environment:
  APK_REPO: alpine/v3.22/bigbes/x86_64
  BOOTSTRAP_REV: 779ad9f174ea5ab7e755f6df0ec9e5912d67dd16
  BUILD_SUBMITTER: git.sr.ht
  CORE_VER: 0.83.8
  GIT_REF: refs/heads/master
  REPO: sr-ht-spec
  S3_BUCKET: repo
  S3_ENDPOINT: https://s3.bigb.es
image: alpine/edge
packages:
- abuild
- go
- git
- rclone
- sassc
- minify
secrets:
- apk-ci-s3
sources:
- "https://git.srht.bigb.es/~bigbes/sr-ht-spec#8219ede1804c144de2a2f2e42f3f476bff4b622a"
submitter:
  git.sr.ht:
    allow-refs:
    - refs/heads/master
tasks:
- scss: |
    # No apk ships the shared sourcehut SCSS partials, so assemble them the
    # way core.sr.ht's `make install-scss` would: its own scss/ plus the
    # Bootstrap 4 submodule. `make css` runs sassc -I against this tree.
    git clone --depth 1 --branch "$CORE_VER" \
      https://git.sr.ht/~sircmpwn/core.sr.ht /tmp/core
    sudo mkdir -p /usr/share/sourcehut/scss/bootstrap
    sudo cp /tmp/core/scss/*.scss /tmp/core/scss/*.css /usr/share/sourcehut/scss/
    git init -q /tmp/bootstrap
    git -C /tmp/bootstrap remote add origin https://github.com/twbs/bootstrap
    git -C /tmp/bootstrap fetch -q --depth 1 origin "$BOOTSTRAP_REV"
    git -C /tmp/bootstrap checkout -q FETCH_HEAD
    sudo cp -r /tmp/bootstrap/scss /usr/share/sourcehut/scss/bootstrap/scss
- keygen: |
    # abuild insists on signing what it builds, but this key is deliberately
    # throwaway: generated per build, dies with the VM, trusted by nothing.
    # Clients verify against the index instead, which is rebuilt and signed on
    # phoebe by the garage stack's apk-mirror service — it indexes this repo
    # with --allow-untrusted precisely because of this.
    #
    # -i installs the public half into /etc/apk/keys. Without it abuild's own
    # final "update the local repository index" step dies with UNTRUSTED
    # signature, after having built the package perfectly well.
    SUDO=sudo abuild-keygen -a -n -i -q
- version: |
    cd "$REPO"
    ver="0.0.$(git rev-list --count HEAD)"
    sed -i "s/^pkgver=.*/pkgver=$ver/" APKBUILD
    echo "export PKGVER=$ver" >> ~/.buildenv
    echo "building $ver"
- build: |
    cd "$REPO"
    # -d: makedepends are already installed via `packages:` above.
    REPODEST=$HOME/packages abuild -d
    find "$HOME/packages" -name '*.apk'
- publish: |
    set +x   # never echo the S3 credentials into the build log
    . ~/.apk-ci.env
    export RCLONE_CONFIG_GARAGE_TYPE=s3
    export RCLONE_CONFIG_GARAGE_PROVIDER=Other
    export RCLONE_CONFIG_GARAGE_ENDPOINT="$S3_ENDPOINT"
    export RCLONE_CONFIG_GARAGE_REGION=garage
    export RCLONE_CONFIG_GARAGE_FORCE_PATH_STYLE=true
    export RCLONE_CONFIG_GARAGE_ACCESS_KEY_ID="$APK_CI_S3_ACCESS_KEY"
    export RCLONE_CONFIG_GARAGE_SECRET_ACCESS_KEY="$APK_CI_S3_SECRET_KEY"
    set -x
    # Upload only; never delete. Old versions stay so a pinned deployment can
    # always be rebuilt — the same reason the upstream mirror is append-only.
    find "$HOME/packages" -name '*.apk' -print | while read -r f; do
      rclone copyto "$f" "garage:$S3_BUCKET/$APK_REPO/$(basename "$f")"
      echo "uploaded $(basename "$f")"
    done
    echo "published; apk-mirror on phoebe re-indexes within 15 minutes"