name: packages

on:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  build:
    if: contains(github.event.head_commit.message, '[cd]') || github.event_name == 'workflow_dispatch'
    name: deb pg${{ matrix.pg }} ${{ matrix.target.arch }}
    runs-on: ${{ matrix.target.runner }}
    strategy:
      fail-fast: false
      matrix:
        pg: ['18']
        target:
          - { runner: ubuntu-24.04, arch: amd64 }
          - { runner: ubuntu-24.04-arm, arch: arm64 }
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Add PGDG repo and build deps
        run: |
          set -e
          sudo install -d /usr/share/postgresql-common/pgdg
          sudo curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc \
            -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc
          . /etc/os-release
          echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt ${VERSION_CODENAME}-pgdg main" \
            | sudo tee /etc/apt/sources.list.d/pgdg.list
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            postgresql-server-dev-${{ matrix.pg }} build-essential clang libclang-dev pkg-config python3

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      - name: Install cargo-pgrx
        run: cargo install cargo-pgrx --version 0.18.1 --locked

      - name: Build .deb
        run: bash packaging/build-deb.sh ${{ matrix.pg }}

      - name: Upload .deb
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: deb-pg${{ matrix.pg }}-${{ matrix.target.arch }}
          path: dist/*.deb
          if-no-files-found: error

  pages:
    name: publish apt repo
    needs: build
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deploy.outputs.page_url }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Install apt tooling
        run: sudo apt-get update && sudo apt-get install -y dpkg-dev apt-utils gnupg

      - name: Download .debs
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          path: dist
          merge-multiple: true

      - name: Import signing key
        id: gpg
        run: |
          set -e
          printf '%s' "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import
          KEY_ID="$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')"
          echo "key_id=$KEY_ID" >> "$GITHUB_OUTPUT"

      - name: Assemble signed apt repo
        env:
          GPG_KEY_ID: ${{ steps.gpg.outputs.key_id }}
        run: bash packaging/build-apt-repo.sh dist

      - name: Configure Pages
        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0

      - name: Upload Pages artifact
        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
        with:
          path: site

      - name: Deploy to Pages
        id: deploy
        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
