name: Bootstrap Andaman and Subatomic
permissions:
  contents: read
  attestations: write
  artifact-metadata: write
  id-token: write
on:
  workflow_dispatch:

jobs:
  bootstrap:
    strategy:
      matrix:
        version: ["rawhide"]
        arch: ["x86_64", "aarch64"]
      fail-fast: true
    runs-on: ${{ matrix.arch == 'aarch64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04' }}
    container:
      image: registry.fedoraproject.org/fedora-minimal:${{ matrix.version }}
      options: --cap-add=SYS_ADMIN --privileged
    steps:
      - name: Install repositories
        run: |
          dnf5 swap -y --setopt=install_weak_deps=False systemd-standalone-sysusers systemd
          dnf5 install -y --setopt=install_weak_deps=False curl wget git-core openssl-devel cargo podman fuse-overlayfs dnf5-plugins rpmbuild script

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: f${{ matrix.version }}
          fetch-depth: 1

      - name: Build anda-srpm-macros
        run: |
          mkdir -p anda-build/rpm/rpms
          rpmbuild -bb anda/terra/srpm-macros/*.spec --undefine=_disable_source_fetch -D "_sourcedir $(pwd)/anda/terra/srpm-macros/" -D "_rpmdir $(pwd)/anda-build/rpm/rpms/"
          mv ./anda-build/rpm/rpms/*/anda-*.rpm ./anda-build/rpm/rpms/
          dnf5 install -y ./anda-build/rpm/rpms/anda-*.rpm

      - name: Install build dependencies
        run: dnf5 builddep -y anda/terra/{mock-configs,srpm-macros}/*.spec anda/tools/buildsys/{anda,subatomic}/*.spec

      - name: Install Anda
        run: |
          rpmbuild -bb anda/tools/buildsys/anda/*.spec --undefine=_disable_source_fetch -D "_sourcedir $(pwd)/anda/tools/buildsys/anda/" -D "_rpmdir $(pwd)/anda-build/rpm/rpms/"
          mv ./anda-build/rpm/rpms/*/anda-*.rpm ./anda-build/rpm/rpms/
          dnf5 install -y ./anda-build/rpm/rpms/anda-*.rpm

      - name: Build terra-mock-configs
        run: |
          echo "PATH=$PATH:/github/home/.cargo/bin" >> $GITHUB_ENV
          export PATH=$PATH:/github/home/.cargo/bin
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          anda build -D "vendor Terra" -rrpmbuild anda/terra/mock-configs/pkg
      - name: Install terra-mock-configs
        run: dnf5 install -y anda-build/rpm/rpms/terra-mock-configs*.rpm

      - name: Build terra-release
        run: anda build -D "vendor Terra" -rrpmbuild anda/terra/release/pkg

      - name: Build terra-appstream-helper
        run: anda build -D "vendor Terra" -D "__python %{__python3}" -rrpmbuild anda/terra/appstream-helper/pkg

      - name: Build Subatomic
        run: anda build -D "vendor Terra" -rrpmbuild anda/tools/buildsys/subatomic/pkg
      - name: Install Subatomic
        run: dnf5 install -y ./anda-build/rpm/rpms/subatomic-*.rpm

      - name: Tidy up output directory
        run: rmdir anda-build/rpm/rpms/{noarch,aarch64,x86_64} | true

      - name: Upload packages to subatomic
        run: |
          subatomic-cli upload --prune \
            --server https://subatomic.fyralabs.com \
            --token ${{ secrets.SUBATOMIC_TOKEN }} \
            terra${{ matrix.version }} anda-build/rpm/rpms/*

      - name: Upload source packages to subatomic
        if: github.event_name == 'push'
        run: |
          subatomic-cli upload --prune \
            --server https://subatomic.fyralabs.com \
            --token ${{ secrets.SUBATOMIC_TOKEN }} \
            terra${{ matrix.version }}-source anda-build/rpm/srpm/*

      - name: Attest build provenance
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-path: |
            anda-build/rpm/rpms/*
            anda-build/rpm/srpm/*
