name: AppImage Build

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]

jobs:
  appimage_build:
    runs-on: ubuntu-24.04

    permissions:
      contents: read
      id-token: write
      attestations: write
      artifact-metadata: write

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true

      - name: Install build dependencies
        run: |
          set -eux
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            build-essential pkg-config meson ninja-build cmake \
            gettext \
            libcanberra-dev libdbus-glib-1-dev libglib2.0-dev \
            libgtk2.0-dev libgtk-3-dev \
            libgtk-3-bin libglib2.0-bin shared-mime-info gsettings-desktop-schemas \
            libluajit-5.1-dev libpci-dev libperl-dev libssl-dev \
            python3-dev python3-cffi mono-devel desktop-file-utils \
            patchelf file curl

      - name: Configure
        run: |
          set -eux
          rm -rf build
          meson setup build \
            --prefix=/usr \
            -Dtext-frontend=true \
            -Dwith-perl=perl \
            -Dwith-python=python3 \
            -Dauto_features=enabled

      - name: Build
        run: |
          set -eux
          ninja -C build

      - name: Install to AppDir
        run: |
          set -eux
          rm -rf AppDir
          DESTDIR="${PWD}/AppDir" ninja -C build install

      - name: Build AppImage
        env:
          APPIMAGE_EXTRACT_AND_RUN: 1
          DEPLOY_GTK_VERSION: 3
          LDAI_NO_APPSTREAM: 1
        run: |
          set -eux

          curl -fL --retry 3 -o linuxdeploy-x86_64.AppImage \
            https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage
          chmod +x linuxdeploy-x86_64.AppImage

          curl -fL --retry 3 -o linuxdeploy-plugin-gtk \
            https://raw.githubusercontent.com/linuxdeploy/linuxdeploy-plugin-gtk/master/linuxdeploy-plugin-gtk.sh
          chmod +x linuxdeploy-plugin-gtk
          export PATH="${PWD}:${PATH}"

          # Bundle CA certificates into the AppDir
          install -Dm644 /etc/ssl/certs/ca-certificates.crt \
            AppDir/etc/ssl/certs/ca-certificates.crt

          # Custom AppRun: preserve typical AppDir runtime paths AND force CA bundle
          cat > AppRun <<'EOF'
          #!/bin/sh
          set -eu

          APPDIR="${APPDIR:-$(dirname "$(readlink -f "$0")")}"

          export PATH="$APPDIR/usr/bin:${PATH:-/usr/bin:/bin}"
          export LD_LIBRARY_PATH="$APPDIR/usr/lib:$APPDIR/usr/lib/x86_64-linux-gnu:${LD_LIBRARY_PATH:-}"
          export XDG_DATA_DIRS="$APPDIR/usr/share:${XDG_DATA_DIRS:-/usr/local/share:/usr/share}"

          if [ -d "$APPDIR/usr/share/glib-2.0/schemas" ]; then
            export GSETTINGS_SCHEMA_DIR="$APPDIR/usr/share/glib-2.0/schemas${GSETTINGS_SCHEMA_DIR:+:$GSETTINGS_SCHEMA_DIR}"
          fi

          if [ -d "$APPDIR/usr/lib/x86_64-linux-gnu/gio/modules" ]; then
            export GIO_EXTRA_MODULES="$APPDIR/usr/lib/x86_64-linux-gnu/gio/modules${GIO_EXTRA_MODULES:+:$GIO_EXTRA_MODULES}"
          elif [ -d "$APPDIR/usr/lib/gio/modules" ]; then
            export GIO_EXTRA_MODULES="$APPDIR/usr/lib/gio/modules${GIO_EXTRA_MODULES:+:$GIO_EXTRA_MODULES}"
          fi

          # OpenSSL trust store override (fixes “unable to get local issuer certificate (20)”)
          export SSL_CERT_FILE="${SSL_CERT_FILE:-$APPDIR/etc/ssl/certs/ca-certificates.crt}"
          export SSL_CERT_DIR="${SSL_CERT_DIR:-$APPDIR/etc/ssl/certs}"
          export CURL_CA_BUNDLE="${CURL_CA_BUNDLE:-$SSL_CERT_FILE}"

          exec "$APPDIR/usr/bin/zoitechat" "$@"
          EOF
          chmod +x AppRun

          VERSION="$(git describe --tags --always)"

          ./linuxdeploy-x86_64.AppImage \
            --appdir AppDir \
            --desktop-file AppDir/usr/share/applications/net.zoite.Zoitechat.desktop \
            --icon-file AppDir/usr/share/icons/hicolor/48x48/apps/net.zoite.Zoitechat.png \
            --custom-apprun ./AppRun \
            --plugin gtk \
            --output appimage

          appimage_path="$(ls -1 *.AppImage | grep -v linuxdeploy | head -n 1)"
          mv "$appimage_path" "Zoitechat-${VERSION}-x86_64.AppImage"

      - name: Attest AppImage (Build Provenance)
        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
        uses: actions/attest-build-provenance@v3
        with:
          subject-path: Zoitechat-*-x86_64.AppImage

      - name: Upload AppImage artifact
        uses: actions/upload-artifact@v4
        with:
          name: zoitechat-appimage
          path: Zoitechat-*-x86_64.AppImage