name: Packages

on:
  workflow_call:
    inputs:
      tag:
        type: string
        required: true
    secrets:
      TAP_GITHUB_TOKEN:
        required: true
      AUR_KEY:
        required: true
      CLOUDSMITH_API_KEY:
        required: true
  workflow_dispatch:
    inputs:
      tag:
        description: The released tag to package, such as v0.1.0
        type: string
        required: true

permissions:
  contents: read

concurrency:
  group: packages
  cancel-in-progress: false

jobs:
  packages:
    name: Binaries, packages and image for ${{ inputs.tag }}
    runs-on: ubuntu-26.04
    permissions:
      contents: write
      packages: write
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.tag }}
          path: src
          fetch-depth: 0
          persist-credentials: false
      # The packaging config comes from the workflow's commit, so a tag cut before it
      # existed can still be packaged.
      - uses: actions/checkout@v7
        with:
          path: tooling
          persist-credentials: false
      - name: The Go the gate tests
        id: go
        run: sed -n 's/^ARG GO_VERSION=/version=/p' tooling/Dockerfile >> "$GITHUB_OUTPUT"
      - uses: actions/setup-go@v7
        with:
          go-version: ${{ steps.go.outputs.version }}
          cache: false
      # The tap, the bucket, the AUR and the image's latest tag each hold one version, so
      # only the latest release updates them.
      - name: Channels holding one version
        id: latest
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ inputs.tag }}
        run: |
          if [ "$(gh release view --repo "$GITHUB_REPOSITORY" --json tagName --jq .tagName)" = "$TAG" ]; then
            echo "skip=" >> "$GITHUB_OUTPUT"
          else
            echo "skip=--skip=homebrew,scoop,aur,docker" >> "$GITHUB_OUTPUT"
          fi
      - uses: docker/setup-buildx-action@v4
      - uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: goreleaser/goreleaser-action@v7
        with:
          version: v2.18.3
          workdir: src
          args: release --clean --config ../tooling/release-tooling/goreleaser.yaml ${{ steps.latest.outputs.skip }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
          AUR_KEY: ${{ secrets.AUR_KEY }}
      - name: Upload to the Cloudsmith repositories
        env:
          CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
        run: |
          pip install --quiet cloudsmith-cli==1.27.0
          for f in dist/*.deb; do cloudsmith push deb --republish larvit/fejkdata/any-distro/any-version "$f"; done
          for f in dist/*.rpm; do cloudsmith push rpm --republish larvit/fejkdata/any-distro/any-version "$f"; done
          for f in dist/*.apk; do cloudsmith push alpine --republish larvit/fejkdata/alpine/any-version "$f"; done
      - name: The built binary and the published image print the tag
        env:
          TAG: ${{ inputs.tag }}
          IMAGE: ${{ steps.latest.outputs.skip == '' }}
        run: |
          test "$(dist/fejkdata_linux_amd64_v1/fejkdata --version)" = "fejkdata $TAG"
          if [ "$IMAGE" = true ]; then
            test "$(docker run --rm "ghcr.io/larvit/fejkdata:${TAG#v}" --version)" = "fejkdata $TAG"
          fi