name: Build Debian package

on:
  push:
    tags:
      - 'v*'

  workflow_dispatch:
    inputs:
      ref:
        description: 'Git ref to build (tag, branch, or commit)'
        required: true
        default: 'master'

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

jobs:
  build-deb:
    name: Build Debian package (${{ matrix.codename }})
    runs-on: ubuntu-24.04

    strategy:
      matrix:
        include:
          - image: debian:bookworm
            codename: bookworm
          - image: debian:trixie
            codename: trixie

    container:
      image: ${{ matrix.image }}

    permissions:
      contents: write

    steps:
      - name: Install git
        run: |
          apt-get update
          apt-get install -y git ca-certificates

      - name: Checkout source
        uses: actions/checkout@v5
        with:
          ref: ${{ github.event.inputs.ref || github.ref }}

      - name: Install build dependencies
        run: |
          apt-get update

          DEBIAN_FRONTEND=noninteractive apt-get install -y \
            build-essential \
            cmake \
            debhelper \
            devscripts \
            dpkg-dev \
            fakeroot \
            equivs \
            pkg-config \
            libssl-dev \
            liblmdb-dev \
            libmilter-dev \
            libunbound-dev \
            liblua5.4-dev \
            libbsd-dev \
            libevent-dev \
            nettle-dev \
            libhiredis-dev \
            dh-python \
            python3

      - name: Show build environment
        run: |
          uname -a
          cat /etc/os-release
          gcc --version
          cmake --version
          openssl version

      - name: Append backport version suffix (bookworm)
        if: matrix.codename == 'bookworm'
        run: |
          export DEBEMAIL="edmund@proteamail.com"
          export DEBFULLNAME="Edmund Lodewijks"
          dch --local "~bpo12+" --distribution bookworm "Rebuild for Debian bookworm"

      - name: Build Debian package
        run: |
          dpkg-buildpackage -us -uc -b

      - name: Collect build artifacts
        run: |
          mkdir -p dist
          mv ../*.deb dist/ || true
          mv ../*.changes dist/ || true
          mv ../*.buildinfo dist/ || true

      - name: Prefix artifacts with codename
        run: |
          cd dist
          for f in *; do
            mv "$f" "${{ matrix.codename }}_${f}"
          done
          ls -lah

      - name: Upload build artifacts
        uses: actions/upload-artifact@v5
        with:
          name: debs-${{ matrix.codename }}
          path: dist/

      - name: Upload release artifacts
        if: github.ref_type == 'tag'
        uses: softprops/action-gh-release@v3
        with:
          files: dist/*
          overwrite_files: true
          fail_on_unmatched_files: true

      - name: Dispatch to apt repository
        if: github.ref_type == 'tag'
        run: |
          BASE="https://github.com/edmundlod/PhoenixDKIM/releases/download/${{ github.ref_name }}"
          PKGS_JSON="["
          first=true
          for deb in dist/*.deb; do
            pkg=$(basename "$deb" | tr '~' '.')
            if [ "$first" = true ]; then
              PKGS_JSON="${PKGS_JSON}\"${BASE}/${pkg}\""
              first=false
            else
              PKGS_JSON="${PKGS_JSON},\"${BASE}/${pkg}\""
            fi
          done
          PKGS_JSON="${PKGS_JSON}]"
          curl -s -X POST \
            -H "Authorization: Bearer ${{ secrets.REPO_DISPATCH_APT_AND_RPM }}" \
            -H "Accept: application/vnd.github+json" \
            https://api.github.com/repos/edmundlod/apt/dispatches \
            -d "{\"event_type\":\"packages-built\",\"client_payload\":{\"deb_urls\":${PKGS_JSON},\"codename\":\"${{ matrix.codename }}\"}}"
