cd-deploy-apt.yml

name: 'CD: APT Repository'
run-name: "APT update (${{ inputs.channel || 'stable' }}) — ${{ github.event.release.tag_name || inputs.tag || 'latest' }}"

on:
  release:
    types: [released]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag (empty = latest stable)'
        required: false
        type: string
      channel:
        description: 'APT channel to update'
        required: false
        type: choice
        default: stable
        options: [stable, nightly]
  workflow_call:
    inputs:
      tag:
        description: 'Release tag'
        required: true
        type: string
      channel:
        description: 'APT channel: stable or nightly'
        required: false
        type: string
        default: stable

permissions: read-all

concurrency:
  group: cd-deploy-apt-${{ inputs.channel || 'stable' }}
  cancel-in-progress: false

jobs:
  update-apt-repo:
    name: Update APT Repository (${{ inputs.channel || 'stable' }})
    runs-on: ubuntu-24.04
    timeout-minutes: 20

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
        with:
          egress-policy: audit

      - name: Determine tag and channel
        id: tag
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          # release event is always stable; workflow_call/dispatch use inputs
          if [[ "${{ github.event_name }}" == "release" ]]; then
            TAG="${{ github.event.release.tag_name }}"
            CHANNEL="stable"
          elif [[ -n "${{ inputs.tag }}" ]]; then
            TAG="${{ inputs.tag }}"
            CHANNEL="${{ inputs.channel || 'stable' }}"
          else
            TAG=$(gh release list --repo "${{ github.repository }}" \
              --exclude-pre-releases \
              --limit 1 --json tagName -q '.[0].tagName')
            CHANNEL="stable"
          fi

          echo "tag=$TAG"     >> "$GITHUB_OUTPUT"
          echo "channel=$CHANNEL" >> "$GITHUB_OUTPUT"
          echo "Using tag: $TAG  channel: $CHANNEL"

      - name: Install tools
        run: sudo apt-get install -y --no-install-recommends dpkg-dev apt-utils knockd rsync

      - name: Download .deb from release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          TAG="${{ steps.tag.outputs.tag }}"
          mkdir -p pool/main/b/bambu-studio
          gh release download "$TAG" \
            --repo "${{ github.repository }}" \
            --pattern "bambustudio_*_amd64.deb" \
            --dir pool/main/b/bambu-studio/ \
            --clobber
          ls -lh pool/main/b/bambu-studio/
          [ -n "$(ls pool/main/b/bambu-studio/*.deb 2>/dev/null)" ] || \
            { echo "ERROR: no bambustudio .deb found in release $TAG" >&2; exit 1; }

      - name: Generate Packages index
        run: |
          set -euo pipefail
          CHANNEL="${{ steps.tag.outputs.channel }}"
          mkdir -p "dists/${CHANNEL}/main/binary-amd64"
          dpkg-scanpackages pool/ \
            > "dists/${CHANNEL}/main/binary-amd64/Packages"
          gzip  -k -f "dists/${CHANNEL}/main/binary-amd64/Packages"
          bzip2 -k -f "dists/${CHANNEL}/main/binary-amd64/Packages"
          echo "Packages: $(wc -l < "dists/${CHANNEL}/main/binary-amd64/Packages") lines"

      - name: Generate Release file
        run: |
          set -euo pipefail
          CHANNEL="${{ steps.tag.outputs.channel }}"
          if [[ "$CHANNEL" == "nightly" ]]; then
            DESCRIPTION="BenJule BambuStudio APT Repository — Nightly Channel"
          else
            DESCRIPTION="BenJule BambuStudio APT Repository"
          fi
          apt-ftparchive \
            -o APT::FTPArchive::Release::Origin="BenJule BambuStudio" \
            -o APT::FTPArchive::Release::Label="BenJule BambuStudio" \
            -o "APT::FTPArchive::Release::Suite=${CHANNEL}" \
            -o "APT::FTPArchive::Release::Codename=${CHANNEL}" \
            -o APT::FTPArchive::Release::Architectures=amd64 \
            -o APT::FTPArchive::Release::Components=main \
            -o "APT::FTPArchive::Release::Description=${DESCRIPTION}" \
            release "dists/${CHANNEL}" \
            > "dists/${CHANNEL}/Release"
          cat "dists/${CHANNEL}/Release"

      - name: Sign Release
        run: |
          set -euo pipefail
          CHANNEL="${{ steps.tag.outputs.channel }}"
          echo "${{ secrets.APT_SIGNING_KEY }}" | gpg --batch --import
          gpg --batch --yes \
            --default-key 1726EB3278D7246499B5F2C319BC754BE4AC6B68 \
            --clearsign \
            -o "dists/${CHANNEL}/InRelease" \
            "dists/${CHANNEL}/Release"
          gpg --batch --yes \
            --default-key 1726EB3278D7246499B5F2C319BC754BE4AC6B68 \
            -abs \
            -o "dists/${CHANNEL}/Release.gpg" \
            "dists/${CHANNEL}/Release"

      - name: Setup SSH key
        run: |
          set -euo pipefail
          mkdir -p ~/.ssh
          (umask 077 && printf '%s\n' "${{ secrets.VPS_DEPLOY_KEY }}" > ~/.ssh/deploy_key)
          ssh-keyscan -H "${{ secrets.VPS_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null || true

      - name: Port knock and deploy
        run: |
          set -euo pipefail
          CHANNEL="${{ steps.tag.outputs.channel }}"
          if [[ "$CHANNEL" == "nightly" ]]; then
            DEST="/srv/apt-repo/nightly/"
          else
            DEST="/srv/apt-repo/"
          fi
          knock -d 200 "${{ secrets.VPS_HOST }}" 7000 8000 9000
          sleep 1
          rsync -avz --delete \
            -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=accept-new" \
            pool dists \
            "${{ secrets.VPS_USER }}@${{ secrets.VPS_HOST }}:${DEST}"