name: Debian-based ISO and SquashFS

on:
  workflow_call:
  workflow_dispatch:
    inputs:
      environment:
        type: choice
        description: Environment
        options:
          - NONE
          - dev
          - unstable
          - dev-unstable
      runner:
        type: choice
        description: Runner
        options:
          - standard
          - fast
      platform:
        type: choice
        description: Platform
        options:
          - ALL
          - x86_64
          - x86_64-nonfree
          - x86_64-nvidia
          - aarch64
          - aarch64-nonfree
          - aarch64-nvidia
          # - raspberrypi
          - riscv64
          - riscv64-nonfree
      deploy:
        type: choice
        description: Deploy
        options:
          - NONE
          - alpha
          - beta
  push:
    branches:
      - master
      - next/*
  pull_request:
    branches:
      - master
      - next/*

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

env:
  NODEJS_VERSION: "24.11.0"
  ENVIRONMENT: '${{ fromJson(format(''["{0}", ""]'', github.event.inputs.environment || ''dev''))[github.event.inputs.environment == ''NONE''] }}'

jobs:
  compile:
    name: Compile Base Binaries
    if: github.event.pull_request.draft != true
    strategy:
      fail-fast: true
      matrix:
        arch: >-
          ${{
            fromJson('{
              "x86_64": ["x86_64"],
              "x86_64-nonfree": ["x86_64"],
              "x86_64-nvidia": ["x86_64"],
              "aarch64": ["aarch64"],
              "aarch64-nonfree": ["aarch64"],
              "aarch64-nvidia": ["aarch64"],
              "raspberrypi": ["aarch64"],
              "riscv64": ["riscv64"],
              "riscv64-nonfree": ["riscv64"],
              "ALL": ["x86_64", "aarch64", "riscv64"]
            }')[github.event.inputs.platform || 'ALL']
          }}
    runs-on: >-
      ${{
        fromJson(
          format(
            '["{0}", "{1}"]',
            fromJson('{
              "x86_64": "ubuntu-latest",
              "aarch64": "ubuntu-24.04-arm",
              "riscv64": "ubuntu-latest"
            }')[matrix.arch],
            fromJson('{
              "x86_64": "amd64-fast",
              "aarch64": "aarch64-fast",
              "riscv64": "amd64-fast"
            }')[matrix.arch]
          )
        )[github.event.inputs.runner == 'fast']
      }}
    steps:
      - name: Mount tmpfs
        if: ${{ github.event.inputs.runner == 'fast' }}
        run: sudo mount -t tmpfs tmpfs .
      - uses: actions/checkout@v6
        with:
          submodules: recursive
      - uses: ./.github/actions/setup-build
        with:
          nodejs-version: ${{ env.NODEJS_VERSION }}
          setup-python: "true"

      - name: Make
        run: make ARCH=${{ matrix.arch }} compiled-${{ matrix.arch }}.tar
        env:
          SCCACHE_GHA_ENABLED: on
          SCCACHE_GHA_VERSION: 0

