.drone.yml

---
kind: pipeline
type: docker
name: Build and check

platform:
  os: linux
  arch: amd64

steps:
  - name: Prepare
    image: archlinux/archlinux:base-devel
    volumes:
      - name: pkgdb
        path: /var/lib/pacman/sync
    commands:
      - source tools/build-env.sh
      - run_nobody tools/prepare-build.sh namcap diffoscope openssh unzip

  - name: Generate package list
    image: archlinux/archlinux:base-devel
    commands:
      - source tools/build-env.sh
      - run_nobody tools/gen-packagelist.sh
    when:
      ref:
        include:
          - refs/heads/master

  - name: Analyze build scripts
    image: archlinux/archlinux:base-devel
    volumes:
      - name: pkgdb
        path: /var/lib/pacman/sync
    commands:
      - source tools/build-env.sh
      - pacman -Sy && pacman-key --init && pacman -S --noconfirm --needed archlinux-keyring
      - pacman -Syu --noconfirm namcap
      - if [ -n "$PACKAGE" ]; then
        namcap packages/$PACKAGE/PKGBUILD;
        else namcap packages/*/PKGBUILD; fi
    depends_on:
      - Prepare

  - name: Build packages
    image: archlinux/archlinux:base-devel
    volumes:
      - name: pkgdb
        path: /var/lib/pacman/sync
    environment:
      SRCDEST: /drone/src/.tmp/cache/srcdest
      PKGDEST: /drone/src/out
    commands:
      - source tools/build-env.sh
      - pacman -Sy && pacman-key --init && pacman -S --noconfirm --needed archlinux-keyring && pacman -Syu --noconfirm
      - run_nobody tools/clean-build-all.sh
      - if ls -1 out/*-debug-*$PKGEXT 2>/dev/null 1>&2; then
        mv out/*-debug-*$PKGEXT out-debug/; fi
    depends_on:
      - Prepare

  - name: List built packages
    image: alpine
    pull: if-not-exists
    commands:
      - ls -1 out/
      - ls -1 out-debug/
    depends_on:
      - Build packages
    when:
      status:
        - success
        - failure

  - name: Analyze built packages
    image: archlinux/archlinux:base-devel
    volumes:
      - name: pkgdb
        path: /var/lib/pacman/sync
    commands:
      - source tools/build-env.sh
      - pacman -Sy && pacman-key --init && pacman -S --noconfirm --needed archlinux-keyring
      - pacman -Syu --noconfirm namcap
      - cd out
      - if ls -1 *$PKGEXT 2>/dev/null 1>&2; then namcap *$PKGEXT; fi
    depends_on:
      - Build packages
    when:
      status:
        - success
        - failure

  - name: Reproduce packages
    image: archlinux/archlinux:base-devel
    volumes:
      - name: pkgdb
        path: /var/lib/pacman/sync
    environment:
      SRCDEST: /drone/src/.tmp/cache/srcdest
      PKGDEST: /drone/src/out2
    commands:
      - sleep 9 # backoff to prevent false positives
      - source ./tools/build-env.sh
      - pacman -Sy && pacman-key --init && pacman -S --noconfirm --needed archlinux-keyring && pacman -Syu --noconfirm
      - run_nobody tools/clean-build-all.sh
    depends_on:
      - Prepare

  - name: Check reproduced checksums
    image: archlinux/archlinux:base-devel
    commands:
      - source ./tools/build-env.sh
      - run_nobody ./tools/compare-checksums.sh
    depends_on:
      - Build packages
      - Reproduce packages
    when:
      status:
        - success
        - failure

  - name: Analyze reproduced packages
    image: archlinux/archlinux:base-devel
    volumes:
      - name: pkgdb
        path: /var/lib/pacman/sync
    commands:
      - source tools/build-env.sh
      - pacman -Sy && pacman-key --init && pacman -S --noconfirm --needed archlinux-keyring
      - pacman -Syu --noconfirm diffoscope unzip
      - run_nobody ./tools/diff-packages.sh
    depends_on:
      - Build packages
      - Reproduce packages
    when:
      status:
        - success
        - failure

  - name: Sign packages
    image: plugins/gpgsign
    pull: if-not-exists
    settings:
      key:
        from_secret: pkgsignkey
      passphrase:
        from_secret: pkgsignkey-pass
      files:
        - out/*.pkg.tar.*
        - out-debug/*.pkg.tar.*
      armor: false
      detach_sign: true
    depends_on:
      - Build packages
    when:
      ref:
        include:
          - refs/heads/master

  - name: Update db
    image: archlinux/archlinux:base-devel
    volumes:
      - name: pkgdb
        path: /var/lib/pacman/sync
    commands:
      - source tools/build-env.sh
      - tools/update-db.sh
    depends_on:
      - Sign packages
      - Generate package list
    when:
      ref:
        include:
          - refs/heads/master

