name: Debian 13 packages
on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
          submodules: recursive
      - name: Build, test and rebuild all five sources
        shell: bash
        run: |
          set -euo pipefail
          for script in packaging/*.sh packaging/overlays/v1/*.sh; do bash -n "$script"; done
          mkdir -p "$RUNNER_TEMP/debs"
          bash packaging/ci.sh "$RUNNER_TEMP/debs"
          test -z "$(git submodule foreach --quiet --recursive 'git status --porcelain')"
      - name: Upload verified binaries and standalone sources
        uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3 (Gitea artifact protocol)
        with:
          name: debian13-amd64
          path: ${{ runner.temp }}/debs/*
          if-no-files-found: error