name: Build Alpine Packages

on:
  push:
    branches:
      - main
    tags:
      - "*"
  pull_request:
  workflow_dispatch:

env:
  ALPINE_VERSION: "3.24"
  ALPINE_ARCHES: "x86_64 aarch64"
  ALPINE_REGISTRY_BRANCH: "v3.24"
  ALPINE_REGISTRY_REPOSITORY: "${{ vars.PACKAGE_NAME }}"
  INSTANCE_URL: "${{ vars.INSTANCE_URL }}"
  PACKAGE_OWNER: "${{ vars.PACKAGE_OWNER }}"
  PACKAGE_USER: "${{ secrets.PACKAGE_USER }}"
  PACKAGE_TOKEN: "${{ secrets.PACKAGE_TOKEN }}"
  PACKAGER: "${{ gitea.repository_owner }}"
  ALPINE_RUST_CACHE_ROOT: "/cache/public-alpine-packages/v3.24/rust"
  TRIVY_VERSION: "0.74.0"
  TRIVY_SHA256: "2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a"

jobs:
  preflight:
    runs-on: ubuntu-latest
    timeout-minutes: 180
    container:
      image: "alpine:3.24"
    outputs:
      packages_selected: "${{ steps.package-selection.outputs.packages_selected }}"
      selected_packages: "${{ steps.package-selection.outputs.selected_packages }}"
      greptimedb_selected: "${{ steps.package-selection.outputs.greptimedb_selected }}"
    steps:
      - name: Prepare Environment
        run: |
          printf '%s\n' 'https://dl-cdn.alpinelinux.org/alpine/edge/community' >> /etc/apk/repositories
          apk add --no-cache --update atools-apkbuild-lint bash ca-certificates curl git jq nodejs shellcheck tar

      - name: Checkout
        uses: actions/checkout@v3

      - name: Select packages
        run: |
          scripts/apk/clean.sh
          find packaging/alpine/local -mindepth 2 -maxdepth 2 -name APKBUILD -exec apkbuild-lint {} +
          scripts/apk/lint-shell.sh
          scripts/apk/outdated.sh | tee update-check.txt
          if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
            {
              echo "## Upstream update check"
              echo
              echo '```text'
              cat update-check.txt
              echo '```'
            } >> "$GITHUB_STEP_SUMMARY"
          fi

      - name: Prepare package cache
        id: package-selection
        run: scripts/apk/ci-package-cache.sh prepare

      - name: Validate selected package matrix
        run: |
          for package in ${ALPINE_PACKAGES}; do
            case "${package}" in
              seaweedfs|greptimedb|lavinmq|gitea|nifi|rclone-openrc) ;;
              *)
                printf 'selected package is missing from the CI build matrix: %s\n' "${package}" >&2
                exit 1
                ;;
            esac
          done

  build:
    needs: preflight
    if: needs.preflight.outputs.packages_selected == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 180
    strategy:
      fail-fast: false
      matrix:
        package: [seaweedfs, greptimedb, lavinmq, gitea, nifi, rclone-openrc]
    container:
      image: "alpine:3.24"
    env:
      ALPINE_PACKAGE: "${{ matrix.package }}"
    steps:
      - name: Prepare Environment
        run: |
          printf '%s\n' 'https://dl-cdn.alpinelinux.org/alpine/edge/community' >> /etc/apk/repositories
          apk add --no-cache --update abuild-rootbld alpine-sdk bash ca-certificates doas git nodejs sudo
          mkdir -p "$ALPINE_RUST_CACHE_ROOT"
          chown -R 1000:1000 /cache/public-alpine-packages/v3.24

      - name: Checkout
        uses: actions/checkout@v3

      - name: Build package
        if: contains(needs.preflight.outputs.selected_packages, matrix.package)
        run: |
          scripts/apk/ci-build.sh
          scripts/apk/list-packages.sh

      - name: Check artifact upload support
        if: contains(needs.preflight.outputs.selected_packages, matrix.package)
        run: |
          test -n "${ACTIONS_RUNTIME_TOKEN:-}" || {
            echo "artifact upload support is required for split package builds" >&2
            exit 1
          }

      - name: Upload package artifacts
        if: contains(needs.preflight.outputs.selected_packages, matrix.package)
        uses: actions/upload-artifact@v3
        with:
          name: alpine-package-${{ matrix.package }}-${{ github.sha }}
          path: packages/local/
          retention-days: 1

  verify-and-publish:
    needs: [preflight, build]
    if: needs.preflight.outputs.packages_selected == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 180
    container:
      image: "alpine:3.24"
    env:
      ALPINE_PACKAGES: "${{ needs.preflight.outputs.selected_packages }}"
    steps:
      - name: Prepare Environment
        run: |
          printf '%s\n' 'https://dl-cdn.alpinelinux.org/alpine/edge/community' >> /etc/apk/repositories
          apk add --no-cache --update abuild-rootbld alpine-sdk bash ca-certificates curl doas docker-cli git jq nodejs rsync shellcheck sudo tar
          trivy_archive="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
          curl -fsSL -o "/tmp/${trivy_archive}" "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${trivy_archive}"
          echo "${TRIVY_SHA256}  /tmp/${trivy_archive}" | sha256sum -c -
          tar -xzf "/tmp/${trivy_archive}" -C /usr/local/bin trivy

      - name: Checkout
        uses: actions/checkout@v3

      - name: Prepare registry fallback
        run: |
          selected_packages="$ALPINE_PACKAGES"
          scripts/apk/ci-package-cache.sh prepare
          printf 'ALPINE_PACKAGES=%s\n' "$selected_packages" >> "$GITHUB_ENV"

      - name: Download package artifacts
        uses: actions/download-artifact@v3
        with:
          path: packages/worker-artifacts

      - name: Merge package artifacts
        run: scripts/apk/merge-ci-artifacts.sh

      - name: Export GreptimeDB CI assets
        if: needs.preflight.outputs.greptimedb_selected == 'true'
        run: scripts/apk/export-ci-assets.sh

      - name: Upload generated CI assets
        if: needs.preflight.outputs.greptimedb_selected == 'true'
        uses: actions/upload-artifact@v3
        with:
          name: greptimedb-musl-binaries-v3.24
          path: packages/ci-assets/

      - name: Upload local Alpine registry
        uses: actions/upload-artifact@v3
        with:
          name: alpine-local-registry-v3.24-${{ github.sha }}
          path: packages/local/
          retention-days: 30

      - name: Smoke test
        run: scripts/apk/ci-smoke.sh

      - name: Generate security reports
        run: |
          scripts/apk/security-report.sh
          if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
            find packages/security-reports -name summary.md -type f -print | sort | while IFS= read -r summary; do
              cat "$summary"
            done >> "$GITHUB_STEP_SUMMARY"
          fi

      - name: Upload security reports
        uses: actions/upload-artifact@v3
        with:
          name: apk-security-reports-v3.24
          path: packages/security-reports/

      - name: Runtime test
        run: ALPINE_RUNTIME_TEST_MODE=docker scripts/apk/runtime-test.sh

      - name: Publish Alpine packages
        if: github.ref == 'refs/heads/main'
        run: scripts/apk/publish-gitea.sh