build.yml

name: build

on:
  push:
  pull_request:
  workflow_dispatch:
    inputs:
      version:
        description: 'DEB version; leave blank for an automatic CI or tag version'
        required: false
        type: string
      release_tag:
        description: 'Existing vX.Y.Z tag to rebuild and publish; leave blank for artifact only'
        required: false
        type: string

permissions:
  contents: read

jobs:
  userspace:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ inputs.release_tag || github.ref }}
      - name: Build userspace and tools
        run: make userspace
      - name: Test readiness checker
        run: make check
      - name: Smoke-test plugin loading
        run: build/usb-displayd --help || test $? -eq 1

  kernel-4-15:
    runs-on: ubuntu-latest
    env:
      KERNEL_RELEASE: 4.15.0-60-generic
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ inputs.release_tag || github.ref }}

      - name: Build target-kernel module without a bind mount
        shell: bash
        run: |
          set -eu
          container_name="usbdisplay-kernel-${GITHUB_RUN_ID}"
          cleanup() {
            docker rm -f "$container_name" >/dev/null 2>&1 || true
          }
          trap cleanup EXIT HUP INT TERM
          docker create --platform linux/386 --name "$container_name" \
            ubuntu:18.04 sh -lc '
            set -eu
            export DEBIAN_FRONTEND=noninteractive
            apt-get -o Acquire::Retries=5 update
            apt-get -o Acquire::Retries=5 install -y --no-install-recommends \
              build-essential file linux-headers-4.15.0-60-generic
            cd /src
            make module KDIR=/lib/modules/4.15.0-60-generic/build
            strings kernel/usbdisplay.ko | grep -q "^vermagic=4.15.0-60-generic "
            file kernel/usbdisplay.ko |
              grep -Eq "ELF 32-bit.*Intel (80386|i386)"
          ' >/dev/null
          docker cp ./. "$container_name:/src"
          docker start --attach "$container_name"
          docker cp "$container_name:/src/kernel/usbdisplay.ko" "$RUNNER_TEMP/usbdisplay.ko"

      - name: Upload target-kernel module for packaging
        uses: actions/upload-artifact@v4
        with:
          name: usbdisplay-kernel-4.15.0-60-${{ github.run_id }}
          if-no-files-found: error
          retention-days: 1
          path: ${{ runner.temp }}/usbdisplay.ko

  debian-package:
    name: package Debian artifact
    runs-on: ubuntu-latest
    needs: kernel-4-15
    outputs:
      version: ${{ steps.version.outputs.version }}
    env:
      KERNEL_RELEASE: 4.15.0-60-generic
      KERNEL_ARCHITECTURE: i386
      PCCT_IMAGE: ghcr.io/iotsharp/pcct-build-x86:latest
      REQUESTED_VERSION: ${{ inputs.version }}
      RELEASE_TAG: ${{ inputs.release_tag }}
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ inputs.release_tag || github.ref }}

      - name: Download target-kernel module
        uses: actions/download-artifact@v4
        with:
          name: usbdisplay-kernel-4.15.0-60-${{ github.run_id }}
          path: ${{ runner.temp }}

      - name: Resolve package version
        id: version
        shell: bash
        run: |
          set -eu
          if [ -n "$RELEASE_TAG" ]; then
            case "$RELEASE_TAG" in
              v[0-9]*) ;;
              *)
                printf 'Invalid release tag: %s\n' "$RELEASE_TAG" >&2
                exit 2
                ;;
            esac
            version="${RELEASE_TAG#v}"
            if [ -n "$REQUESTED_VERSION" ] && [ "$REQUESTED_VERSION" != "$version" ]; then
              printf 'Version %s does not match release tag %s\n' \
                "$REQUESTED_VERSION" "$RELEASE_TAG" >&2
              exit 2
            fi
          elif [ -n "$REQUESTED_VERSION" ]; then
            version="$REQUESTED_VERSION"
          elif [[ "$GITHUB_REF" == refs/tags/v* ]]; then
            version="${GITHUB_REF_NAME#v}"
          else
            version="0.0.0-ci.${GITHUB_RUN_NUMBER}"
          fi
          case "$version" in
            ''|[!0-9]*|*[!0-9A-Za-z.+~-]*)
              printf 'Invalid package version: %s\n' "$version" >&2
              exit 2
              ;;
            *) ;;
          esac
          printf 'version=%s\n' "$version" >> "$GITHUB_OUTPUT"
          printf 'Building USBDisplayStack version %s\n' "$version"

