name: Build live installer

on:
  workflow_dispatch:
    inputs:
      image_tag:
        description: "AeroCore image tag to install"
        required: false
        default: latest
        type: string
  workflow_call:
  push:
    branches:
      - main
    paths:
      - "Justfile"
      - "installer/**"
      - "just_scripts/build-live-installer.sh"
      - ".github/workflows/build-live-installer.yml"

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
  cancel-in-progress: true

jobs:
  build-live-installer:
    name: Build KDE live installer
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: read

    env:
      IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
      IMAGE_TAG: ${{ inputs.image_tag || 'latest' }}
      LIVE_BASE_IMAGE: quay.io/fedora/fedora-kinoite:43
      FEDORA_VERSION: "44"

    steps:
      - name: Maximize build space
        uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
        with:
          remove-codeql: true

      - name: Mount container storage BTRFS loopback
        run: |
          sudo truncate -s 70G /mnt/podman-storage.img
          sudo mkfs.btrfs -f /mnt/podman-storage.img
          sudo podman system reset --force
          sudo systemctl stop podman.service
          sudo mount -o compress-force=zstd:2 /mnt/podman-storage.img /var/lib/containers/storage
          sudo systemctl start podman.service

      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Install just
        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4

      - name: Prepare image references
        run: |
          image_name="$(just image_name)"
          image_registry="${IMAGE_REGISTRY,,}"
          echo "IMAGE_NAME=${image_name,,}" >> "$GITHUB_ENV"
          echo "IMAGE_REGISTRY=${image_registry}" >> "$GITHUB_ENV"

      - name: Login to GHCR
        run: |
          echo '${{ secrets.GITHUB_TOKEN }}' | sudo podman login ghcr.io \
            --username '${{ github.actor }}' --password-stdin

      - name: Pull AeroCore install image
        run: |
          sudo podman pull "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"

      - name: Build live installer payload
        run: |
          mkdir -p output
          sudo podman tag \
            "${IMAGE_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}" \
            localhost/aerocore-live-payload:latest
          sudo podman save \
            --format oci-archive \
            --output output/install-payload.oci \
            localhost/aerocore-live-payload:latest

          sudo podman build \
            --cap-add sys_admin \
            --security-opt label=disable \
            --build-arg "BASE_IMAGE=${LIVE_BASE_IMAGE}" \
            --build-arg "INSTALL_IMAGE_PAYLOAD=localhost/aerocore-live-payload:latest" \
            --build-arg "INSTALL_IMAGE_PAYLOAD_ARCHIVE=/install-payload.oci" \
            --tag localhost/aerocore-live-payload:latest \
            --file installer/Containerfile \
            .

      - name: Build ISO
        id: build
        uses: Zeglius/titanoboa@revamp-pr
        with:
          arch: x86_64
          image_name: aerocore-live-payload
          image_repo: localhost
          variant: Kinoite
          version: ${{ env.FEDORA_VERSION }}
          image_tag: latest
          iso_name: aerocore-os-${{ env.IMAGE_TAG }}-amd64.iso
          enable_cache_dnf: "false"
          enable_cache_skopeo: "false"
          enable_flatpak_dependencies: "false"
          additional_templates: /github/workspace/installer/lorax_templates/remove_root_password_prompt.tmpl /github/workspace/installer/lorax_templates/set_default_user.tmpl

      - name: Display checksum
        run: |
          cat "${{ steps.build.outputs.iso_path }}/${{ steps.build.outputs.iso_name }}-CHECKSUM"

      - name: Upload ISO artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: aerocore-os-live-installer-${{ env.IMAGE_TAG }}
          path: |
            ${{ steps.build.outputs.iso_path }}/${{ steps.build.outputs.iso_name }}
            ${{ steps.build.outputs.iso_path }}/${{ steps.build.outputs.iso_name }}-CHECKSUM
          if-no-files-found: error
          compression-level: 0