cryptomator/.github/workflows/debian.yml

name: Build Debian Package

on:
  workflow_dispatch:
    inputs:
      ref:
        description: 'GitHub Ref (e.g. refs/tags/1.6.16)'
        required: true
      semver:
        description: 'SemVer String (e.g. 1.7.0-beta1)'
        required: true
      ppaver:
        description: 'Base PPA Version String (e.g. 1.6.16+1.7.0~beta1) without -0ppa1'
        required: true
      dput:
        description: 'Upload to PPA'
        required: true
        default: false
        type: boolean

env:
  JAVA_VERSION: 20
  OPENJFX_JMODS_AMD64: 'https://download2.gluonhq.com/openjfx/20.0.1/openjfx-20.0.1_linux-x64_bin-jmods.zip'
  JMODS_AMD64_HASH: '0b244b08354dc5e1b639765fd0858cbc154774e9cb05467c4111b7c63d3b3721'
  OPENJFX_JMODS_AARCH64: 'https://download2.gluonhq.com/openjfx/20.0.1/openjfx-20.0.1_linux-aarch64_bin-jmods.zip'
  JMODS_AARCH64_HASH: '4b0dd30282c067aa07fe840374115b5ec5dcfd8dc479ebd2231dfdb6a518b3b3'

jobs:
  build:
    name: Build Debian Package
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ inputs.ref }}
          fetch-depth: 0
      - id: versions
        name: Get version information
        run: |
          SEM_VER_STR="${{ inputs.semver }}"
          SEM_VER_NUM=`echo ${SEM_VER_STR} | sed -E 's/([0-9]+\.[0-9]+\.[0-9]+).*/\1/'`
          REVCOUNT=`git rev-list --count HEAD`
          echo "semVerStr=${SEM_VER_STR}" >> $GITHUB_OUTPUT
          echo "semVerNum=${SEM_VER_NUM}" >> $GITHUB_OUTPUT
          echo "revNum=${REVCOUNT}" >> $GITHUB_OUTPUT
      - name: Install build tools
        run: |
          sudo add-apt-repository ppa:coffeelibs/openjdk
          sudo apt-get update
          sudo apt-get install debhelper devscripts dput coffeelibs-jdk-19 libgtk2.0-0
      - name: Setup Java
        uses: actions/setup-java@v3
        with:
          distribution: 'zulu'
          java-version: ${{ env.JAVA_VERSION }}
          cache: 'maven'
      - name: Run maven
        run: mvn -B clean package -Pdependency-check,linux -DskipTests
      - name: Download OpenJFX jmods
        id: download-jmods
        run: |
          curl -L ${{ env.OPENJFX_JMODS_AMD64 }} -o openjfx-amd64.zip
          echo "${{ env.JMODS_AMD64_HASH }} openjfx-amd64.zip" | sha256sum -c
          if [ $? != 0 ]; then
            echo "Wrong checksum of JMOD archive downloaded from ${{ env.OPENJFX_JMODS_AMD64 }}.";
            exit 1
          fi
          mkdir -p jmods/amd64
          unzip -j openjfx-amd64.zip \*/javafx.base.jmod \*/javafx.controls.jmod \*/javafx.fxml.jmod \*/javafx.graphics.jmod -d jmods/amd64
          curl -L ${{ env.OPENJFX_JMODS_AARCH64 }} -o openjfx-aarch64.zip
          echo "${{ env.JMODS_AARCH64_HASH }} openjfx-aarch64.zip" | sha256sum -c
          if [ $? != 0 ]; then
            echo "Wrong checksum of JMOD archive downloaded from ${{ env.OPENJFX_JMODS_AARCH64 }}.";
            exit 1
          fi
          mkdir -p jmods/aarch64
          unzip -j openjfx-aarch64.zip \*/javafx.base.jmod \*/javafx.controls.jmod \*/javafx.fxml.jmod \*/javafx.graphics.jmod -d jmods/aarch64
      - name: Ensure major jfx version in pom and in jmods is the same
        run: |
          JMOD_VERSION_AMD64=$(jmod describe jmods/amd64/javafx.base.jmod | head -1)
          JMOD_VERSION_AMD64=${JMOD_VERSION_AMD64#*@}
          JMOD_VERSION_AMD64=${JMOD_VERSION_AMD64%%.*}
          JMOD_VERSION_AARCH64=$(jmod describe jmods/aarch64/javafx.base.jmod | head -1)
          JMOD_VERSION_AARCH64=${JMOD_VERSION_AARCH64#*@}
          JMOD_VERSION_AARCH64=${JMOD_VERSION_AARCH64%%.*}
          POM_JFX_VERSION=$(mvn help:evaluate "-Dexpression=javafx.version" -q -DforceStdout)
          POM_JFX_VERSION=${POM_JFX_VERSION#*@}
          POM_JFX_VERSION=${POM_JFX_VERSION%%.*}