      - uses: actions/upload-artifact@v7
        with:
          name: compiled-${{ matrix.arch }}.tar
          path: compiled-${{ matrix.arch }}.tar
  image:
    name: Build Image
    needs: [compile]
    strategy:
      fail-fast: false
      matrix:
        platform: >-
          ${{
            fromJson(
              format(
                '[
                  ["{0}"],
                  ["x86_64", "x86_64-nonfree", "x86_64-nvidia", "aarch64", "aarch64-nonfree", "aarch64-nvidia", "raspberrypi", "riscv64", "riscv64-nonfree"]
                ]',
                github.event.inputs.platform || 'ALL'
              )
            )[(github.event.inputs.platform || 'ALL') == 'ALL']
          }}
    runs-on: >-
      ${{
        fromJson(
          format(
            '["{0}", "{1}"]',
            fromJson('{
              "x86_64": "ubuntu-latest",
              "x86_64-nonfree": "ubuntu-latest",
              "x86_64-nvidia": "ubuntu-latest",
              "aarch64": "ubuntu-24.04-arm",
              "aarch64-nonfree": "ubuntu-24.04-arm",
              "aarch64-nvidia": "ubuntu-24.04-arm",
              "raspberrypi": "ubuntu-24.04-arm",
              "riscv64": "ubuntu-24.04-arm",
              "riscv64-nonfree": "ubuntu-24.04-arm",
            }')[matrix.platform],
            fromJson('{
              "x86_64": "amd64-fast",
              "x86_64-nonfree": "amd64-fast",
              "x86_64-nvidia": "amd64-fast",
              "aarch64": "aarch64-fast",
              "aarch64-nonfree": "aarch64-fast",
              "aarch64-nvidia": "aarch64-fast",
              "raspberrypi": "aarch64-fast",
              "riscv64": "amd64-fast",
              "riscv64-nonfree": "amd64-fast",
            }')[matrix.platform]
          )
        )[github.event.inputs.runner == 'fast']
      }}
    env:
      ARCH: >-
        ${{
          fromJson('{
            "x86_64": "x86_64",
            "x86_64-nonfree": "x86_64",
            "x86_64-nvidia": "x86_64",
            "aarch64": "aarch64",
            "aarch64-nonfree": "aarch64",
            "aarch64-nvidia": "aarch64",
            "raspberrypi": "aarch64",
            "riscv64": "riscv64",
            "riscv64-nonfree": "riscv64",
          }')[matrix.platform]
        }}
    steps:
      - name: Free space
        run: |
          sudo apt-get remove --purge -y azure-cli || true
          sudo apt-get remove --purge -y firefox || true
          sudo apt-get remove --purge -y ghc-* || true
          sudo apt-get remove --purge -y google-cloud-sdk || true
          sudo apt-get remove --purge -y google-chrome-stable || true
          sudo apt-get remove --purge -y powershell || true
          sudo apt-get remove --purge -y php* || true
          sudo apt-get remove --purge -y ruby* || true
          sudo apt-get remove --purge -y mono-* || true
          sudo apt-get autoremove -y
          sudo apt-get clean
          sudo rm -rf /usr/lib/jvm               # All JDKs
          sudo rm -rf /usr/local/.ghcup          # Haskell toolchain
          sudo rm -rf /usr/local/lib/android     # Android SDK/NDK, emulator
          sudo rm -rf /usr/share/dotnet          # .NET SDKs
          sudo rm -rf /usr/share/swift           # Swift toolchain (if present)
          sudo rm -rf "$AGENT_TOOLSDIRECTORY"    # Pre-cached tool cache (Go, Node, etc.)
        if: ${{ github.event.inputs.runner != 'fast' }}

      # Some runners lack /opt/hostedtoolcache, which setup-qemu expects
      - name: Ensure hostedtoolcache exists
        run: sudo mkdir -p /opt/hostedtoolcache && sudo chown $USER:$USER /opt/hostedtoolcache

      - name: Set up docker QEMU
        uses: docker/setup-qemu-action@v4

      - uses: actions/checkout@v6
        with:
          submodules: recursive

      - name: Download compiled artifacts
        uses: actions/download-artifact@v8
        with:
          name: compiled-${{ env.ARCH }}.tar

      - name: Extract compiled artifacts
        run: tar -xvf compiled-${{ env.ARCH }}.tar

      - name: Prevent rebuild of compiled artifacts
        run: |
          mkdir -p web/node_modules
          mkdir -p web/dist/raw
          mkdir -p core/bindings
          mkdir -p sdk/base/lib/osBindings
          mkdir -p container-runtime/node_modules
          mkdir -p container-runtime/dist
          mkdir -p container-runtime/dist/node_modules
          mkdir -p sdk/dist
          mkdir -p sdk/baseDist
          mkdir -p patch-db/client/node_modules
          mkdir -p patch-db/client/dist
          mkdir -p web/.angular
          mkdir -p web/dist/raw/ui
          mkdir -p web/dist/raw/setup-wizard
          mkdir -p web/dist/static/ui
          mkdir -p web/dist/static/setup-wizard
          PLATFORM=${{ matrix.platform }} make -t compiled-${{ env.ARCH }}.tar

      - run: git status

      - name: Run iso build
        run: PLATFORM=${{ matrix.platform }} make iso
        if: ${{ matrix.platform != 'raspberrypi' }}