  - name: Publish
    image: appleboy/drone-scp
    pull: if-not-exists
    settings:
      host: arch.osamc.de
      user: aiwahpoo
      key:
        from_secret: ssh-key
      source: out
      target: /var/www/virtual/aiwahpoo/html/proaudio/x86_64
      strip_components: 1
      overwrite: true
    depends_on:
      - Update db
    when:
      ref:
        include:
          - refs/heads/master

  - name: Publish debug packages
    image: appleboy/drone-scp
    pull: if-not-exists
    settings:
      host: arch.osamc.de
      user: aiwahpoo
      key:
        from_secret: ssh-key
      source: out-debug
      target: /var/www/virtual/aiwahpoo/html/debug-archive
      strip_components: 1
      overwrite: true
    depends_on:
      - Sign packages
    when:
      ref:
        include:
          - refs/heads/master

  - name: Push to AUR
    image: archlinux/archlinux:base-devel
    volumes:
      - name: pkgdb
        path: /var/lib/pacman/sync
    environment:
      SSH_KEY:
        from_secret: ssh-key
    commands:
      - source tools/build-env.sh
      - pacman -Sy && pacman-key --init && pacman -S --noconfirm --needed archlinux-keyring
      - pacman -Syu --noconfirm git openssh
      - echo "$${SSH_KEY}" > aur/.ssh/id_osamc
      - cp -a aur/.ssh /root && chmod 600 /root/.ssh/*
      - tools/push-aur.sh
      - rm -rf /root/.ssh
    depends_on:
      - Build packages
    when:
      ref:
        include:
          - refs/heads/master

# a shared package cache should be provided by the CI runner under $DRONE_CACHE
volumes:
  - name: pkgdb
    temp: {}

trigger:
  event:
    exclude:
      - cron
  ref:
    include:
      - refs/heads/master
      - refs/pull/**

---
kind: pipeline
type: docker
name: Build arm64

# makepkg -A will attempt building even if aarch64 is missing in PKGBUILD

platform:
  os: linux
  arch: arm64

steps:
  - name: Prepare
    image: lopsided/archlinux-arm64v8:devel
    volumes:
      - name: pkgdb
        path: /var/lib/pacman/sync
    failure: ignore # arm64 is not critical for now
    environment:
      PKGDEST: /drone/src/out
      MAKEPKG_ARGS: -A
    commands:
      - source tools/build-env.sh
      - run_nobody tools/prepare-build.sh

  - name: Generate package list
    image: lopsided/archlinux-arm64v8:devel
    commands:
      - source tools/build-env.sh
      - run_nobody tools/gen-packagelist.sh
    when:
      ref:
        include:
          - refs/heads/master

  - name: Build packages
    image: lopsided/archlinux-arm64v8:devel
    volumes:
      - name: pkgdb
        path: /var/lib/pacman/sync
    environment:
      PKGDEST: /drone/src/out
      SRCDEST: /drone/src/.tmp/cache/srcdest
      MAKEPKG_ARGS: -A
    commands:
      - source tools/build-env.sh
      - pacman -Sy && pacman-key --init && pacman -S --noconfirm --needed archlinux-keyring && pacman -Syu --noconfirm
      - run_nobody tools/clean-build-all.sh
      - if ls -1 out/*-debug-*$PKGEXT 2>/dev/null 1>&2; then
        mv out/*-debug-*$PKGEXT out-debug/; fi
    depends_on:
      - Prepare

  - name: List built packages
    image: alpine
    pull: if-not-exists
    commands:
      - ls -1 out/
      - ls -1 out-debug/
    depends_on:
      - Build packages
    when:
      status:
        - success
        - failure

  - name: Sign packages
    image: plugins/gpgsign
    pull: if-not-exists
    settings:
      key:
        from_secret: pkgsignkey
      passphrase:
        from_secret: pkgsignkey-pass
      files:
        - out/*.pkg.tar.*
        - out-debug/*.pkg.tar.*
      armor: false
      detach_sign: true
    depends_on:
      - Build packages
    when:
      ref:
        include:
          - refs/heads/master
      status:
        - success
        - failure

  - name: Update db
    image: lopsided/archlinux-arm64v8:devel
    commands:
      - source tools/build-env.sh
      - tools/update-db.sh
    depends_on:
      - Sign packages
      - Generate package list
    when:
      ref:
        include:
          - refs/heads/master

  - name: Publish
    image: appleboy/drone-scp
    pull: if-not-exists
    settings:
      host: arch.osamc.de
      user: aiwahpoo
      key:
        from_secret: ssh-key
      source: out
      target: /var/www/virtual/aiwahpoo/html/proaudio/aarch64
      strip_components: 1
      overwrite: true
    depends_on:
      - Update db
    when:
      ref:
        include:
          - refs/heads/master

