cryptomator/.github/workflows/linux-flatpak.yml

name: Build flatpak

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag'
        required: false
  push:
    branches-ignore:
      - 'dependabot/**'
    paths:
      - '.github/workflows/linux-flatpak.yml'
      - 'dist/linux/flatpak/**'
      - 'dist/linux/common/**'
      - 'dist/linux/resources/**'

jobs:
  get-version:
    uses: ./.github/workflows/get-version.yml
    with:
      version: ${{ inputs.tag }}

  flatpak:
    name: "Build flatpak"
    needs: [get-version]
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/flathub-infra/flatpak-github-actions:freedesktop-25.08
      options: --privileged
    strategy:
      #fail-fast: false
      matrix:
        variant:
          - arch: x86_64
            runner: ubuntu-24.04
          #- arch: aarch64
          #  runner: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: flathub/org.cryptomator.Cryptomator
          submodules: true
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          path: cryptomator
      - name: Prepare build files
        run: |
          cp -r -f cryptomator/dist/linux/flatpak/* .
          envsubst '$FLATPAK_VERSION $FLATPAK_REVISION $CRYPTOMATOR_SOURCE' < org.cryptomator.Cryptomator.TEMPLATE.yaml > org.cryptomator.Cryptomator.yaml
        env:
          FLATPAK_VERSION: ${{ needs.get-version.outputs.semVerNum }}
          FLATPAK_REVISION: 1
          CRYPTOMATOR_SOURCE: |-
            type: git
                    path: cryptomator
                    commit: ${{ github.sha }}
      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          archive: false
          if-no-files-found: error
          path: |
            org.cryptomator.Cryptomator.yaml
      - uses: flatpak/flatpak-github-actions/flatpak-builder@92ae9851ad316786193b1fd3f40c4b51eb5cb101 # v6.6
        with:
          bundle: cryptomator.flatpak
          manifest-path: org.cryptomator.Cryptomator.yaml
          cache-key: flatpak-builder-${{ github.sha }}
          #build-dir: flatpak_app
          #gpg-sign:
          arch: ${{ matrix.variant.arch }}

  tarball:
    name: Determines tarball url and compute checksum
    runs-on: ubuntu-latest
    needs: [get-version]
    if:  github.event_name == 'workflow_dispatch' || needs.get-version.outputs.versionType == 'stable'
    outputs:
      url: ${{ steps.url.outputs.url}}
      sha512: ${{ steps.sha512.outputs.sha512}}
    steps:
      - name: Determine tarball url
        id: url
        run: |
          URL="https://github.com/cryptomator/cryptomator/archive/refs/tags/${TAG}.tar.gz"
          echo "url=${URL}" >> "$GITHUB_OUTPUT"
        env:
          TAG: ${{ inputs.tag || github.event.release.tag_name}}
      - name: Download source tarball and compute checksum
        id: sha512
        run: |
          curl --silent --fail-with-body --proto "=https" -L -H "Accept: application/vnd.github+json" ${{ steps.url.outputs.url }} --output cryptomator.tar.gz
          TARBALL_SHA512=$(sha512sum cryptomator.tar.gz | cut -d ' ' -f1)
          echo "sha512=${TARBALL_SHA512}" >> "$GITHUB_OUTPUT"
  flathub:
    name: Create PR for flathub
    runs-on: ubuntu-latest
    needs: [tarball, get-version]
    env:
      FLATHUB_PR_URL: tbd
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: 'flathub/org.cryptomator.Cryptomator'
          token: ${{ secrets.CRYPTOBOT_PR_TOKEN }}
      - name: Checkout release branch
        run: |
          git checkout -b release/${{ needs.get-version.outputs.semVerStr }}
      - name: Update build file
        run: |
          sed -i -e 's/VERSION: [0-9]\+\.[0-9]\+\.[0-9]\+.*/VERSION: ${{ needs.get-version.outputs.semVerStr }}/g' org.cryptomator.Cryptomator.yaml
          sed -i -e 's/sha512: [0-9A-Za-z_\+-]\{128\} #CRYPTOMATOR/sha512: ${{ needs.tarball.outputs.sha512 }} #CRYPTOMATOR/g' org.cryptomator.Cryptomator.yaml
          sed -i -e 's;url: https://github.com/cryptomator/cryptomator/archive/refs/tags/[^[:blank:]]\+;url: ${{ needs.tarball.outputs.url }};g' org.cryptomator.Cryptomator.yaml
      - name: Commit and push
        run: |
          git config user.name "${{ github.actor }}"
          git config user.email "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"
          git config push.autoSetupRemote true
          git stage .
          git commit -m "Prepare release ${{needs.get-version.outputs.semVerStr}}"
          git push
      - name: Create pull request
        run: |
          printf "> [!IMPORTANT]\n> Todos:\n> - [ ] Update maven dependencies\n> - [ ] Check for JDK update\n> - [ ] Check for JFX update" > pr_body.md
          PR_URL=$(gh pr create --title "Release ${{ needs.get-version.outputs.semVerStr }}" --body-file pr_body.md)
          echo "FLATHUB_PR_URL=$PR_URL" >> "$GITHUB_ENV"
        env:
          GH_TOKEN: ${{ secrets.CRYPTOBOT_PR_TOKEN }}
      - name: Slack Notification
        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
        if: github.event_name == 'release'
        env:
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_USERNAME: 'Cryptobot'
          SLACK_ICON: false
          SLACK_ICON_EMOJI: ':bot:'
          SLACK_CHANNEL: 'cryptomator-desktop'
          SLACK_TITLE: "Flathub release PR created for ${{ github.event.repository.name }} ${{ github.event.release.tag_name }} created."
          SLACK_MESSAGE: "See <${{ env.FLATHUB_PR_URL }}|PR> on how to proceed.>."
          SLACK_FOOTER: false
          MSG_MINIMAL: true