          if [ $POM_JFX_VERSION -ne $JMOD_VERSION_AMD64 ]; then
            >&2 echo "Major JavaFX version in pom.xml (${POM_JFX_VERSION}) != amd64 jmod version (${JMOD_VERSION_AMD64})"
            exit 1
          fi

          if [ $POM_JFX_VERSION -ne $JMOD_VERSION_AARCH64 ]; then
            >&2 echo "Major JavaFX version in pom.xml (${POM_JFX_VERSION}) != aarch64 jmod version (${JMOD_VERSION_AARCH64})"
            exit 1
          fi
      - name: Create orig.tar.gz with common/ libs/ mods/ jmods/
        run: |
          mkdir pkgdir
          cp -r target/libs pkgdir
          cp -r target/mods pkgdir
          cp -r jmods pkgdir
          cp -r dist/linux/common/ pkgdir
          cp target/cryptomator-*.jar pkgdir/mods
          tar -cJf cryptomator_${{ inputs.ppaver }}.orig.tar.xz -C pkgdir .
      - name: Patch and rename pkgdir
        run: |
          cp -r dist/linux/debian/ pkgdir
          export RFC2822_TIMESTAMP=`date --rfc-2822`
          envsubst '${SEMVER_STR} ${VERSION_NUM} ${REVISION_NUM}' < dist/linux/debian/rules > pkgdir/debian/rules
          envsubst '${PPA_VERSION} ${RFC2822_TIMESTAMP}' < dist/linux/debian/changelog > pkgdir/debian/changelog
          find . -name "*.jar" >> pkgdir/debian/source/include-binaries
          mv pkgdir cryptomator_${{ inputs.ppaver }}
        env:
          SEMVER_STR: ${{ steps.versions.outputs.semVerStr }}
          VERSION_NUM: ${{ steps.versions.outputs.semVerNum }}
          REVISION_NUM: ${{ steps.versions.outputs.revNum }}
          PPA_VERSION: ${{ inputs.ppaver }}-0ppa1
      - name: Prepare GPG-Agent for signing with key 615D449FE6E6A235
        run: |
          echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import
          echo "${GPG_PASSPHRASE}" | gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --dry-run --sign README.md
        env:
          GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
          GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
      - name: debuild
        run: |
          debuild -S -sa -d
          debuild -b -sa -d
        env:
          DEBSIGN_PROGRAM: gpg --batch --pinentry-mode loopback
          DEBSIGN_KEYID: 615D449FE6E6A235
        working-directory: cryptomator_${{ inputs.ppaver }}
      - name: Create detached GPG signatures
        run: |
          gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a cryptomator_*_amd64.deb
      - name: Upload artifacts
        uses: actions/upload-artifact@v3
        with:
          name: linux-deb-package
          path: |
            cryptomator_*.dsc
            cryptomator_*.orig.tar.xz
            cryptomator_*.debian.tar.xz
            cryptomator_*_source.buildinfo
            cryptomator_*_source.changes
            cryptomator_*_amd64.deb
            cryptomator_*.asc
      - name: Publish on PPA
        if: inputs.dput
        run: dput ppa:sebastian-stenzel/cryptomator-beta cryptomator_*_source.changes
      
      # If ref is a tag, also upload to GitHub Releases:
      - name: Determine tag name
        if: startsWith(inputs.ref, 'refs/tags/')
        run: |
          REF=${{ inputs.ref }}
          echo "TAG_NAME=${REF##*/}" >> $GITHUB_ENV
      - name: Publish Debian package on GitHub Releases
        if: startsWith(inputs.ref, 'refs/tags/')
        env:
          GITHUB_TOKEN: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
        run: |
          artifacts=$(ls | grep cryptomator*.deb)
          gh release upload ${{ env.TAG_NAME }} $artifacts