  - name: Publish debug packages
    image: appleboy/drone-scp
    pull: if-not-exists
    settings:
      host: arch.osamc.de
      user: aiwahpoo
      key:
        from_secret: ssh-key
      source: out-debug
      target: /var/www/virtual/aiwahpoo/html/debug-archive
      strip_components: 1
      overwrite: true
    depends_on:
      - Sign packages
    when:
      ref:
        include:
          - refs/heads/master

# a shared package cache should be provided by the CI runner under $DRONE_CACHE
volumes:
  - name: pkgdb
    temp: {}

trigger:
  event:
    exclude:
      - cron
  ref:
    include:
      - refs/heads/master
      - refs/pull/**

---
kind: pipeline
type: docker
name: Website

steps:
  - name: Fetch databases
    image: archlinux/archlinux:base-devel
    commands:
      - for ARCH in x86_64 aarch64; do
        mkdir -p .tmp/db/$ARCH &&
        curl https://arch.osamc.de/proaudio/$ARCH/proaudio.files.tar.gz |
        bsdtar -xC .tmp/db/$ARCH; done
    when:
      status:
        - success
        - failure

  - name: Build site
    image: klakegg/hugo:busybox
    commands:
      - hugo

  - name: Publish
    image: appleboy/drone-scp
    pull: if-not-exists
    settings:
      host: arch.osamc.de
      user: aiwahpoo
      key:
        from_secret: ssh-key
      source: .tmp/public
      target: /var/www/virtual/aiwahpoo/html
      strip_components: 2
      overwrite: true
    when:
      ref:
        include:
          - refs/heads/master

depends_on:
  - Build and check
  - Build arm64

trigger:
  event:
    exclude:
      - cron
  ref:
    include:
      - refs/heads/master
      - refs/pull/**

when:
  status:
    - success
    - failure

---
kind: pipeline
name: Send notification

steps:
  - name: Notify Matrix chat
    image: spotlightkid/drone-matrixchat-notify
    pull: if-not-exists
    settings:
      homeserver: "https://sonoj.org"
      roomid: "!WYagUGTylkAMKoxcVa:sonoj.org"
      userid: "@arch-bot:sonoj.org"
      accesstoken:
        from_secret: matrix-bot-token
      deviceid: "HOFQKIPDQE"
      template: |
        CI pipeline `${DRONE_REPO}` build #${DRONE_BUILD_NUMBER} status: **${DRONE_BUILD_STATUS}**

        Build logs: [#${DRONE_BUILD_NUMBER}](${DRONE_BUILD_LINK})

        PR: [#${DRONE_PULL_REQUEST} ${DRONE_PULL_REQUEST_TITLE}](${DRONE_COMMIT_LINK}) by *${DRONE_COMMIT_AUTHOR}*

        ```
        ${DRONE_COMMIT_MESSAGE}
        ```
      markdown: "yes"

depends_on:
  - Build and check
  - Build arm64
  - Website

trigger:
  event:
    exclude:
      - cron
  ref:
    include:
      - refs/heads/master
      - refs/pull/**
  status:
    - success
    - failure

---
kind: pipeline
name: Nvchecker

platform:
  os: linux
  arch: amd64

steps:
  - name: Get GitHub token
    image: rssnyder/drone-github-app
    pull: if-not-exists
    settings:
      app_id:
        from_secret: gh-app-id
      installation:
        from_secret: gh-app-install
      pem:
        from_secret: gh-app-privkey
      token_file: .github-token
  - name: Run nvchecker
    image: archlinux/archlinux:base-devel
    volumes:
      - name: pkgdb
        path: /var/lib/pacman/sync
    commands:
      - source tools/build-env.sh
      - pacman -Sy && pacman-key --init && pacman -S --noconfirm --needed archlinux-keyring git nvchecker python-jq python-packaging
      - |
        cat > nvchecker/keyfile.toml << __EOF__
        [keys]
        github = "$(cat .github-token)"
        __EOF__
      - nvchecker/gen-config.sh
      - nvchecker -c nvchecker/archlinux-proaudio.toml
  - name: Create PRs
    image: archlinux/archlinux:base-devel
    volumes:
      - name: pkgdb
        path: /var/lib/pacman/sync
    commands:
      - source tools/build-env.sh
      - pacman -Sy && pacman-key --init && pacman -S --noconfirm --needed archlinux-keyring git github-cli jq nvchecker pacman-contrib
      - export GITHUB_TOKEN="$(cat .github-token)"
      - gh auth setup-git
      - nvchecker/nvpr.sh

trigger:
  event:
    - cron
  cron:
    - nvchecker