mond/.gitea/workflows/ci.yaml

# .gitea/workflows/ci.yaml
name: Build and Release Mond

on:
  push:
    branches: [main, master, develop]
    tags: ['v*']

env:
  DOCKER_BUILDKIT: "1"
  PRODUCT_NAME: "mond"
  PACKAGE_VERSION: "0.18.5.0"
  BUILDX_NO_DEFAULT_ATTESTATIONS: "1"

jobs:
  build-and-test:
    runs-on: ${{ matrix.arch == 'amd64' && 'ubuntu-latest-amd64' || 'ubuntu-latest-arm64' }}
    strategy:
      matrix:
        arch: [amd64, arm64]
    steps:
      - uses: actions/checkout@v4

      - name: Setup Docker Buildx
        run: |
          # 创建 buildx builder（原生构建不需要 QEMU）
          docker buildx create --use --name native-builder \
            --driver docker-container \
            --driver-opt network=host \
            --driver-opt env.BUILDKIT_STEP_LOG_MAX_SIZE=50000000 \
            --driver-opt env.BUILDKIT_STEP_LOG_MAX_SPEED=10000000 \
            || true
          docker buildx inspect --bootstrap

      - name: Build binaries
        run: |
          PLATFORM="linux/${{ matrix.arch }}"
          MONERO_VERSION="v${PACKAGE_VERSION}"   # 上游 Monero git tag 带 v 前缀，需补回

          # 设置 BuildKit 优化参数
          export BUILDKIT_PROGRESS=plain

          docker buildx build --pull \
            --platform ${PLATFORM} \
            --build-arg MONERO_VERSION=${MONERO_VERSION} \
            --output type=local,dest=./output \
            -f docker/Dockerfile.ubuntu .

      - name: Package and test
        run: |
          DIR="./output/linux_${{ matrix.arch }}"
          VERSION=${PACKAGE_VERSION}
          TARGZ="${PRODUCT_NAME}-${{ matrix.arch }}-ubuntu-${VERSION}.tar.gz"

          tar -czf "${TARGZ}" -C "$DIR" .

          echo "📦 Created package: ${TARGZ}"
          ls -lh "${TARGZ}"

          # 快速验证
          mkdir -p test && tar -xzf "${TARGZ}" -C test
          test/mond --version 2>/dev/null || echo "⚠️ 跳过版本检查"
          # 纯静态校验（depends 系统应产出无动态依赖的二进制）
          ldd test/mond 2>&1 | grep -q "not a dynamic executable" \
            && echo "✅ 纯静态链接" || echo "⚠️ 非纯静态二进制"
          rm -rf test

      - name: Build Debian package
        run: |
          # 安装 dpkg-deb（如果需要）
          sudo apt-get update && sudo apt-get install -y dpkg-dev

          VERSION=${PACKAGE_VERSION}
          TARGZ="${PRODUCT_NAME}-${{ matrix.arch }}-ubuntu-${VERSION}.tar.gz"

          echo "📦 Building Debian package for ${{ matrix.arch }}..."
          chmod +x debian/build-deb.sh
          ./debian/build-deb.sh ${{ matrix.arch }} ${VERSION} "${TARGZ}"

          ls -lh *.deb

      - uses: https://github.com/ChristopherHX/gitea-upload-artifact@v4
        with:
          name: binaries-${{ matrix.arch }}
          path: |
            *.tar.gz
            *.deb
          retention-days: 1

  release:
    runs-on: ubuntu-latest-amd64
    needs: build-and-test
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - uses: https://github.com/ChristopherHX/gitea-download-artifact@v4
        with:
          pattern: binaries-*
          path: ./packages
          merge-multiple: true

      - name: Upload packages and create release
        env:
          TOKEN: ${{ secrets.BUILD_TOKEN }}
          TAG: ${{ github.ref_name }}
        run: |
          cd packages

          # 提取仓库信息（移除 https:// 前缀和仓库路径）
          REGISTRY=$(echo "${{ gitea.server_url }}" | sed 's|https\?://||')
          OWNER="${{ gitea.repository_owner }}"
          REPO_NAME=$(echo "${{ gitea.repository }}" | cut -d'/' -f2)
          VERSION="${TAG#v}"   # 包版本：去掉 git tag 的 v 前缀（registry 路径/下载名/Release 标题统一用）

          echo "📦 上传包到 Generic Package Registry..."
          echo "  Registry: ${REGISTRY}"
          echo "  Owner: ${OWNER}"
          echo "  Package: ${PRODUCT_NAME}"
          echo "  Version: ${VERSION}"

