revkit/.github/workflows/deployment.yaml

name: Release .deb
on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Version tag to build (e.g. v0.2.0). Empty = use ref name."
        required: false
        default: ""

permissions:
  contents: write

concurrency:
  # Don't kill a release mid-upload; tags are unique anyway.
  group: deployment-${{ github.ref }}
  cancel-in-progress: false

env:
  THEOS: ${{ github.workspace }}/theos
  IOS_SDK_VERSION: "16.5"
  LDID_VERSION: "v2.1.5-procursus7"

jobs:
  release:
    name: Build & Release
    runs-on: ubuntu-latest
    steps:
      - name: Resolve tag
        id: tag
        run: |
          if [ -n "${{ inputs.tag }}" ]; then
            echo "value=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
          else
            echo "value=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
          fi

      - name: Checkout source at tag
        uses: actions/checkout@v5
        with:
          ref: ${{ steps.tag.outputs.value }}
          submodules: recursive
          fetch-depth: 0


      - name: Install host build tools
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            build-essential curl git make perl xz-utils \
            libplist-utils libc++-dev \
            libtinfo6 libncurses6 \
            python3 python3-pip

      - name: Install ldid
        run: |
          curl -L -o /tmp/ldid \
            "https://github.com/ProcursusTeam/ldid/releases/download/${LDID_VERSION}/ldid_linux_x86_64"
          sudo install -m 0755 /tmp/ldid /usr/local/bin/ldid
          ldid -V 2>&1 | head -1 || true

      - name: Cache Theos
        id: cache-theos
        uses: actions/cache@v4
        with:
          path: theos
          key: theos-linux-${{ env.IOS_SDK_VERSION }}-v1

      - name: Install Theos
        if: steps.cache-theos.outputs.cache-hit != 'true'
        run: |
          [ -d "$THEOS/.git" ] || git clone --recursive https://github.com/theos/theos.git "$THEOS"

          ARCH=$(uname -m)
          curl -fsSL \
            "https://github.com/L1ghtmann/llvm-project/releases/latest/download/iOSToolchain-${ARCH}.tar.xz" \
            | tar xJ -C "$THEOS/toolchain"

          mkdir -p "$THEOS/sdks"
          curl -L -o /tmp/sdk.tar.gz \
            "https://github.com/theos/sdks/archive/master.tar.gz"
          tar -xf /tmp/sdk.tar.gz -C /tmp
          cp -R "/tmp/sdks-master/iPhoneOS${IOS_SDK_VERSION}.sdk" "$THEOS/sdks/"

      - name: Verify Theos
        run: |
          test -d "$THEOS/sdks/iPhoneOS${IOS_SDK_VERSION}.sdk"
          test -x "$THEOS/toolchain/linux/iphone/bin/clang"
          "$THEOS/toolchain/linux/iphone/bin/clang" --version

      # FINALPACKAGE=1 — Theos release-mode switch. Without it Theos builds
      # at -O0 with debug symbols and stamps "+debug" into the .deb name
      # (e.g. *_0.2.0-1+debug_iphoneos-arm64.deb) — fine locally but not
      # what a tagged Release should ship. Release builds get -O3, stripped
      # debug symbols, and no "+debug" suffix on the .deb.
      - name: Build release .deb
        run: |
          make clean
          make package FINALPACKAGE=1
          ls -la packages/

      - name: Stage release assets
        id: assets
        run: |
          mkdir -p dist
          cp packages/*.deb dist/
          ls -la dist/

      - name: Compute SHA256 checksums
        run: |
          cd dist
          sha256sum * > SHA256SUMS
          cat SHA256SUMS

      - name: Extract release notes from CHANGELOG
        id: notes
        run: |
          TAG="${{ steps.tag.outputs.value }}"
          VER="${TAG#v}"
          # Pull the section between `## [<ver>]` and the next `## [`.
          # Falls back to a one-liner if no CHANGELOG entry exists yet.
          if [ -f CHANGELOG.md ]; then
            awk -v ver="$VER" '
              $0 ~ "^## \\[" ver "\\]" { in_section = 1; print; next }
              in_section && /^## \[/ { exit }
              in_section { print }
            ' CHANGELOG.md > release_notes.md
          fi
          if [ ! -s release_notes.md ]; then
            echo "Release ${TAG}." > release_notes.md
          fi
          echo "----- release_notes.md -----"
          cat release_notes.md

      - name: Publish release
        if: env.ACT != 'true'
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.tag.outputs.value }}
          name: ${{ steps.tag.outputs.value }}
          body_path: release_notes.md
          files: |
            dist/*.deb
            dist/SHA256SUMS
          fail_on_unmatched_files: true
          # v1.2.3-beta1 → prerelease, v1.2.3 → stable
          prerelease: ${{ contains(steps.tag.outputs.value, '-') }}