build-release.yaml

name: Build Release

permissions:
  contents: write
  id-token: write
  attestations: write
  packages: write

on:
  push:
    tags:
      - '*.*.*'
  pull_request:

jobs:
  packages:
    name: Packages
    if: false
    strategy:
      fail-fast: true
      matrix:
        model: [lx01, lx06, l09a, l09b]
    uses: ./.github/workflows/build-packages.yaml
    with:
      model: ${{ matrix.model }}

  image:
    name: Image
    #needs: [packages]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        model: [lx01, lx06, l09a, l09b]
    env:
      MODEL: ${{ matrix.model }}
      PULL_PACKAGES: false
      UPLOAD_RELEASE: false
    steps:
      - uses: actions/checkout@v4

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Pull base image
        id: base
        env:
          IMAGE: ghcr.io/${{ github.repository }}/${{ matrix.model }}:base
        run: |
          sudo ln -svf $HOME/.docker/config.json /root/.docker/config.json
          sudo make pull MODEL=$MODEL

          VERSION=`docker inspect ${IMAGE} | jq -r '.[0].Config.Labels["org.opencontainers.image.version"]'`
          echo "version=${VERSION}" >> ${GITHUB_OUTPUT}

          # download update file and extract
          UPDATE=`docker inspect ${IMAGE} | jq -r '.[0].Config.Labels["org.opencontainers.image.source"]'`
          echo "::add-mask::${UPDATE}"
          echo "::add-mask::`basename ${UPDATE}`"
          wget -q -O mico_${MODEL}.bin "${UPDATE}"

          ./tools/mico_firmware.py -d mico_${MODEL} -e mico_${MODEL}.bin -i

          # generate links for files
          if [ "$MODEL" = "lx01" ]; then
            ln -svf kernel.img mico_${MODEL}/boot.img
            ln -svf rootfs.img mico_${MODEL}/root.squashfs
          fi

      - name: Pull build packages
        uses: actions/download-artifact@v4
        if: ${{ env.PULL_PACKAGES == 'true' }}
        with:
          name: build-${{ matrix.model }}
          path: build-packages/targets/

      - name: Extract build packages
        if: ${{ env.PULL_PACKAGES == 'true' }}
        env:
          SOURCE_DIR: build-packages/targets
          TARGET: build-packages/s2t/armv7
        run: |
          mkdir -p ${TARGET}
          sudo tar xzvf ${SOURCE_DIR}/bin-*.tar.gz -C ${TARGET}

      - name: Build artifact
        run: sudo -E make patch build release MODEL=${MODEL}

      - name: Prepare artifact
        id: artifact
        env:
          BASE_VERSION: ${{ steps.base.outputs.version }}
        run: |
          FILE=`ls -1 release/${MODEL}/mico_*.tar | head -n 1`
          HASH=`md5sum ${FILE} | awk '{print $1}'`
          echo "hash=${HASH}" | tee -a ${GITHUB_OUTPUT}
          NAME=`basename ${FILE}`
          echo "name=${NAME}" | tee -a ${GITHUB_OUTPUT}

          cp -vf ${FILE} .

          SIZE=`stat -c%s ${NAME}`
          echo "size=${SIZE}" | tee -a ${GITHUB_OUTPUT}

          {
            echo '```json'
            jq -nc \
              --arg name "$NAME" \
              --argjson size "$SIZE" \
              --arg hash "$HASH" \
              --arg version "$BASE_VERSION" \
              '{"name": $name, "size": $size, "hash": $hash, "base_version": $version}'
            echo '```'
          } >> ${GITHUB_STEP_SUMMARY}

      - name: Upload artifact to release
        if: ${{ env.UPLOAD_RELEASE == 'true' }}
        uses: softprops/action-gh-release@v2
        with:
          files: ${{ steps.artifact.outputs.name }}
          draft: true

      - name: Upload artifact to Workflow Run
        if: ${{ env.UPLOAD_RELEASE == 'false' }}
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.artifact.outputs.name }}
          path: ${{ steps.artifact.outputs.name }}
          retention-days: 10
          if-no-files-found: error

      - name: Attest Build Provenance
        uses: actions/attest-build-provenance@v1
        with:
          subject-path: ${{ steps.artifact.outputs.name }}
          show-summary: false