          # 上传所有 tar.gz 包到 Generic Package Registry
          for file in *.tar.gz; do
            [ ! -f "$file" ] && continue
            echo "  ⬆️  $file"
            curl -fsSL -X PUT \
              -H "Authorization: token ${TOKEN}" \
              --upload-file "$file" \
              "https://${REGISTRY}/api/packages/${OWNER}/generic/${PRODUCT_NAME}/${VERSION}/$file" || {
              echo "❌ 上传失败: $file"
              exit 1
            }
          done

          # 上传 Debian 包到 Debian Package Registry (通用稳定版)
          echo ""
          echo "📦 上传 Debian 包到 Debian Package Registry..."
          for file in *.deb; do
            [ ! -f "$file" ] && continue

            # 上传到 stable (通用稳定版)
            echo "  ⬆️  $file → stable"
            curl -fsSL -X PUT \
              -H "Authorization: token ${TOKEN}" \
              --upload-file "$file" \
              "https://${REGISTRY}/api/packages/${OWNER}/debian/pool/stable/main/upload" || {
              echo "❌ Debian 包上传失败: $file (stable)"
              exit 1
            }
          done

          # 生成 Release 描述
          echo ""
          echo "📝 生成 Release..."

          # 拼接 tar.gz 下载链接
          ASSETS=$(for f in *.tar.gz; do
            [ -f "$f" ] || continue
            echo "- [\`$f\`](https://${REGISTRY}/api/packages/${OWNER}/generic/${PRODUCT_NAME}/${VERSION}/$f)"
          done)

          BODY=$(cat <<EOF
          ## Release ${VERSION}

          ### 📥 Debian/Ubuntu 安装

          \`\`\`bash
          sudo curl https://${REGISTRY}/api/packages/${OWNER}/debian/repository.key -o /etc/apt/keyrings/gitea-${OWNER}.asc
          echo "deb [signed-by=/etc/apt/keyrings/gitea-${OWNER}.asc] https://${REGISTRY}/api/packages/${OWNER}/debian stable main" | sudo tee /etc/apt/sources.list.d/${OWNER}.list
          sudo apt-get update && sudo apt-get install ${PRODUCT_NAME}
          \`\`\`

          ### 📦 tar.gz 下载

          ${ASSETS}
          EOF
          )

          RELEASE_DATA=$(jq -n --arg tag "$TAG" --arg ver "$VERSION" --arg body "$BODY" \
            '{tag_name: $tag, name: "Release \($ver)", body: $body, draft: false, prerelease: false}')

          # 创建 Release
          echo ""
          echo "🎉 创建 Release..."
          RESPONSE=$(curl -fsSL -w "\n%{http_code}" -X POST \
            -H "Authorization: token ${TOKEN}" \
            -H "Content-Type: application/json" \
            "https://${REGISTRY}/api/v1/repos/${{ gitea.repository }}/releases" \
            -d "${RELEASE_DATA}")

          HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
          RESPONSE_BODY=$(echo "$RESPONSE" | head -n-1)

          if [ "$HTTP_CODE" = "201" ]; then
            echo "✅ Release 创建成功"
            RELEASE_ID=$(echo "$RESPONSE_BODY" | grep -o '"id":[0-9]*' | head -1 | cut -d':' -f2)
            echo "  Release ID: ${RELEASE_ID}"
          elif [ "$HTTP_CODE" = "409" ]; then
            echo "⚠️  Release 已存在，获取现有 Release ID..."
            RELEASE_ID=$(curl -fsSL \
              -H "Authorization: token ${TOKEN}" \
              "https://${REGISTRY}/api/v1/repos/${{ gitea.repository }}/releases/tags/${TAG}" | \
              grep -o '"id":[0-9]*' | head -1 | cut -d':' -f2)
            echo "  Release ID: ${RELEASE_ID}"
          else
            echo "❌ 创建 Release 失败 (HTTP ${HTTP_CODE})"
            echo "$RESPONSE_BODY"
            exit 1
          fi

          # 上传文件作为 Release 附件
          echo ""
          echo "📎 上传文件作为 Release 附件..."
          for file in *.tar.gz *.deb; do
            [ ! -f "$file" ] && continue
            echo "  ⬆️  $file"

            # 使用 multipart/form-data 上传附件
            curl -fsSL -X POST \
              -H "Authorization: token ${TOKEN}" \
              -F "attachment=@${file}" \
              "https://${REGISTRY}/api/v1/repos/${{ gitea.repository }}/releases/${RELEASE_ID}/assets?name=${file}" || {
              echo "  ⚠️  附件上传失败: $file（可能已存在）"
            }
          done

          echo ""
          echo "✅ Release 创建完成！"
          echo "🔗 访问: https://${REGISTRY}/${{ gitea.repository }}/releases/tag/${TAG}"

          # 清理临时文件
          rm -f release_body.md