name: .deb build orchestrator

on:
  pull_request:
    branches:
      - "**"
  push:
    branches:
      - "**"
    tags:
      - v*

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  source-only:
    permissions:
      id-token: write
      contents: read
      attestations: write
    uses: ./.github/workflows/deb-src.yml
    with:
      runs-on: ubuntu-24.04
    secrets:
      GPG_SECRET_SUBKEYS: ${{ secrets.GPG_SECRET_SUBKEYS }}
      GPG_SIGNING_SUBKEY_FINGERPRINT: ${{ secrets.GPG_SIGNING_SUBKEY_FINGERPRINT }}
  obs:
    needs: source-only
    if: github.event_name != 'pull_request' && (github.ref_type == 'tag' || (github.ref_type == 'branch' && github.ref_name == 'master'))
    uses: ./.github/workflows/obs.yml
    with:
      deb-src-artifact-id: ${{ needs.source-only.outputs.deb-src-artifact-id }}
      runs-on: "ubuntu-24.04"
      arch: amd64
      dist-name: debian
      dist-version: unstable
    secrets:
      GPG_SECRET_SUBKEYS: ${{ secrets.GPG_SECRET_SUBKEYS }}
      GPG_SIGNING_SUBKEY_FINGERPRINT: ${{ secrets.GPG_SIGNING_SUBKEY_FINGERPRINT }}
      GPG_AUTH_SUBKEY_KEYGRIP: ${{ secrets.GPG_AUTH_SUBKEY_KEYGRIP }}
      OBS_SNAPSHOT_REPO_URL: ${{ secrets.OBS_SNAPSHOT_REPO_URL }}
      OBS_RELEASE_REPO_URL: ${{ secrets.OBS_RELEASE_REPO_URL }}
  buildd:
    needs: source-only
    permissions:
      id-token: write
      contents: read
      attestations: write
    strategy:
      fail-fast: false
      matrix:
        stack:
          - { runs-on: "ubuntu-24.04",     machine-arch: "amd64", build-arch: "amd64",   host-arch: "amd64" }
          - { runs-on: "ubuntu-24.04",     machine-arch: "amd64", build-arch: "amd64",   host-arch: "ppc64el" }
          - { runs-on: "ubuntu-24.04-arm", machine-arch: "arm64", build-arch: "arm64",   host-arch: "arm64" }
        dist:
          - { name: debian, version: unstable }
          - { name: debian, version: forky    } # Debian 14
          - { name: debian, version: trixie   } # Debian 13
          - { name: ubuntu, version: questing } # Ubuntu 25.10       (Questing Quokka) Beta
          - { name: ubuntu, version: plucky   } # Ubuntu 25.04       (Plucky Puffin)
        exclude:
          - stack: { runs-on: "ubuntu-24.04",     machine-arch: "amd64", build-arch: "amd64",   host-arch: "ppc64el" }
            dist: { name: ubuntu, version: questing }
            # cross-build broken, package conflicts
          - stack: { runs-on: "ubuntu-24.04",     machine-arch: "amd64", build-arch: "amd64",   host-arch: "ppc64el" }
            dist: { name: ubuntu, version: plucky   }
            # cross-build broken, broken packages
        # # If someone asks for ubuntu ppc64el packages, these can be reenabled:
        # include:
        #   - stack: { runs-on: "ubuntu-24.04",     machine-arch: "amd64", build-arch: "ppc64el", host-arch: "ppc64el" }
        #     dist: { name: ubuntu, version: questing }
        #   - stack: { runs-on: "ubuntu-24.04",     machine-arch: "amd64", build-arch: "ppc64el", host-arch: "ppc64el" }
        #     dist: { name: ubuntu, version: plucky   }
    uses: ./.github/workflows/deb-buildd.yml
    with:
      deb-src-artifact-id: ${{ needs.source-only.outputs.deb-src-artifact-id }}
      runs-on: ${{ matrix.stack.runs-on }}
      machine-arch: ${{ matrix.stack.machine-arch }}
      build-arch: ${{ matrix.stack.build-arch }}
      host-arch: ${{ matrix.stack.host-arch }}
      dist-name: ${{ matrix.dist.name }}
      dist-version: ${{ matrix.dist.version }}
    secrets:
      GPG_SECRET_SUBKEYS: ${{ secrets.GPG_SECRET_SUBKEYS }}
      GPG_SIGNING_SUBKEY_FINGERPRINT: ${{ secrets.GPG_SIGNING_SUBKEY_FINGERPRINT }}
  reprotest:
    needs: source-only
    uses: ./.github/workflows/deb-reprotest.yml
    with:
      deb-src-artifact-id: ${{ needs.source-only.outputs.deb-src-artifact-id }}
      runs-on: "ubuntu-24.04"
      arch: amd64
      dist-name: debian
      dist-version: unstable
    secrets:
      GPG_SECRET_SUBKEYS: ${{ secrets.GPG_SECRET_SUBKEYS }}
      GPG_SIGNING_SUBKEY_FINGERPRINT: ${{ secrets.GPG_SIGNING_SUBKEY_FINGERPRINT }}
  publish:
    needs: [ source-only, buildd, reprotest ]
    if: github.event_name != 'pull_request' && (github.ref_type == 'tag' || (github.ref_type == 'branch' && github.ref_name == 'master'))
    uses: ./.github/workflows/deb-publish.yml
    with:
      runs-on: ubuntu-24.04
    secrets:
      GPG_SECRET_SUBKEYS: ${{ secrets.GPG_SECRET_SUBKEYS }}
      GPG_SIGNING_SUBKEY_FINGERPRINT: ${{ secrets.GPG_SIGNING_SUBKEY_FINGERPRINT }}
      GPG_AUTH_SUBKEY_KEYGRIP: ${{ secrets.GPG_AUTH_SUBKEY_KEYGRIP }}
      SSH_HOST: ${{ secrets.SSH_HOST }}
      SSH_SERVER_KEYS: ${{ secrets.SSH_SERVER_KEYS }}
