name: Publish to AUR

on:
  push:
    tags:
      - 'v*'

jobs:
  publish:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Extract version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Compute sha256 of GitHub tarball
        id: sha256
        run: |
          URL="https://github.com/${{ github.repository }}/archive/refs/tags/${GITHUB_REF_NAME}.tar.gz"
          SHA=$(curl -sL "$URL" | sha256sum | awk '{print $1}')
          echo "sha256=$SHA" >> "$GITHUB_OUTPUT"

      - name: Update PKGBUILD version and checksum
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          SHA="${{ steps.sha256.outputs.sha256 }}"
          sed -i "s/^pkgver=.*/pkgver=${VERSION}/" PKGBUILD
          sed -i "s/^pkgrel=.*/pkgrel=1/" PKGBUILD
          sed -i "s/^sha256sums=.*/sha256sums=('${SHA}')/" PKGBUILD

      - name: Update .SRCINFO version and checksum
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          SHA="${{ steps.sha256.outputs.sha256 }}"
          PKGNAME="${{ github.event.repository.name }}"
          sed -i "s/pkgver = .*/pkgver = ${VERSION}/" .SRCINFO
          sed -i "s/pkgrel = .*/pkgrel = 1/" .SRCINFO
          sed -i "s|source = .*|source = ${PKGNAME}-${VERSION}.tar.gz::https://github.com/${{ github.repository }}/archive/refs/tags/v${VERSION}.tar.gz|" .SRCINFO
          sed -i "s/sha256sums = .*/sha256sums = ${SHA}/" .SRCINFO

      - name: Set up SSH for AUR
        env:
          AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}
        run: |
          mkdir -p ~/.ssh
          printf '%s' "$AUR_SSH_KEY" | base64 -d > ~/.ssh/aur
          chmod 600 ~/.ssh/aur
          echo "Key fingerprint: $(ssh-keygen -l -f ~/.ssh/aur)"
          ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts
          # exit 1 = auth OK but interactive shell disabled (expected for AUR)
          # exit 255 = connection/auth failure
          ssh -i ~/.ssh/aur -o StrictHostKeyChecking=no -T aur@aur.archlinux.org || [[ $? -eq 1 ]]

      - name: Clone AUR repo
        env:
          GIT_SSH_COMMAND: ssh -i ~/.ssh/aur -o StrictHostKeyChecking=no
        run: git clone ssh://aur@aur.archlinux.org/${{ github.event.repository.name }}.git /tmp/aur-pkg

      - name: Copy files and push to AUR
        env:
          GIT_SSH_COMMAND: ssh -i ~/.ssh/aur -o StrictHostKeyChecking=no
        run: |
          cp PKGBUILD .SRCINFO turnupd.install /tmp/aur-pkg/
          cd /tmp/aur-pkg
          git config user.name "github-actions"
          git config user.email "github-actions@github.com"
          git add PKGBUILD .SRCINFO turnupd.install
          git commit -m "Update to ${{ github.ref_name }}"
          git push