name: DEB build armhf

on:
  release:
    types: [published]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  ci:
    permissions:
      contents: write
      id-token: write
      attestations: write
    name: "${{ matrix.target }}"
    strategy:
      matrix:
        target:
          - ubuntu-latest
    runs-on: ${{ matrix.target }}
    steps:
    - uses: actions/checkout@v7
    - name: env
      run: |
       pwd
       echo "RELEASE=$(cat RELEASE)" >> $GITHUB_ENV
       echo "VERSION=$(date +%y%m%d%H%M%S)" >> $GITHUB_ENV
    - name: Linux libraries
      run: |
       sudo apt update
       sudo dpkg --add-architecture armhf
       echo "Types: deb" > ~/ubuntu.sources
       echo "URIs: http://archive.ubuntu.com/ubuntu/" >> ~/ubuntu.sources 
       echo "Suites: noble noble-updates noble-backports" >> ~/ubuntu.sources 
       echo "Components: main restricted universe multiverse" >> ~/ubuntu.sources 
       echo "Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" >> ~/ubuntu.sources 
       echo "Architectures: amd64" >> ~/ubuntu.sources 
       echo "" >> ~/ubuntu.sources 
       echo "Types: deb" >> ~/ubuntu.sources 
       echo "URIs: http://security.ubuntu.com/ubuntu/" >> ~/ubuntu.sources 
       echo "Suites: noble-security" >> ~/ubuntu.sources 
       echo "Components: main restricted universe multiverse" >> ~/ubuntu.sources 
       echo "Architectures: amd64" >> ~/ubuntu.sources 
       echo "Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" >> ~/ubuntu.sources 
       echo "" >> ~/ubuntu.sources 
       echo "Types: deb" >>~/ubuntu.sources 
       echo "URIs: http://ports.ubuntu.com/ubuntu-ports/" >>~/ubuntu.sources
       echo "Suites: noble noble-updates" >>~/ubuntu.sources
       echo "Components: main restricted universe multiverse" >>~/ubuntu.sources
       echo "Architectures: armhf" >>~/ubuntu.sources
       echo "Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg" >>~/ubuntu.sources
       sudo cp ~/ubuntu.sources /etc/apt/sources.list.d/ubuntu.sources
       sudo apt update
       sudo apt install libssl3t64:armhf openssl:armhf libssl-dev:armhf libpam0g:armhf libpam0g-dev:armhf libpcre2-dev:armhf rpm crossbuild-essential-armhf build-essential debhelper
    - name: configure deb env
      run: |
       mkdir ~/debian
       mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
       tar -czf ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz --transform "s,^,3proxy-$RELEASE/," .
       ln -s ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/rpmbuild/SOURCES/$RELEASE.tar.gz
       cp scripts/rh/3proxy.spec ~/rpmbuild/SPECS/3proxy-$RELEASE.spec
       cp ~/rpmbuild/SOURCES/3proxy-$RELEASE.tar.gz ~/debian/3proxy_$RELEASE.orig.tar.gz
    - name: debbuild
      run: |
        ret=`pwd`
        cd ~/debian/
        tar xzf 3proxy_$RELEASE.orig.tar.gz
        cd 3proxy-$RELEASE
        echo "3proxy ($RELEASE-$VERSION) buster; urgency=medium" >debian/changelog
        echo " " >>debian/changelog
        echo "  *3proxy $RELEASE build" >>debian/changelog
        echo " " >>debian/changelog
        echo " -- z3APA3A <3apa3a@3proxy.org>  "`date "+%a, %d %b %Y %H:%M:%S %z"` >>debian/changelog
        echo "">>debian/changelog
        PATH=/usr/arm-linux-gnueabihf/bin:$PATH
        export PATH=$PATH
        CC=arm-linux-gnueabihf-gcc
        export CC=$CC
        export RPATH=/usr/arm-linux-gnueabihf/lib:$RPATH
        export LD_LIBRARY_PATH=/usr/arm-linux-gnueabihf/lib:$LD_LIBRARY_PATH
        dpkg-buildpackage
        cd $ret
        cp ~/debian/3proxy_$RELEASE-"$VERSION"_armhf.deb ./3proxy-$RELEASE.arm.deb
    - name: Get artifact deb
      uses: actions/upload-artifact@v7
      with:
       name: "3proxy-${{ env.RELEASE }}-arm.deb"
       path: "*.deb"
    - name: Import signing key
      if: github.event_name == 'release'
      env:
       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
      run: |
       if [ -z "$GPG_PRIVATE_KEY" ]; then echo "GPG_PRIVATE_KEY is not set"; exit 1; fi
       mkdir -p ~/.gnupg && chmod 700 ~/.gnupg
       printf 'allow-loopback-pinentry\ndefault-cache-ttl 7200\nmax-cache-ttl 7200\n' > ~/.gnupg/gpg-agent.conf
       gpgconf --kill gpg-agent || true
       printf '%s' "$GPG_PRIVATE_KEY" | gpg --batch --import
       KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/{print $5; exit}')
       echo "GPG_KEYID=$KEYID" >> $GITHUB_ENV
       echo prime > /tmp/prime.txt
       gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
           -u "$KEYID" --detach-sign -o /dev/null /tmp/prime.txt
       rm -f /tmp/prime.txt
    - name: Checksums and detached signatures
      if: github.event_name == 'release'
      env:
       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
      run: |
       sha256sum *.deb > SHA256SUMS-arm
       for f in *.deb SHA256SUMS-arm; do
         gpg --batch --yes --pinentry-mode loopback --passphrase "$GPG_PASSPHRASE" \
             -u "$GPG_KEYID" --armor --detach-sign "$f"
       done
       sha256sum -c SHA256SUMS-arm
       gpg --verify SHA256SUMS-arm.asc SHA256SUMS-arm
    - name: Attest build provenance
      if: github.event_name == 'release'
      uses: actions/attest-build-provenance@v2
      with:
        subject-path: |
          *.deb
    - name: Upload to release
      if: github.event_name == 'release'
      env:
       GH_TOKEN: ${{ github.token }}
       TAG: ${{ github.event.release.tag_name }}
      run: gh release upload "$TAG" *.deb *.deb.asc SHA256SUMS-arm SHA256SUMS-arm.asc