test.yaml

name: Main workflow

on:
  pull_request:
  push:
    branches:
      - main
    tags:
      - 'v*'
  schedule:
    - cron: '17 14 * * *'

jobs:
  dist:
    strategy:
      fail-fast: true

    runs-on: ubuntu-latest

    steps:
      - name: Allow unprivileged user namespaces (for Ubuntu 24.04)
        run: |
          sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y expect mergerfs attr pandoc

      - name: Checkout
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Check autoscan
        run: |
          autoscan | tee autoscan.out
          ! [ -s autoscan.out ]

      - name: Configure and build manpage
        run: |
          autoconf
          ./configure
          make dist

      - name: Upload dist tarball
        uses: actions/upload-artifact@v7
        with:
          name: try-dist.tgz
          path: try-*.tgz

      - name: Package packaging assets
        run: |
          tar czf packaging.tgz packaging

      - name: Upload packaging assets
        uses: actions/upload-artifact@v7
        with:
          name: packaging-assets
          path: packaging.tgz

  package:
    needs: [dist, test-dist]
    runs-on: ubuntu-latest

    steps:
      - name: Install dependencies
        run: |
          sudo apt-get install -y rpm

      - name: Download dist tarball
        uses: actions/download-artifact@v8
        with:
          name: try-dist.tgz

      - name: Download packaging assets
        uses: actions/download-artifact@v8
        with:
          name: packaging-assets

      - name: Unpack tarballs
        run: |
          tar xzf try-*.tgz --strip-components=1
          tar xzf packaging.tgz
          rm -f try-*.tgz packaging.tgz

      - name: Build .deb and .rpm
        run: |
          packaging/build_packages.sh

      - name: Upload packages
        uses: actions/upload-artifact@v7
        with:
          name: try-packages
          path: |
            dist-packages/try*.deb
            dist-packages/try*.rpm

  ppa-source-check:
    needs: [dist, test-dist]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    strategy:
      fail-fast: true
      matrix:
        series: [focal, jammy, noble]

    steps:
      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential debhelper dpkg-dev lintian pandoc attr

      - name: Download dist tarball
        uses: actions/download-artifact@v8
        with:
          name: try-dist.tgz

      - name: Download packaging assets
        uses: actions/download-artifact@v8
        with:
          name: packaging-assets

      - name: Assemble Debian source tree
        env:
          SERIES: ${{ matrix.series }}
        run: |
          tar xzf try-*.tgz
          srcdir=$(echo try-*/)
          version=${srcdir#try-}
          version=${version%/}
          tar --sort=name --owner=0 --group=0 --numeric-owner \
              --mtime='UTC 2020-01-01' -cf - "$srcdir" \
              | gzip -n -9 > "try_${version}.orig.tar.gz"
          tar xzf packaging.tgz
          cp -R packaging/debian "$srcdir/debian"
          rm -f try-*.tgz packaging.tgz

          changelog="$srcdir/debian/changelog"
          committed=$(sed -n '1s/^try (\([^)]*\)).*/\1/p' "$changelog")
          if [ "${committed%-*}" = "$version" ]
          then
              # same upstream version: packaging-only revision, keep the committed one
              revision=${committed##*-}
          else
              # new upstream release: start again at revision 1
              revision=1
              maintainer=$(sed -n 's/^Maintainer: //p' "$srcdir/debian/control")
              {
                  echo "try (${version}-1) UNRELEASED; urgency=medium"
                  echo
                  echo "  * New upstream release ${version}."
                  echo
                  echo " -- ${maintainer}  $(date -R)"
                  echo
                  cat "$changelog"
              } > "$changelog.new"
              mv "$changelog.new" "$changelog"
          fi
          sed -i "1s/^try ([^)]*)/try (${version}-${revision}~${SERIES}1)/" "$changelog"

          sed -i "1s/UNRELEASED/${SERIES}/" "$changelog"
          echo "SRCDIR=$srcdir" >> "$GITHUB_ENV"

      - name: Build the Debian source package
        run: |
          cd "$SRCDIR"
          dpkg-buildpackage -S -us -uc -sa

      - name: Lint the source package
        run: |
          lintian try_*_source.changes

