name: AUR Publish (fips-git)

on:
  workflow_dispatch:
  push:
    branches:
      - master
    paths:
      - 'packaging/aur/PKGBUILD-git'
      - 'packaging/aur/fips.sysusers'
      - 'packaging/aur/fips.tmpfiles'
      - 'packaging/aur/fips.install'

jobs:
  aur-publish-fips-git:
    name: Publish fips-git to AUR
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - name: Patch PKGBUILD-git b2sums for local assets
        run: |
          set -euo pipefail
          SYSUSERS_SUM=$(b2sum packaging/aur/fips.sysusers | awk '{print $1}')
          TMPFILES_SUM=$(b2sum packaging/aur/fips.tmpfiles | awk '{print $1}')
          if [ -z "$SYSUSERS_SUM" ] || [ -z "$TMPFILES_SUM" ]; then
            echo "Failed to compute asset b2sums"; exit 1
          fi
          awk -v s1="$SYSUSERS_SUM" -v s2="$TMPFILES_SUM" '
            /^b2sums=\(/ { in_block=1; count=0 }
            in_block {
              count++
              if (count == 2) sub(/[a-f0-9]{128}/, s1)
              if (count == 3) sub(/[a-f0-9]{128}/, s2)
              if ($0 ~ /\)/) in_block=0
            }
            { print }
          ' packaging/aur/PKGBUILD-git > packaging/aur/PKGBUILD-git.new
          mv packaging/aur/PKGBUILD-git.new packaging/aur/PKGBUILD-git
          echo "Patched PKGBUILD-git b2sums:"
          awk '/^b2sums=\(/,/\)$/' packaging/aur/PKGBUILD-git

      - name: Publish to AUR
        uses: KSXGitHub/github-actions-deploy-aur@v4.1.2
        with:
          pkgname: fips-git
          pkgbuild: packaging/aur/PKGBUILD-git
          updpkgsums: false
          assets: |
            packaging/aur/fips.sysusers
            packaging/aur/fips.tmpfiles
            packaging/aur/fips.install
          commit_username: ${{ github.repository_owner }}
          commit_email: ${{ secrets.AUR_EMAIL }}
          ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
          commit_message: "Update PKGBUILD-git (${{ github.sha }})"