name: Build and Deploy Meshy Flatpak

on:
  push:
    branches: [ "main" ]
  workflow_dispatch:
  
jobs:
  build:
    runs-on: linux-64
    steps:
      - name: Update source code
        run: |
          # Ensure exclusive run with a time limit (max 2 hours wait)
          exec 9>/tmp/meshy-builder.lock
          flock -w 7200 -x 9 || { echo "Error: Failed to acquire lock within 2 hours."; exit 1; }

          cd /opt/meshy-builder/meshy

          # Get current commit before update
          BEFORE_COMMIT=$(git rev-parse HEAD)
          echo "Current commit: $BEFORE_COMMIT"

          # Fetch latest changes
          git fetch origin main || { echo "Error: git fetch failed"; exit 1; }

          # Get remote commit hash
          REMOTE_COMMIT=$(git rev-parse origin/main)
          echo "Remote commit: $REMOTE_COMMIT"

          # Reset to remote state
          git reset --hard origin/main || { echo "Error: git reset failed"; exit 1; }

          # Verify we're now at the remote commit
          AFTER_COMMIT=$(git rev-parse HEAD)
          echo "Updated to commit: $AFTER_COMMIT"

          if [ "$AFTER_COMMIT" != "$REMOTE_COMMIT" ]; then
            echo "Error: Local commit ($AFTER_COMMIT) doesn't match remote ($REMOTE_COMMIT)"
            exit 1
          fi

          if [ "$BEFORE_COMMIT" = "$AFTER_COMMIT" ]; then
            echo "Warning: No new commits (already at $AFTER_COMMIT)"
          else
            echo "Successfully updated from $BEFORE_COMMIT to $AFTER_COMMIT"
          fi

      - name: Build x86_64
        run: |
          cd /opt/meshy-builder/meshy
          flatpak-builder --arch=x86_64 \
            --gpg-sign=F4A5C1B58269D130484CE939EE9DE25458E1D065 \
            --disable-rofiles-fuse \
            --force-clean \
            --repo=/opt/meshy-builder/flatpak/ \
            build-dir-x86_64 page.codeberg.sesivany.Meshy.json

      - name: Build aarch64
        run: |
          cd /opt/meshy-builder/meshy
          # If aarch64 still fails, this step can be commented out
          flatpak-builder --arch=aarch64 \
            --gpg-sign=F4A5C1B58269D130484CE939EE9DE25458E1D065 \
            --disable-rofiles-fuse \
            --force-clean \
            --repo=/opt/meshy-builder/flatpak/ \
            build-dir-aarch64 page.codeberg.sesivany.Meshy.json

      - name: Update local repository metadata (Runner)
        run: |
          # Generate a signed index and prune old builds (keep the last 10)
          flatpak build-update-repo --prune --prune-depth=10 --gpg-sign=F4A5C1B58269D130484CE939EE9DE25458E1D065 /opt/meshy-builder/flatpak/

      - name: Deploy to Public Server
        env:
          SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
        run: |
          mkdir -p ~/.ssh
          echo "$SSH_KEY" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          
          # Sync with accept-new parameter (automatic and safe server key acceptance without keyscan)
          rsync -avz -e "ssh -o StrictHostKeyChecking=accept-new" /opt/meshy-builder/flatpak/ meshy@eischmann.cz:/var/www/html/meshy/flatpak/

      - name: Set permissions and metadata on the public server
        run: |
          # Remote update and pruning of the repository (keep 10) + set read permissions via a single SSH command
          ssh -o StrictHostKeyChecking=accept-new meshy@eischmann.cz \
            "flatpak build-update-repo --prune --prune-depth=10 --gpg-sign=F4A5C1B58269D130484CE939EE9DE25458E1D065 /var/www/html/meshy/flatpak/ && chmod -R a+rX /var/www/html/meshy/flatpak/"
