build-on-image.yml

name: Build

# called from a workflow in each repository
on:
  workflow_call:
    inputs:
      display_name:
        description: "Name of the build"
        type: string
        required: true
      mint_version:
        description: "The Mint version to tag for"
        type: string
        required: true
      image:
        description: "The container to build in"
        type: string
        required: true
      commit_id:
        description: "The commit sha or branch to build from"
        type: string
        required: true
        default: "master"
      dependencies:
        description: 'A comma separated list of owner/repo dependencies to pull the latest build for (such as "linuxmint/xapp, linuxmint/cinnamon-desktop, linuxmint/cinnamon-menus")'
        type: string
        required: false
      codespell:
        description: "Whether to run codespell during the job"
        type: boolean
        required: false
        default: false
      codespell_ignore_files_list:
        description: "A comma separated list of files to skip when running codespell"
        type: string
        required: false
        default: ""
      codespell_ignore_words_list:
        description: "A comma separated list of words to have codespell ignore"
        type: string
        required: false
        default: ""
      upload_artifacts:
        description: "Upload build artifacts (for PR testing)"
        type: boolean
        required: false
        default: false
      artifact_retention_days:
        description: "Days to retain uploaded artifacts"
        type: number
        required: false
        default: 7

jobs:
  build-on-image:
    name: ${{ inputs.display_name }}
    runs-on: ubuntu-latest
    container:
      image: ${{ inputs.image }}
      # Disable seccomp until a container manager in GitHub recognizes
      # clone3() syscall,
      # <https://github.com/actions/virtual-environments/issues/3812>.
      options: --security-opt seccomp=unconfined
    steps:
      - name: Checkout Pull Request
        if: ${{ github.event_name == 'pull_request'}}
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Checkout branch ${{ inputs.commit_id }}
        if: ${{ github.event_name != 'pull_request' }}
        uses: actions/checkout@v6
        with:
          ref: ${{ inputs.commit_id }}

      - name: Run Codespell
        if: ${{ inputs.codespell }}
        uses: codespell-project/actions-codespell@v2
        with:
          # only show the typo detected but don't make workflow to fail
          only_warn: 1
          skip: ${{ inputs.codespell_ignore_files_list }}  
          # word to exclude must be always lowercase as must be same of the codespell dictionary
          ignore_words_list: ${{ inputs.codespell_ignore_words_list }}

      - name: Update build environment
        run: |
          echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections
          sudo apt-get update
          sudo apt-get -y dist-upgrade
          sudo apt-get install -y python-is-python3
        shell: bash

      - name: Install first-class dependencies
        uses: linuxmint/github-actions/install-deps@master
        with:
          mint_version: ${{ inputs.mint_version }}
          dependencies: ${{ inputs.dependencies }}

      - name: Build
        uses: linuxmint/github-actions/real-build@master

      - name: Setup SSH upon failure
        if: ${{ failure() && inputs.debug_enabled}}
        uses: mxschmitt/action-tmate@v3
        with:
          limit-access-to-actor: true

      #### Stop here when triggered by a PR (without /upload-artifacts)

      - name: Isolate packages
        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || inputs.upload_artifacts }}
        run: |
          mkdir -p ./output/packages
          mv ../*.changes ./output
          mv ../*.*deb ./output/packages
        shell: bash

      - name: Upload build artifacts
        if: ${{ inputs.upload_artifacts }}
        uses: actions/upload-artifact@v4
        with:
          name: packages-${{ inputs.mint_version }}
          path: |
            output/packages/*
            output/*.changes
          retention-days: ${{ inputs.artifact_retention_days }}

      - name: Bundle packages
        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
        uses: TheDoctor0/zip-release@0.7.6
        with:
          type: 'tar'
          filename: 'packages.tar.gz'
          path: packages
          directory: ./output

      #### Release steps (push/workflow_dispatch only)

      - name: Install gh cli
        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
        uses: sersoft-gmbh/setup-gh-cli-action@v3
        with:
          version: stable
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Delete existing tag/release
        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
        run: gh release delete ${{ github.ref_name }}.${{ inputs.mint_version }} --cleanup-tag || true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Wait a few moments...
        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
        run: |
          sleep 20
        shell: bash

      - name: Create release
        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
        uses: ncipollo/release-action@v1.20.0
        with:
          token: "${{ secrets.GITHUB_TOKEN }}"
          artifacts: "output/packages.tar.gz,output/*.changes"
          tag: ${{ github.ref_name }}.${{ inputs.mint_version }}
          commit: ${{ github.sha }}
          artifactErrorsFailBuild: true
          makeLatest: true