name: nightly-build

on:
  schedule:
    # 03:30 UTC every night
    - cron: "30 3 * * *"
  workflow_dispatch:
    inputs:
      only:
        description: "Space-separated package dirs to build (blank = all)"
        required: false
        default: ""
      replace:
        description: "Replace existing registry files on version clash"
        required: false
        default: "false"

jobs:
  discover:
    runs-on: ubuntu-latest
    container:
      image: archlinux:latest
    outputs:
      packages: ${{ steps.list.outputs.packages }}
    steps:
      - name: Install toolchain
        run: |
          # nodejs is required by JS actions like actions/checkout.
          pacman -Syu --noconfirm --needed git python nodejs

      - name: Checkout
        uses: actions/checkout@v4

      - name: List packages
        id: list
        env:
          ONLY: ${{ github.event.inputs.only }}
        run: |
          packages=$(python3 autopackage.py --list-json ${ONLY:+--only $ONLY})
          echo "packages=$packages" >> "$GITHUB_OUTPUT"
          echo "Matrix: $packages"

  build:
    needs: discover
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    container:
      image: archlinux:latest
      # makepkg refuses to run as root; we create a build user below.
      options: --privileged
    strategy:
      # Build every package even if one fails.
      fail-fast: false
      # Tune to your runner capacity; remove for unlimited parallelism.
      max-parallel: 3
      matrix:
        pkg: ${{ fromJSON(needs.discover.outputs.packages) }}
    steps:
      - name: Install toolchain
        run: |
          # nodejs is required by JS actions like actions/checkout.
          pacman -Syu --noconfirm --needed base-devel git python sudo nodejs

      - name: Create build user
        run: |
          useradd -m -s /bin/bash builder
          echo "builder ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/builder
          chmod 0440 /etc/sudoers.d/builder

      - name: Checkout
        uses: actions/checkout@v4

      - name: Fix permissions
        run: chown -R builder:builder "$GITHUB_WORKSPACE"

      - name: Build and publish
        env:
          AUTOPKG_REGISTRY_URL: ${{ github.server_url }}
          AUTOPKG_OWNER: ${{ github.repository_owner }}
          AUTOPKG_REPO: arch
          AUTOPKG_USER: ${{ github.actor }}
          AUTOPKG_TOKEN: ${{ secrets.PACKAGE_TOKEN || github.token }}
          AUTOPKG_REPLACE: ${{ github.event.inputs.replace }}
          PKG: ${{ matrix.pkg }}
        run: |
          # -E keeps AUTOPKG_*; force HOME to builder's so cargo/git/etc. can write their caches
          sudo -E -u builder env HOME=/home/builder \
            python3 autopackage.py --only "$PKG"