strategy:
      fail-fast: false
      matrix:
        pkg-type:
          - src

    steps:
      - uses: actions/checkout@v4

      - name: Setup Python Tools Scripts
        uses: ./.github/actions/setup-python-tools-scripts
        with:
          cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}

      - name: Download Source Tarball
        uses: actions/download-artifact@v4
        with:
          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
          path: artifacts/pkgs/incoming

      - name: Setup GnuPG
        run: |
          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
          GNUPGHOME="$(mktemp -d -p /run/gpg)"
          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
          cat <<EOF > "${GNUPGHOME}/gpg.conf"
          batch
          no-tty
          pinentry-mode loopback
          EOF

      - name: Get Secrets
        env:
          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
        run: |
          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
            --query SecretString --output text | jq .default_key -r | base64 -d \
            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
            | gpg --import -
          sync
          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
          sync
          rm "$SECRETS_KEY_FILE"
          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"

      - name: Create Repository Path
        run: |
          mkdir -p artifacts/pkgs/repo

      - name: Create Repository
        run: |
          tools pkg repo create src --key-id=<{ gpg_key_id }> <% if gh_environment == 'nightly' -%> --nightly-build-from=${{ github.ref_name }} <%- endif %> \
            --salt-version=${{ needs.prepare-workflow.outputs.salt-version }} \
            --incoming=artifacts/pkgs/incoming --repo-path=artifacts/pkgs/repo

      - name: Copy Files For Source Only Artifact Uploads
        run: |
          mkdir artifacts/src
          find artifacts/pkgs/repo -type f -print -exec cp {} artifacts/src \;

      - name: Upload Standalone Repository As An Artifact
        uses: actions/upload-artifact@v4
        with:
          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-src-repo
          path: |
            artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
            artifacts/src/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz.*
            artifacts/src/*-GPG-*
          retention-days: 7
          if-no-files-found: error

      - name: Upload Repository As An Artifact
        uses: ./.github/actions/upload-artifact
        with:
          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-<{ gh_environment }>-repo-src
          path: artifacts/pkgs/repo/*
          retention-days: 7
          if-no-files-found: error
          archive-name: src-repo