name: Debian 13 packages
on:
  push:
    branches: [main]
  pull_request:
    paths:
      - 'packaging/**'
      - '.github/**'
      - '.devcontainer/**'
      - '.gitmodules'
      - '.gitignore'
      - 'README.md'
      - 'libg15'
      - 'libg15render'
      - 'g15daemon'
      - 'g15macro'
      - 'g15stats'
  workflow_dispatch:
  release:
    types: [published]

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
          submodules: recursive
      - name: Build and validate in Debian 13
        shell: bash
        run: |
          set -euo pipefail
          for script in packaging/*.sh packaging/overlays/v1/*.sh .devcontainer/*.sh; do bash -n "$script"; done
          # Real devcontainer CLI validation is a separate local check; see README.md.
          docker run --rm -v "$GITHUB_WORKSPACE/.github:/repo/.github:ro" -w /repo \
            rhysd/actionlint@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9 \
            .github/workflows/debian.yml
          mkdir -p "$RUNNER_TEMP/debs"
          bash packaging/run.sh "$RUNNER_TEMP/debs"
          docker run --rm -v "$GITHUB_WORKSPACE/packaging:/checks/packaging:ro" \
            -v "$GITHUB_WORKSPACE/.devcontainer:/checks/.devcontainer:ro" \
            -w /checks g15-packaging bash -c 'shellcheck packaging/*.sh packaging/overlays/v1/*.sh .devcontainer/*.sh'
          test -z "$(git submodule foreach --quiet --recursive 'git status --porcelain')"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: debian13-amd64
          path: ${{ runner.temp }}/debs/*
          if-no-files-found: error

  release:
    if: github.event_name == 'release'
    needs: build
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: debian13-amd64
          path: artifacts
      - name: Attach verified packages and sources
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          cd artifacts
          sha256sum -c SHA256SUMS
          gh release upload "$RELEASE_TAG" -- ./*