pantry/.github/workflows/bottle.yml

name: bottle

on:
  workflow_call:
    inputs:
      new-version:
        type: boolean
        required: false
        default: false
      platform:
        required: true
        type: string
    outputs:
      pr:
        description: 'The PR number'
        value: ${{ jobs.bottle.outputs.pr }}

jobs:
  get-platform:
    runs-on: ubuntu-latest
    outputs:
      os: ${{ steps.platform.outputs.os }}
      cache-set: ${{ steps.platform.outputs.cache-set }}
    steps:
      - uses: actions/checkout@v3
        with:
          repository: teaxyz/pantry.core
      - uses: actions/cache@v3
        with:
          path: |
            ~/.deno
            ~/.cache/deno            
          key: ${{ runner.os }}-deno-get-platform-${{ hashFiles('deno.jsonc')}}
      - uses: teaxyz/setup@v0
      - run: scripts/get-platform.ts
        id: platform
        env:
          PLATFORM: ${{ inputs.platform }}

  bottle:
    needs: [get-platform]
    runs-on: ${{ fromJson(needs.get-platform.outputs.os) }}
    outputs:
      srcs: ${{ env.srcs }}
      built: ${{ env.built }}
      pr: ${{ env.PR }}
    steps:
      - uses: teaxyz/setup@v0
        id: tea
        with:
          srcroot: null
          prefix: ${{ github.workspace }}

      - uses: actions/cache@v3
        with:
          path: ${{ needs.get-platform.outputs.cache-set }}
          key: ${{ runner.os }}-deno-bottle-${{ hashFiles('tea.xyz/var/pantry/deno.jsonc')}}

      - name: configure scripts PATH
        run: echo "$TEA_PREFIX/tea.xyz/var/pantry/scripts" >> $GITHUB_PATH

      - uses: actions/download-artifact@v3
        if: ${{ inputs.new-version }}
        with:
          name: ${{ inputs.platform }}

      - run: fetch-pr-artifacts.ts ${{ github.repository }} ${{ github.sha }} ${{ inputs.platform }} >>$GITHUB_ENV
        if: ${{ !inputs.new-version }}
        env:
          GITHUB_TOKEN: ${{github.token}}
          AWS_S3_CACHE: ${{ secrets.AWS_S3_CACHE }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

      - run: tar xzvf artifacts.tgz

      - run: |
          for file in built relative-paths srcs; do
            echo "$file=$(cat $file)" >>$GITHUB_ENV
          done          

      - uses: actions/checkout@v3
        if: startsWith(inputs.platform, 'darwin+')
        with:
          path: pantry
          repository: teaxyz/pantry.core
      - uses: ./pantry/.github/actions/apple-signing
        if: startsWith(inputs.platform, 'darwin+')
        with:
            p12-file-base64: ${{ secrets.APPLE_CERTIFICATE_P12 }}
            p12-password: ${{ secrets.APPLE_CERTIFICATE_P12_PASSWORD }}
            identity: "Developer ID Application: Tea Inc. (7WV56FL599)"
            paths: ${{ env.relative-paths}}

      - run: |
          tea +gnupg.org gpg-agent --daemon || true
          echo $GPG_PRIVATE_KEY | \
            base64 -d | \
            tea +gnupg.org gpg --import --batch --yes          
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

      - run: bottle.ts $built
        id: bottle-xz
        env:
          COMPRESSION: xz
          GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

      - run: bottle.ts $built
        id: bottle-gz
        env:
          COMPRESSION: gz
          GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

      - run: |
          echo ${{ steps.bottle-gz.outputs.bottles }} ${{ steps.bottle-xz.outputs.bottles }} >bottles
          echo ${{ steps.bottle-gz.outputs.checksums }} ${{ steps.bottle-xz.outputs.checksums }} >checksums
          echo ${{ steps.bottle-gz.outputs.signatures }} ${{ steps.bottle-xz.outputs.signatures }} >signatures

          SRCS=$(echo $srcs | tr -d '~')

          tar cf artifacts.tar \
            $SRCS \
            ${{ steps.bottle-gz.outputs.bottles }} \
            ${{ steps.bottle-xz.outputs.bottles }} \
            bottles checksums signatures          

      - name: upload artifacts
        uses: actions/upload-artifact@v3
        with:
          name: ${{ inputs.platform }}-bottles
          path: artifacts.tar
          if-no-files-found: error

  upload:
    needs: [bottle]
    runs-on: ubuntu-latest
    steps:
      - uses: teaxyz/setup@v0
        id: tea
        with:
          srcroot: null
          prefix: ${{ github.workspace }}

      - name: configure scripts PATH
        run: echo "${{ steps.tea.outputs.prefix }}/tea.xyz/var/pantry/scripts" >> $GITHUB_PATH

      - uses: actions/cache@v3
        with:
          path: |
            ~/.deno
            ~/.cache/deno            
          key: ${{ runner.os }}-deno-bottle-${{ hashFiles('tea.xyz/var/pantry/deno.jsonc')}}

      - uses: actions/download-artifact@v3
        with:
          name: ${{ inputs.platform }}-bottles

      - run: |
          tar xvf artifacts.tar

          for file in bottles checksums signatures; do
            echo "$file=$(cat $file)" >>$GITHUB_ENV
          done          

      - name: upload bottles
        id: upload
        run: upload.ts
          --pkgs ${{ needs.bottle.outputs.built }} ${{ needs.bottle.outputs.built }}
          --srcs ${{ needs.bottle.outputs.srcs }} ${{ needs.bottle.outputs.srcs }}
          --bottles $bottles
          --checksums $checksums
          --signatures $signatures
        env:
          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

      - uses: chetan/invalidate-cloudfront-action@v2
        env:
          PATHS: ${{ steps.upload.outputs.cf-invalidation-paths }}
          DISTRIBUTION: ${{ secrets.AWS_CF_DISTRIBUTION_ID }}
          AWS_REGION: us-east-1
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

  complain:
    needs: [upload]
    if: inputs.new-version == 'true' && failure()
    uses: ./.github/workflows/complain.yml
    with:
      projects: ${{ inputs.projects }}
      platform: ${{ inputs.platform }}
    secrets: inherit