name: Linux x64
on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
  workflow_dispatch:
permissions:
  contents: read
jobs:
  build:
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - name: Install pinned Rust and musl build tools
        run: |
          sudo apt-get update
          sudo apt-get install -y musl-tools
          rustup toolchain install 1.93.1 --profile minimal --component rustfmt --component clippy --target x86_64-unknown-linux-musl
          rustup override set 1.93.1
      - name: Verify
        run: |
          cargo fmt --check
          cargo clippy --all-targets --locked -- -D warnings
          cargo test --all-targets --locked --target x86_64-unknown-linux-musl
          node --check web/app.js
          sh -n deploy/run.sh scripts/package-linux.sh
      - name: Build static release and verify package
        run: |
          cargo build --release --locked --target x86_64-unknown-linux-musl
          sh scripts/package-linux.sh
          python3 scripts/verify-linux-package.py dist/release/mirror-tool-linux-x64.tar.gz
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: mirror-tool-linux-x64
          path: dist/release/*
          if-no-files-found: error
  release:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: build
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: mirror-tool-linux-x64
          path: release
      - name: Publish verified archive
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          gh release create "$RELEASE_TAG" release/* --verify-tag --title "Mirror Tool $RELEASE_TAG — Linux x64" --notes 'Ready-to-run static Linux x64 package. Extract and run ./run.sh. First launch creates mirror.toml with listen=0.0.0.0:6700 and password=mirror-tool-change-me. Change the password in the config before shared-network use. Existing configs are preserved. No Rust, Python, Node, glibc or external SQLite required. See included README.md. Flag substitution is disabled by default.'