      - name: Run img build
        run: PLATFORM=${{ matrix.platform }} make img
        if: ${{ matrix.platform == 'raspberrypi' }}

      - uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.platform }}.squashfs
          path: results/*.squashfs

      - uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.platform }}.iso
          path: results/*.iso
        if: ${{ matrix.platform != 'raspberrypi' }}

      - uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.platform }}.img
          path: results/*.img
        if: ${{ matrix.platform == 'raspberrypi' }}

  deploy:
    name: Deploy
    needs: [image]
    if: github.event_name == 'workflow_dispatch' && github.event.inputs.deploy != 'NONE'
    runs-on: ubuntu-latest
    env:
      REGISTRY: >-
        ${{
          fromJson('{
            "alpha": "https://alpha-registry-x.start9.com",
            "beta": "https://beta-registry.start9.com"
          }')[github.event.inputs.deploy]
        }}
      S3_BUCKET: s3://startos-images
      S3_CDN: https://startos-images.nyc3.cdn.digitaloceanspaces.com
    steps:
      - uses: actions/checkout@v6
        with:
          sparse-checkout: web/package.json

      - name: Determine version
        id: version
        run: |
          VERSION=$(sed -n 's/.*"version": *"\([^"]*\)".*/\1/p' web/package.json | head -1)
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Version: $VERSION"

      - name: Download squashfs artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: "*.squashfs"
          path: artifacts/
          merge-multiple: true

      - name: Download ISO artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: "*.iso"
          path: artifacts/
          merge-multiple: true

      - name: Install start-cli
        run: |
          ARCH=$(uname -m)
          OS=$(uname -s | tr '[:upper:]' '[:lower:]')
          ASSET_NAME="start-cli_${ARCH}-${OS}"
          DOWNLOAD_URL=$(curl -fsS \
            -H "Authorization: token ${{ github.token }}" \
            https://api.github.com/repos/Start9Labs/start-os/releases \
            | jq -r '[.[].assets[] | select(.name=="'"$ASSET_NAME"'")] | first | .browser_download_url')
          curl -fsSL \
            -H "Authorization: token ${{ github.token }}" \
            -H "Accept: application/octet-stream" \
            "$DOWNLOAD_URL" -o /tmp/start-cli
          sudo install -m 755 /tmp/start-cli /usr/local/bin/start-cli
          echo "start-cli: $(start-cli --version)"

      - name: Configure S3
        run: |
          sudo apt-get install -y -qq s3cmd > /dev/null
          cat > ~/.s3cfg <<EOF
          [default]
          access_key = ${{ secrets.S3_ACCESS_KEY }}
          secret_key = ${{ secrets.S3_SECRET_KEY }}
          host_base = nyc3.digitaloceanspaces.com
          host_bucket = %(bucket)s.nyc3.digitaloceanspaces.com
          use_https = True
          EOF

      - name: Set up developer key
        run: |
          mkdir -p ~/.startos
          printf '%s' "${{ secrets.DEV_KEY }}" > ~/.startos/developer.key.pem

      - name: Upload to S3
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          cd artifacts
          for file in *.iso *.squashfs; do
            [ -f "$file" ] || continue
            echo "Uploading $file..."
            s3cmd put -P "$file" "${{ env.S3_BUCKET }}/v${VERSION}/$file"
          done

      - name: Register OS version
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          start-cli --registry="${{ env.REGISTRY }}" registry os version add \
            "$VERSION" "v${VERSION}" '' ">=0.3.5 <=${VERSION}"

      - name: Index assets in registry
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          cd artifacts
          for file in *.squashfs *.iso; do
            [ -f "$file" ] || continue
            PLATFORM=$(echo "$file" | sed 's/.*_\([^.]*\)\.\(squashfs\|iso\)$/\1/')
            echo "Indexing $file for platform $PLATFORM..."
            start-cli --registry="${{ env.REGISTRY }}" registry os asset add \
              --platform="$PLATFORM" \
              --version="$VERSION" \
              "$file" \
              "${{ env.S3_CDN }}/v${VERSION}/$file"
          done