      - name: Upload Debian source package
        uses: actions/upload-artifact@v7
        with:
          name: try-ppa-source-${{ matrix.series }}
          path: |
            try_*.dsc
            try_*.orig.tar.gz
            try_*.debian.tar.xz
            try_*_source.changes
            try_*_source.buildinfo

  test-dist:
    needs: dist
    strategy:
      fail-fast: false

    runs-on: ubuntu-latest
    if: github.event.pull_request.draft == false

    steps:
      - name: Allow unprivileged user namespaces (for Ubuntu 24.04)
        run: |
          sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y expect mergerfs attr pandoc

      - name: Download dist tarball
        uses: actions/download-artifact@v8
        with:
          name: try-dist.tgz

      - name: Unpack tarball; configure and build utilities
        run: |
          tar xzf try-*.tgz --strip-components=1
          rm try-*.tgz
          ./configure --disable-utils
          make all
          sudo make install

      - name: Run tests with shell fallbacks
        run: |
          ! which try-summary
          ! which try-commit
          scripts/run_tests.sh

      - name: Clean up build
        run: |
         sudo make clean

      - name: Install utilities
        run: |
          autoconf
          ./configure
          make all
          sudo make install

      - name: Run tests with utilities
        run: |
          which try-summary
          which try-commit
          scripts/run_tests.sh

      - name: Check manpage
        run: |
          man -w try

  test-checkout:
    strategy:
      fail-fast: false

    runs-on: ubuntu-latest

    steps:
      - name: Allow unprivileged user namespaces (for Ubuntu 24.04)
        run: |
          sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y expect mergerfs attr pandoc

      - name: Checkout
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Configure and build utilities
        run: |
          autoconf
          ./configure --disable-utils
          make all
          sudo make install

      - name: Run tests with shell fallbacks
        run: |
          ! which try-summary
          ! which try-commit
          scripts/run_tests.sh

      - name: Clean up build
        run: |
          sudo make clean

      - name: Install utilities
        run: |
          autoconf
          ./configure
          make all
          sudo make install

      - name: Run tests with utilities
        run: |
          which try-summary
          which try-commit
          scripts/run_tests.sh

      - name: Check manpage
        run: |
          man -w try

  lint:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Run scripts/lint.sh
        run: scripts/lint.sh

  trycase-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Run check_trycase.sh
        run: scripts/check_trycase.sh

  version-check:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Check version consistency (script, manpage, include)
        run: scripts/check_version.sh

  shellcheck:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Run ShellCheck
        uses: ludeeus/action-shellcheck@master
        with:
          ignore_paths: >-
            completions
            ./configure
            ./install-sh

  nix:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Allow unprivileged user namespaces (for Ubuntu 24.04)
        run: |
          sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@main

      - name: Run tests
        run: |
          nix-shell --run "sh scripts/run_tests.sh"

  tag-version-check:
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Check tag against declared versions
        run: scripts/check_version.sh "${GITHUB_REF_NAME#v}"

  smoke-test-deb:
    needs: package
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')

    steps:
      - name: Download packages
        uses: actions/download-artifact@v8
        with:
          name: try-packages

      - name: Install the .deb
        run: |
          sudo apt-get update
          sudo apt-get install -y ./try*.deb

      - name: Check installed version matches the tag
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          # try -v writes to stderr
          INSTALLED="$(try -v 2>&1 | awk '{print $NF}')"
          echo "installed: '$INSTALLED' expected: '$TAG_VERSION'"
          [ "$INSTALLED" = "$TAG_VERSION" ]

      - name: Check manpage is installed
        run: |
          man -w try

  smoke-test-rpm:
    needs: package
    runs-on: ubuntu-latest
    container: fedora:latest
    if: startsWith(github.ref, 'refs/tags/v')

    steps:
      - name: Download packages
        uses: actions/download-artifact@v8
        with:
          name: try-packages

      - name: Install the .rpm
        run: |
          # fedora's container image sets tsflags=nodocs by default, which
          # would silently drop the manpage; override it for this install
          dnf install -y --setopt=tsflags= ./try*.rpm man-db

      - name: Check installed version matches the tag
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          # try -v writes to stderr
          INSTALLED="$(try -v 2>&1 | awk '{print $NF}')"
          echo "installed: '$INSTALLED' expected: '$TAG_VERSION'"
          [ "$INSTALLED" = "$TAG_VERSION" ]

