhom/donutbrowser' &&
      (github.event_name == 'workflow_dispatch' ||
       github.event.workflow_run.conclusion == 'success')
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2

      - name: Determine release tag
        id: tag
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          INPUT_TAG: ${{ inputs.tag }}
        run: |
          if [[ -n "${INPUT_TAG:-}" ]]; then
            echo "tag=${INPUT_TAG}" >> "$GITHUB_OUTPUT"
          elif [[ "${{ github.event_name }}" == "workflow_run" ]]; then
            # The Release workflow is triggered by a tag push (v*),
            # so head_branch is the tag name
            echo "tag=${{ github.event.workflow_run.head_branch }}" >> "$GITHUB_OUTPUT"
          else
            TAG=$(gh release view --repo "${{ github.repository }}" --json tagName -q .tagName)
            echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
          fi

      - name: Install tools (dpkg-dev, createrepo-c, aws-cli v1)
        run: |
          sudo apt-get update
          sudo apt-get install -y dpkg-dev createrepo-c python3-pip
          # GitHub runners ship aws-cli v2, which sends CRC64NVME integrity
          # checksums that Cloudflare R2 rejects with `Unauthorized` on
          # ListObjectsV2 (the call behind `aws s3 sync`). aws-cli v1 predates
          # that behavior — the same reason scripts/publish-repo.sh works in
          # Docker. Remove v2 and install v1 system-wide so it's the binary on
          # PATH within this job, and fail fast if v2 somehow survives rather
          # than letting the publish step die on an opaque Unauthorized later.
          sudo rm -f /usr/local/bin/aws /usr/local/bin/aws_completer
          sudo rm -rf /usr/local/aws-cli
          sudo pip3 install --break-system-packages 'awscli<2'
          hash -r
          aws --version
          case "$(aws --version 2>&1)" in
            aws-cli/1.*) ;;
            *) echo "::error::Expected aws-cli v1 but got: $(aws --version 2>&1)"; exit 1 ;;
          esac

      - name: Publish DEB & RPM repositories to R2
        env:
          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          R2_ENDPOINT_URL: ${{ secrets.R2_ENDPOINT_URL }}
          R2_BUCKET_NAME: ${{ secrets.R2_BUCKET_NAME }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bash scripts/publish-repo.sh "${{ steps.tag.outputs.tag }}"