on:
  workflow_call:
    inputs:
      publish:
        required: true
        type: boolean

jobs:
  build:
    permissions:
      contents: read
    runs-on: ${{ case(matrix.env.ARCH == 'arm64', 'ubuntu-24.04-arm', 'ubuntu-latest') }}
    needs: library
    strategy:
      fail-fast: false
      matrix:
        env:
          # NOTE: values are joined by '-' for name of container image, unless `CONTAINER` overrides it
          - { DISTRO: arch, ARCH: amd64 }
          - { DISTRO: centos, ARCH: amd64 }
          - { DISTRO: debian, ARCH: amd64 }
          - { DISTRO: debian, ARCH: amd64, VARIANT: i386 }
          # - { DISTRO: debian, ARCH: amd64, VARIANT: tartan }
          - { DISTRO: debian, ARCH: arm64 }
          - { DISTRO: debian, ARCH: arm64, VARIANT: cross-s390x }
          - { DISTRO: fedora, ARCH: amd64 }
          - { DISTRO: fedora, ARCH: amd64, VARIANT: openssl, CONTAINER: fedora-amd64 }
          - { DISTRO: ubuntu, ARCH: amd64 }
    env: ${{ matrix.env }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Login to GitHub Container Registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Download tarball
        if: matrix.env.DISTRO == 'fedora' || matrix.env.DISTRO == 'centos'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        id: download
        with:
          name: tarball
      - name: Build in container
        env:
          CI_NETWORK: true
          VERSION: ${{ needs.library.outputs.version }}
        run: |
          docker run --privileged -t \
              -e "CI=$CI" \
              -e "CI_NETWORK=$CI_NETWORK" \
              -e "VARIANT=$VARIANT" \
              -e "VERSION=$VERSION" \
              -v "$GITHUB_WORKSPACE:/github/workspace" \
              "ghcr.io/fwupd/fwupd/fwupd-${{ matrix.env.CONTAINER || join(matrix.env.*, '-') }}:latest" \
              "./contrib/ci/$DISTRO${VARIANT:+-$VARIANT}.sh"
      - name: Save any applicable artifacts
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ join(matrix.env.*, '-') }}
          path: |
            ${{ github.workspace }}/build/meson-logs/scanbuild/*
            ${{ github.workspace }}/dist/*
          if-no-files-found: ignore
      - name: Check if tests supported
        id: supported
        run: |
          if [ -x "./contrib/ci/$DISTRO${VARIANT:+-$VARIANT}-test.sh" ]; then
            echo "supported=true" >> $GITHUB_OUTPUT
          else
            echo "supported=false" >> $GITHUB_OUTPUT
          fi
      - name: Test in container
        if: steps.supported.outputs.supported == 'true'
        env:
          CI_NETWORK: true
        run: |
          docker run --privileged -t \
              -e "CI=$CI" \
              -e "CI_NETWORK=$CI_NETWORK" \
              -e "VARIANT=$VARIANT" \
              -e "VERSION=$VERSION" \
              -v "$GITHUB_WORKSPACE:/github/workspace" \
              "ghcr.io/fwupd/fwupd/fwupd-${{ matrix.env.CONTAINER || join(matrix.env.*, '-') }}:latest" \
              "./contrib/ci/$DISTRO${VARIANT:+-$VARIANT}-test.sh"
      - name: Save any coverage data
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage-${{ join(matrix.env.*, '-') }}
          path: ${{ github.workspace }}/coverage.xml
      - name: Upload to codecov
        if: steps.supported.outputs.supported == 'true' &&
          matrix.env.VARIANT != 'tartan' && (
          matrix.env.DISTRO == 'arch' ||
          matrix.env.DISTRO == 'debian' ||
          matrix.env.DISTRO == 'fedora')
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  openbmc:
    permissions:
      contents: read
    runs-on: ubuntu-22.04
    if: ${{ !inputs.publish }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Refresh dependencies
        run: |
          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
          sudo apt update
      - name: Install dependencies
        run: |
          sudo ./contrib/ci/fwupd_setup_helpers.py install-dependencies -o ubuntu --yes
          sudo ./contrib/ci/fwupd_setup_helpers.py test-meson
      - name: Build
        run: |
          ./contrib/build-openbmc.sh --prefix=/home/runner/.root