      - name: Check manpage is installed
        run: |
          mandb
          man -w try

  release:
    needs: [tag-version-check, smoke-test-deb, smoke-test-rpm]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: write

    steps:
      - name: Download dist tarball
        uses: actions/download-artifact@v8
        with:
          name: try-dist.tgz

      - name: Download packages
        uses: actions/download-artifact@v8
        with:
          name: try-packages

      - name: Publish release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "$GITHUB_REF_NAME" \
              --repo "$GITHUB_REPOSITORY" \
              --title "$GITHUB_REF_NAME" \
              --generate-notes \
              try-*.tgz ./try*.deb ./try*.rpm

  publish-ppa:
    needs: ppa-source-check
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    environment: ppa-release

    steps:
      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y devscripts dput gnupg openssh-client python3-paramiko

      - name: Download the Debian source packages
        uses: actions/download-artifact@v8
        with:
          pattern: try-ppa-source-*
          merge-multiple: true

      - name: Import GPG signing key
        env:
          GPG_PRIVATE_KEY: ${{ secrets.PPA_GPG_PRIVATE_KEY }}
        run: |
          echo "$GPG_PRIVATE_KEY" | gpg --batch --import
          echo "KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec/ {print $5; exit}')" >> "$GITHUB_ENV"

      - name: Configure SFTP upload to Launchpad
        env:
          SSH_KEY: ${{ secrets.PPA_SSH_KEY }}
          PPA_TARGET: ${{ vars.PPA_TARGET }}
          PPA_LOGIN: ${{ vars.PPA_LOGIN }}
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          echo "$SSH_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan ppa.launchpad.net >> ~/.ssh/known_hosts
          ssh-keygen -lf ~/.ssh/known_hosts

          ppa=${PPA_TARGET#ppa:}
          owner=${ppa%%/*}
          name=${ppa#*/}
          cat > ~/.dput.cf <<EOF
          [ppa-sftp]
          fqdn = ppa.launchpad.net
          method = sftp
          incoming = ~${owner}/ubuntu/${name}/
          login = ${PPA_LOGIN:-$owner}
          allow_unsigned_uploads = 0
          EOF

      - name: Sign and upload to the PPA
        env:
          GPG_PASSPHRASE: ${{ secrets.PPA_GPG_PASSPHRASE }}
        run: |
          echo "$GPG_PASSPHRASE" > /tmp/gpg-passphrase
          failed=""
          for changes in try_*_source.changes
          do
              debsign -k"$KEYID" -p"gpg --batch --yes --pinentry-mode loopback --passphrase-file /tmp/gpg-passphrase" "$changes"
              uploaded=""
              for attempt in 1 2 3 4 5
              do
                  if dput ppa-sftp "$changes"
                  then
                      uploaded=yes
                      break
                  fi
                  echo "upload of $changes failed (attempt $attempt); retrying in 60s"
                  sleep 60
              done
              [ -n "$uploaded" ] || failed="$failed $changes"
              # give Launchpad's upload server time to finish the previous upload
              sleep 30
          done
          rm -f /tmp/gpg-passphrase
          [ -z "$failed" ] || { echo "failed uploads:$failed"; exit 1; }

  prerelease:
    needs:
      - test-checkout
      - test-dist
      - version-check
      - lint
      - shellcheck
      - trycase-check
      - package
    runs-on: ubuntu-latest
    if: ${{ github.ref == 'refs/heads/main' && github.event_name != 'schedule' }}

    steps:
      - name: Download dist tarball
        uses: actions/download-artifact@v8
        with:
          name: try-dist.tgz

      - name: Download packages
        uses: actions/download-artifact@v8
        with:
          name: try-packages

      - name: Rename tarball
        run: |
          mv try-*.tgz try-latest.tgz

      - name: Deploy 'latest' release
        uses: "marvinpinto/action-automatic-releases@latest"
        with:
          repo_token: "${{ secrets.GITHUB_TOKEN }}"
          automatic_release_tag: "latest"
          prerelease: true
          title: "Latest distribution tarball"
          files: |
            try-latest.tgz
            try*.deb
            try*.rpm