# Flatpak build workflow - packages pre-built binary as a Flatpak bundle
# Called from the release workflow after the build job completes

name: Flatpak Build

on:
  workflow_call:
    inputs:
      version:
        description: 'Version to build'
        required: true
        type: string

jobs:
  build-flatpak:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/flathub-infra/flatpak-github-actions:freedesktop-24.08
      options: --privileged
    steps:
      - uses: actions/checkout@v6

      - name: Download pre-built binary
        uses: actions/download-artifact@v7
        with:
          name: artifacts-x86_64-unknown-linux-gnu
          path: artifacts/

      - name: Extract pre-built binary
        run: |
          # Flatpak manifest expects binary at crates/fresh-editor/target/release/
          mkdir -p crates/fresh-editor/target/release
          cd artifacts
          tar -xJf fresh-editor-x86_64-unknown-linux-gnu.tar.xz
          cp fresh-editor-x86_64-unknown-linux-gnu/fresh ../crates/fresh-editor/target/release/

      - name: Strip binary
        run: |
          strip --strip-all crates/fresh-editor/target/release/fresh
          ls -lh crates/fresh-editor/target/release/fresh

      - name: Update metainfo version
        run: |
          VERSION="${{ inputs.version }}"
          DATE=$(date +%Y-%m-%d)
          sed -i "s/<release version=\"[^\"]*\"/<release version=\"$VERSION\"/" crates/fresh-editor/flatpak/io.github.sinelaw.fresh.metainfo.xml
          sed -i "s/date=\"[^\"]*\"/date=\"$DATE\"/" crates/fresh-editor/flatpak/io.github.sinelaw.fresh.metainfo.xml

      - name: Copy icons into Flatpak source tree
        run: |
          mkdir -p crates/fresh-editor/docs/icons/linux
          cp -r docs/icons/linux/hicolor crates/fresh-editor/docs/icons/linux/

      - name: Copy install-receipt script into Flatpak source tree
        run: |
          # The manifest runs scripts/write-install-receipt.sh relative to the
          # source root (crates/fresh-editor, via `path: ..`), but the script
          # lives at the repo root. Copy it in like the icons above.
          mkdir -p crates/fresh-editor/scripts
          cp scripts/write-install-receipt.sh crates/fresh-editor/scripts/

      - name: Build Flatpak
        uses: flatpak/flatpak-github-actions/flatpak-builder@v6
        with:
          manifest-path: crates/fresh-editor/flatpak/io.github.sinelaw.fresh.yml
          bundle: fresh-editor-${{ inputs.version }}-x86_64.flatpak
          upload-artifact: false

      - name: Generate checksum
        run: |
          VERSION="${{ inputs.version }}"
          sha256sum fresh-editor-${VERSION}-x86_64.flatpak > fresh-editor-${VERSION}-x86_64.flatpak.sha256

      - name: Upload Flatpak bundle
        uses: actions/upload-artifact@v6
        with:
          name: artifacts-flatpak
          path: |
            fresh-editor-*.flatpak
            fresh-editor-*.flatpak.sha256

      - name: Test Flatpak installation
        run: |
          VERSION="${{ inputs.version }}"
          flatpak install --user -y fresh-editor-${VERSION}-x86_64.flatpak
          flatpak run io.github.sinelaw.fresh --version
          # Assert the provenance the sandboxed binary *resolves*, not merely
          # that the receipt file is present: `cat`ing the file passes even when
          # the resolver never looks at that path (which is exactly how the
          # .deb/.rpm receipts stayed broken while CI was green).
          paths=$(flatpak run io.github.sinelaw.fresh --cmd config paths) \
            || { echo "config paths failed inside the sandbox"; exit 1; }
          echo "$paths"
          echo "$paths" | grep -qE '^install channel: +.*\(flatpak\)$' \
            || { echo "sandboxed binary did not resolve channel flatpak"; exit 1; }
          echo "$paths" | grep -qE '^provenance: +Authoritative$' \
            || { echo "provenance is not Authoritative — the receipt was not found"; exit 1; }
