salt/.github/workflows/build-onedir-repo.yml

---
name: Build Onedir Repository

on:
  workflow_call:
    inputs:
      salt-version:
        type: string
        required: true
        description: The Salt version to set prior to building packages.
      nightly-build:
        type: boolean
        default: false
      rc-build:
        type: boolean
        default: false
      environment:
        type: string
        description: On which GitHub Environment Context To Run
    secrets:
      SECRETS_KEY:
        required: true

env:
  COLUMNS: 190

jobs:
  build-repo:
    name: Onedir
    environment: ${{ inputs.environment }}
    runs-on:
      - self-hosted
      - linux
      - repo-${{ inputs.environment }}

    steps:
      - uses: actions/checkout@v3

      - name: Setup Python Tools Scripts
        uses: ./.github/actions/setup-python-tools-scripts

      - name: Download Linux x86_64 Onedir Archive
        uses: actions/download-artifact@v3
        with:
          name: salt-${{ inputs.salt-version }}-onedir-linux-x86_64.tar.xz
          path: artifacts/pkgs/incoming

      - name: Download Linux aarch64 Onedir Archive
        uses: actions/download-artifact@v3
        with:
          name: salt-${{ inputs.salt-version }}-onedir-linux-aarch64.tar.xz
          path: artifacts/pkgs/incoming

      - name: Download macOS x86_64 Onedir Archive
        uses: actions/download-artifact@v3
        with:
          name: salt-${{ inputs.salt-version }}-onedir-darwin-x86_64.tar.xz
          path: artifacts/pkgs/incoming

      - name: Download Windows amd64 Onedir Archive
        uses: actions/download-artifact@v3
        with:
          name: salt-${{ inputs.salt-version }}-onedir-windows-amd64.tar.xz
          path: artifacts/pkgs/incoming

      - name: Download Windows amd64 Onedir Archive(zip)
        uses: actions/download-artifact@v3
        with:
          name: salt-${{ inputs.salt-version }}-onedir-windows-amd64.zip
          path: artifacts/pkgs/incoming

      - name: Download Windows x86 Onedir Archive
        uses: actions/download-artifact@v3
        with:
          name: salt-${{ inputs.salt-version }}-onedir-windows-x86.tar.xz
          path: artifacts/pkgs/incoming

      - name: Download Windows amd64 Onedir Archive(zip)
        uses: actions/download-artifact@v3
        with:
          name: salt-${{ inputs.salt-version }}-onedir-windows-x86.zip
          path: artifacts/pkgs/incoming

      - name: Setup GnuPG
        run: |
          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
          GNUPGHOME="$(mktemp -d -p /run/gpg)"
          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
          cat <<EOF > "${GNUPGHOME}/gpg.conf"
          batch
          no-tty
          pinentry-mode loopback
          EOF

      - name: Get Secrets
        env:
          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
        run: |
          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
            --query SecretString --output text | jq .default_key -r | base64 -d \
            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
            | gpg --import -
          sync
          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
          sync
          rm "$SECRETS_KEY_FILE"
          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"

      - name: Create Repository Path
        run: |
          mkdir -p artifacts/pkgs/repo

      - name: Create Repository
        run: |
          tools pkg repo create onedir --key-id=64CBBC8173D76B3F \
            ${{ inputs.nightly-build && '--nightly-build' || ''  }} --salt-version=${{ inputs.salt-version }} \
            ${{ inputs.rc-build && '--rc-build' || ''  }} --incoming=artifacts/pkgs/incoming \
            --repo-path=artifacts/pkgs/repo

      - name: Upload Repository As An Artifact
        uses: ./.github/actions/upload-artifact
        with:
          name: salt-${{ inputs.salt-version }}-${{ inputs.environment }}-repo
          path: artifacts/pkgs/repo/*
          retention-days: 7
          if-no-files-found: error
          archive-name: onedir-repo