name: CI

on:
  push:
  workflow_dispatch:

jobs:
  test_local:
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
    runs-on: '${{ matrix.os }}'
    name: 'Test / ${{ matrix.os }}'
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install dependencies
        run: |
          brew install bash coreutils findutils
          echo "$(brew --prefix)/opt/coreutils/libexec/gnubin" >> "$GITHUB_PATH"
          echo "$(brew --prefix)/opt/findutils/libexec/gnubin" >> "$GITHUB_PATH"
        if: runner.os == 'macOS'
        # Is it even macOS anymore? It is for me. I really am too lazy to deal
        # with ancient utilities that come with the actual macOS.

      - name: Test
        run: make test

  test_docker:
    strategy:
      matrix:
        # Keep in sync with those in Makefile:
        distro: [xenial, focal]
    runs-on: ubuntu-latest
    name: 'Test / Docker / ${{ matrix.distro }}'
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Test
        run: make 'test/docker/${{ matrix.distro }}'

  aur:
    name: Publish to AUR
    needs:
      - test_local
      - test_docker
    runs-on: ubuntu-latest
    if: |
      startsWith(github.ref, 'refs/tags/')
      && !startsWith(github.ref, 'refs/tags/debian/')
    container:
      image: archlinux:base-devel
    steps:
      # This step must be done before actions/checkout. From the latter's
      # output:
      #
      #     To create a local Git repository instead, add Git 2.18 or higher to the PATH
      #
      - name: Install dependencies
        run: |
          pacman -Syu --noconfirm git openssh

      - name: Checkout
        uses: actions/checkout@v7
        with:
          ref: aur
          token: '${{ secrets.GH_TOKEN }}'

      # makepkg for no reason hard-forbids running as root. Kill me now.
      - name: Add builder user
        run: |
          useradd -m -s /bin/bash builder
          passwd -d builder
          echo 'builder ALL=(ALL) ALL' >> /etc/sudoers
          chown -R builder:builder -- "$GITHUB_WORKSPACE"

      - name: Configure SSH
        run: |
          mkdir -p /home/builder/.ssh/
          cat > /home/builder/.ssh/config <<'EOF'
          StrictHostKeyChecking no
          EOF
          cat > /home/builder/.ssh/id_ed25519 <<'EOF'
          ${{ secrets.SSH_KEY }}
          EOF
          chown -R builder:builder /home/builder/.ssh
          chmod 0600 /home/builder/.ssh/id_ed25519

      - name: Configure git
        run: |
          # See https://github.com/actions/checkout#push-a-commit-using-the-built-in-token
          runuser -u builder -- git -C "$GITHUB_WORKSPACE" config user.name "github-actions[bot]"
          runuser -u builder -- git -C "$GITHUB_WORKSPACE" config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Run maintenance
        run: |
          runuser -u builder -- make -C "$GITHUB_WORKSPACE" maintenance