name: Build Live ISOs

on:
  workflow_dispatch:
    inputs:
      image_tag:
        description: "AeroCore image tag to install"
        required: false
        default: latest
        type: string
  workflow_call:

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
  cancel-in-progress: true

jobs:
  build-installer-iso:
    name: Build KDE live ISO
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: read

    env:
      IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
      IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
      ISO_FILE_TAG: ${{ github.ref_name == 'testing' && 'testing' || (inputs.image_tag || 'latest') }}
      # Keep these aligned with the Fedora major used by the target bazzite-deck base image.
      LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
      FEDORA_VERSION: "43"
      OSTREE_IMAGE_REF: ${{ vars.OSTREE_IMAGE_REF }}

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
        with:
          remove-codeql: true

      - name: Mount container storage BTRFS loopback
        run: |
          sudo truncate -s 70G /mnt/podman-storage.img
          sudo mkfs.btrfs -f /mnt/podman-storage.img
          sudo podman system reset --force
          sudo systemctl stop podman.service
          sudo mount -o compress-force=zstd:2 /mnt/podman-storage.img /var/lib/containers/storage
          sudo systemctl start podman.service

      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Install just
        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4

      - name: Prepare image references
        run: |
          image_name="$(just image_name)"
          image_registry="${IMAGE_REGISTRY,,}"
          echo "IMAGE_NAME=${image_name,,}" >> "$GITHUB_ENV"
          echo "IMAGE_REGISTRY=${image_registry}" >> "$GITHUB_ENV"

      - name: Login to GHCR
        run: |
          echo '${{ secrets.GITHUB_TOKEN }}' | sudo podman login ghcr.io \
            --username '${{ github.actor }}' --password-stdin

      - name: Pull AeroCore install image
        run: |
          sudo podman pull "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"

      - name: Build installer ISO payload
        run: |
          mkdir -p output
          ostree_image_ref="${OSTREE_IMAGE_REF:-ostree-image-signed:docker://${IMAGE_REGISTRY}/${IMAGE_NAME}}"
          install_image_ref="${ostree_image_ref#ostree-image-signed:docker://}"
          install_image_ref="${install_image_ref#ostree-unverified-registry:docker://}"
          install_image_ref="${install_image_ref#docker://}"
          sudo podman tag \
            "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \
            "${install_image_ref}:${IMAGE_TAG}"
          sudo podman save \
            --format oci-archive \
            --output output/install-payload.oci \
            "${install_image_ref}:${IMAGE_TAG}"

          sudo podman build \
            --cap-add sys_admin \
            --security-opt label=disable \
            --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
            --build-arg "INSTALL_IMAGE_PAYLOAD=${install_image_ref}:${IMAGE_TAG}" \
            --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
            --build-arg "INSTALL_IMAGE_TAG=${IMAGE_TAG}" \
            --build-arg "OSTREE_IMAGE_REF=${ostree_image_ref}" \
            --tag localhost/aerocore-os-installer:latest \
            --file installer/Containerfile \
            .

      - name: Build ISO
        id: build
        uses: Zeglius/titanoboa@7737f4748458252ac827dca14b3d6dd09298472a # revamp-pr
        with:
          image-ref: localhost/aerocore-os-installer:latest
          iso-dest: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-live-amd64.iso

      - name: Normalize ISO output path
        shell: bash
        env:
          GENERATED_ISO: ${{ steps.build.outputs.iso-dest }}
          EXPECTED_ISO: ${{ github.workspace }}/output/aerocore-os-${{ env.ISO_FILE_TAG }}-live-amd64.iso
        run: |
          if [[ ! -f "${GENERATED_ISO}" ]]; then
            echo "::error::Generated ISO does not exist at ${GENERATED_ISO}"
            exit 1
          fi
          if [[ "${GENERATED_ISO}" != "${EXPECTED_ISO}" ]]; then
            mkdir -p "$(dirname "${EXPECTED_ISO}")"
            mv "${GENERATED_ISO}" "${EXPECTED_ISO}"
          fi

      - name: Display checksum
        shell: bash
        run: |
          set -o pipefail
          iso_path="output/aerocore-os-${ISO_FILE_TAG}-live-amd64.iso"
          checksum_path="${iso_path}-CHECKSUM"
          sha256sum "${iso_path}" | tee "${checksum_path}"
          {
            echo "# ISO Checksum (SHA256)"
            echo
            echo "ISO: $(basename "${iso_path}")"
            echo
            echo '```'
            cat "${checksum_path}"
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Move ISO to upload directory
        id: upload-directory
        shell: bash
        run: |
          iso_upload_dir="${{ github.workspace }}/output/upload"
          iso_path="${{ github.workspace }}/output/aerocore-os-${ISO_FILE_TAG}-live-amd64.iso"
          iso_name="$(basename "${iso_path}")"

          mkdir -p "${iso_upload_dir}"
          mv "${iso_path}" "${iso_upload_dir}/"
          (
            cd "${iso_upload_dir}"
            sha256sum "${iso_name}" | tee "${iso_name}-CHECKSUM"
          )
          echo "iso-upload-dir=${iso_upload_dir}" >> "$GITHUB_OUTPUT"

      - name: Upload ISO checksum to Job Artifacts
        if: github.ref_name == 'testing'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: aerocore-os-installer-iso-${{ env.ISO_FILE_TAG }}-checksum
          path: ${{ steps.upload-directory.outputs.iso-upload-dir }}/*-CHECKSUM
          if-no-files-found: error
          retention-days: 1
          compression-level: 0

      - name: Upload ISO and checksum to R2
        if: github.event_name == 'workflow_dispatch' && github.ref_name == 'main'
        shell: bash
        env:
          RCLONE_CONFIG_R2_TYPE: s3
          RCLONE_CONFIG_R2_PROVIDER: Cloudflare
          RCLONE_CONFIG_R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          RCLONE_CONFIG_R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          RCLONE_CONFIG_R2_REGION: auto
          RCLONE_CONFIG_R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
          SOURCE_DIR: ${{ steps.upload-directory.outputs.iso-upload-dir }}
        run: |
          sudo apt-get update
          sudo apt-get install -y rclone
          rclone copy "$SOURCE_DIR" R2:bazzite