name: Publish to AUR

on:
  push:
    tags:
      - 'v*'

jobs:
  publish:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Extract version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Compute sha256 of GitHub tarball
        id: sha256
        run: |
          URL="https://github.com/${{ github.repository }}/archive/refs/tags/${GITHUB_REF_NAME}.tar.gz"
          SHA=$(curl -sL "$URL" | sha256sum | awk '{print $1}')
          echo "sha256=$SHA" >> "$GITHUB_OUTPUT"

      - name: Update PKGBUILD version and checksum
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          SHA="${{ steps.sha256.outputs.sha256 }}"
          sed -i "s/^pkgver=.*/pkgver=${VERSION}/" PKGBUILD
          sed -i "s/^pkgrel=.*/pkgrel=1/" PKGBUILD
          sed -i "s/^sha256sums=.*/sha256sums=('${SHA}')/" PKGBUILD

      - name: Generate .SRCINFO
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          SHA="${{ steps.sha256.outputs.sha256 }}"
          PKGNAME="${{ github.event.repository.name }}"
          cat > .SRCINFO <<EOF
          pkgbase = ${PKGNAME}
          	pkgdesc = USB serial knob/button mixer daemon for PipeWire/PulseAudio on Linux
          	pkgver = ${VERSION}
          	pkgrel = 1
          	url = https://github.com/${{ github.repository }}
          	arch = any
          	license = MIT
          	makedepends = python-build
          	makedepends = python-installer
          	makedepends = python-wheel
          	makedepends = python-hatchling
          	depends = python
          	depends = python-pyserial
          	depends = python-pulsectl
          	depends = pipewire-pulse
          	optdepends = playerctl: media key support via button commands
          	optdepends = pulseaudio: alternative to pipewire-pulse
          	source = ${PKGNAME}-${VERSION}.tar.gz::https://github.com/${{ github.repository }}/archive/refs/tags/v${VERSION}.tar.gz
          	sha256sums = ${SHA}

          pkgname = ${PKGNAME}
          EOF

      - name: Set up SSH for AUR
        env:
          AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
        run: |
          mkdir -p ~/.ssh
          printf '%s' "$AUR_SSH_KEY" | base64 -d > ~/.ssh/aur
          chmod 600 ~/.ssh/aur
          echo "Key fingerprint: $(ssh-keygen -l -f ~/.ssh/aur)"
          ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts
          # exit 1 = auth OK but interactive shell disabled (expected for AUR)
          # exit 255 = connection/auth failure
          ssh -i ~/.ssh/aur -o StrictHostKeyChecking=no -T aur@aur.archlinux.org || [[ $? -eq 1 ]]

      - name: Clone AUR repo
        env:
          GIT_SSH_COMMAND: ssh -i ~/.ssh/aur -o StrictHostKeyChecking=no
        run: git clone ssh://aur@aur.archlinux.org/${{ github.event.repository.name }}.git /tmp/aur-pkg

      - name: Copy files and push to AUR
        env:
          GIT_SSH_COMMAND: ssh -i ~/.ssh/aur -o StrictHostKeyChecking=no
        run: |
          cp PKGBUILD .SRCINFO /tmp/aur-pkg/
          cd /tmp/aur-pkg
          git config user.name "github-actions"
          git config user.email "github-actions@github.com"
          git add PKGBUILD .SRCINFO
          git commit -m "Update to ${{ github.ref_name }}"
          git push