  library:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Refresh dependencies
        run: |
          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
          sudo apt update
      - name: Install dependencies
        run: |
          sudo ./contrib/ci/fwupd_setup_helpers.py install-dependencies -o ubuntu --yes
          sudo ./contrib/ci/fwupd_setup_helpers.py test-meson
      - name: Build
        run: |
          meson setup build \
                      -Dbuild=library \
                      -Ddocs=disabled \
                      -Dman=false \
                      -Dauto_features=disabled \
                      -Dtests=false
          ninja -C build dist
      - name: Save version
        id: version
        run: |
          echo "version=$(meson introspect build --projectinfo | jq -r .version)" >> $GITHUB_OUTPUT
      - name: Save tarball
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: tarball
          path: ${{ github.workspace }}/build/meson-dist/*xz

  macos:
    permissions:
      contents: read
    runs-on: macos-latest
    if: ${{ !inputs.publish }}
    steps:
      - name: install dependencies
        run: |
          brew install meson usb.ids gobject-introspection vala gi-docgen
          python3 -m pip install --user jinja2 --break-system-packages
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: configure
        run: ./contrib/ci/build_macos.sh
      - name: build
        run: ninja -C build-macos

  build-windows:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    container:
      image: fedora:42
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: configure
        run: ./contrib/ci/build_windows.sh
      - name: upload-artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: windows
          path: |
            ${{ github.workspace }}/dist/setup/*.msi

  build-freebsd:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    if: ${{ !inputs.publish }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Build
        id: test
        uses: vmactions/freebsd-vm@5a72679103d223925653750faa878a143340fbd0 # v1.5.0
        env:
          CI: true
          CC: gcc
        with:
          usesh: true
          mem: 8192
          sync: rsync
          envs: "CI CC"
          prepare: |
            pkg install -y bash python3 git cmake gcc
          run: |
            ./contrib/ci/fwupd_setup_helpers.py install-dependencies -o freebsd --yes
            ./contrib/setup
            bash -c "source ./venv/bin/activate && build-fwupd"

  publish-docs:
    permissions:
      contents: read
    name: Publish docs
    if: ${{ inputs.publish }}
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Download artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        id: download
        with:
          name: ubuntu-amd64
      - name: Install SSH key
        uses: shimataro/ssh-key-action@87a8f067114a8ce263df83e9ed5c849953548bc3 # v2.8.1
        with:
          key: ${{ secrets.FWUPD_GITHUB_IO_SSH_KEY }}
          name: id_rsa # optional
          known_hosts: unnecessary
          if_key_exists: fail # replace / ignore / fail; optional (defaults to fail)
      - name: Clone docs
        run: |
          cd share/doc/fwupd
          git clone --depth 1 git@github.com:fwupd/fwupd.github.io.git
      - name: Trigger docs deployment
        run: |
          cd share/doc/fwupd/fwupd.github.io
          git config credential.helper 'cache --timeout=120'
          git config user.email "info@fwupd.org"
          git config user.name "Documentation deployment Bot"
          rm -rf *
          cp ../../libfwupd* ../*html . -R
          git add .
          git commit -a --allow-empty -m "Trigger deployment"
          git push git@github.com:fwupd/fwupd.github.io.git

  publish-windows:
    permissions:
      contents: write
    name: Publish Windows binaries
    runs-on: ubuntu-latest
    if: ${{ inputs.publish }}
    needs: build-windows
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Download artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        id: download
        with:
          name: windows
      - name: Upload Binaries to Release
        uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # 2.11.5
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          tag: ${{ github.ref }}
          file_glob: true
          file: fwupd*.msi
