name: Update AUR Package

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

jobs:
  aur-sync:
    name: Sync PKGBUILD with release
    runs-on: ubuntu-latest
    container:
      image: archlinux:latest
    defaults:
      run:
        shell: bash
    env:
      AUR_REPO: ssh://aur@aur.archlinux.org/noctalia-shell.git
      GIT_SSH_COMMAND: ssh -i /root/.ssh/id_aur -o StrictHostKeyChecking=yes -o IdentitiesOnly=yes -o ServerAliveInterval=15 -o ServerAliveCountMax=4
      PKGNAME: noctalia-shell
      AUR_LINK: https://aur.archlinux.org/packages/noctalia-shell

    steps:
      - name: Install dependencies
        run: |
          set -euo pipefail
          pacman -Syu --noconfirm git base-devel pacman-contrib openssh

      - name: Create build user
        run: |
          set -euo pipefail
          useradd -m builduser
          echo 'builduser ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers

      - name: Configure SSH
        env:
          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
        run: |
          set -euo pipefail
          mkdir -p /root/.ssh
          chmod 700 /root/.ssh
          printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > /root/.ssh/id_aur
          chmod 600 /root/.ssh/id_aur
          ssh-keyscan aur.archlinux.org >> /root/.ssh/known_hosts
          chmod 600 /root/.ssh/known_hosts

      - name: Determine version
        id: vars
        env:
          TAG_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          PKGVER="${TAG_NAME#v}"
          echo "pkgver=$PKGVER" >> "$GITHUB_OUTPUT"

      - name: Clone AUR repository
        run: |
          set -euo pipefail
          git clone "$AUR_REPO" "$GITHUB_WORKSPACE/aur"

      - name: Update PKGBUILD
        env:
          PKGVER: ${{ steps.vars.outputs.pkgver }}
        working-directory: ${{ github.workspace }}/aur
        run: |
          set -euo pipefail
          sed -i "s/^pkgver=.*/pkgver=${PKGVER}/" PKGBUILD
          sed -i "s/^pkgrel=.*/pkgrel=1/" PKGBUILD

      - name: Refresh checksums and metadata
        env:
          AUR_DIR: ${{ github.workspace }}/aur
        run: |
          set -euo pipefail
          chown -R builduser:builduser "$AUR_DIR"
          su - builduser -c "cd $AUR_DIR && updpkgsums"
          su - builduser -c "cd $AUR_DIR && makepkg --printsrcinfo > .SRCINFO"

      - name: Commit and push changes
        env:
          PKGVER: ${{ steps.vars.outputs.pkgver }}
        working-directory: ${{ github.workspace }}/aur
        run: |
          set -euo pipefail
          git config --global --add safe.directory "$PWD"
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          if [[ -n "$(git status --porcelain)" ]]; then
            git add PKGBUILD .SRCINFO
            git commit -m "chore(package): release ${PKGVER}"
            git push origin HEAD
          else
            echo "No updates necessary."
          fi

      - name: Summarize update
        env:
          PKGNAME: noctalia-shell
          PKGVER: ${{ steps.vars.outputs.pkgver }}
          AUR_LINK: https://aur.archlinux.org/packages/noctalia-shell
        run: |
          set -euo pipefail
          {
            echo "## AUR Update"
            echo ""
            echo "- Package: ${PKGNAME}"
            echo "- Updated version: ${PKGVER}"
            echo "- AUR page: ${AUR_LINK}"
          } >> "$GITHUB_STEP_SUMMARY"