      - name: Build and package with PCCT
        shell: pwsh
        env:
          PACKAGE_VERSION: ${{ steps.version.outputs.version }}
        run: |
          ./scripts/build-pcct-deb.ps1 `
            -Version "$env:PACKAGE_VERSION" `
            -KernelModule "$env:RUNNER_TEMP/usbdisplay.ko" `
            -KernelRelease "$env:KERNEL_RELEASE" `
            -Architecture "$env:KERNEL_ARCHITECTURE" `
            -Image "$env:PCCT_IMAGE" `
            -OutputDirectory "$env:GITHUB_WORKSPACE/dist-pcct"

      - name: Verify Debian metadata and checksum
        shell: bash
        env:
          EXPECTED_VERSION: ${{ steps.version.outputs.version }}
        run: |
          set -eu
          package=$(find dist-pcct -maxdepth 1 -type f -name '*.deb' -print -quit)
          test -n "$package"
          test "$(dpkg-deb -f "$package" Architecture)" = i386
          test "$(dpkg-deb -f "$package" X-USBDisplay-Kernel)" = "$KERNEL_RELEASE"
          depends=$(dpkg-deb -f "$package" Depends)
          for dependency in kmod systemd udev ffmpeg; do
            printf '%s\n' "$depends" | grep -q "\b$dependency\b"
          done
          package_contents="$RUNNER_TEMP/usbdisplay-package-contents.txt"
          dpkg-deb -c "$package" > "$package_contents"
          grep -q './usr/share/usbdisplay/install-scripts/install-offline-deb.sh' \
            "$package_contents"
          grep -q './usr/share/doc/usbdisplay-stack/docs/assets/usbdisplay-splash.png' \
            "$package_contents"
          extracted="$RUNNER_TEMP/usbdisplay-package-root"
          dpkg-deb -x "$package" "$extracted"
          test "$(cat "$extracted/usr/share/usbdisplay/VERSION")" = \
            "$EXPECTED_VERSION"
          strings "$extracted/usr/bin/usb-displayd" |
            grep -Fqx "VERSION $EXPECTED_VERSION"
          file "$extracted/lib/modules/$KERNEL_RELEASE/extra/usbdisplay.ko" |
            grep -Eq 'ELF 32-bit.*Intel (80386|i386)'
          file "$extracted/usr/bin/usb-displayd" |
            grep -Eq 'ELF 32-bit.*Intel (80386|i386)'
          (cd dist-pcct && sha256sum -c "$(basename "$package").sha256")

      - name: Upload Debian package
        uses: actions/upload-artifact@v4
        with:
          name: usbdisplay-stack-deb-${{ steps.version.outputs.version }}
          if-no-files-found: error
          path: |
            dist-pcct/*.deb
            dist-pcct/*.deb.sha256
            dist-pcct/install-usbdisplay-offline.sh

  publish-tag:
    name: publish tagged Debian release
    if: >-
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) ||
      (github.event_name == 'workflow_dispatch' && inputs.release_tag != '')
    runs-on: ubuntu-latest
    needs: debian-package
    permissions:
      contents: write
    env:
      GH_REPO: ${{ github.repository }}
      RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }}
    steps:
      - name: Download Debian package
        uses: actions/download-artifact@v4
        with:
          name: usbdisplay-stack-deb-${{ needs.debian-package.outputs.version }}
          path: dist-pcct

      - name: Publish GitHub Release assets
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -eu
          shopt -s nullglob
          assets=(
            dist-pcct/*.deb
            dist-pcct/*.deb.sha256
            dist-pcct/install-usbdisplay-offline.sh
          )
          if [ "${#assets[@]}" -ne 3 ]; then
            printf 'Expected three release assets, found %s\n' "${#assets[@]}" >&2
            exit 1
          fi
          if ! gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            gh release create "$RELEASE_TAG" \
              --verify-tag \
              --title "$RELEASE_TAG" \
              --generate-notes
          fi
          gh release upload "$RELEASE_TAG" "${assets[@]}" --clobber

  publish-launchpad:
    name: publish ${{ matrix.series }} ${{ matrix.architecture }} to Launchpad
    if: >-
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) ||
      (github.event_name == 'workflow_dispatch' && inputs.release_tag != '')
    runs-on: ubuntu-latest
    needs: debian-package
    strategy:
      fail-fast: false
      max-parallel: 1
      matrix:
        include:
          - series: bionic
            architecture: i386
          - series: resolute
            architecture: amd64
    permissions:
      contents: read
    env:
      DEBFULLNAME: Yanhong Ma
      DEBEMAIL: mysticboy@live.com
      PPA_TARGET: ppa:maikebing/usbdisplaystack
      RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }}
      UBUNTU_SERIES: ${{ matrix.series }}
      PACKAGE_ARCHITECTURE: ${{ matrix.architecture }}
    steps:
      - name: Check out tagged source
        uses: actions/checkout@v5
        with:
          ref: ${{ inputs.release_tag || github.ref }}
          path: source

      - name: Install source-package tools
        shell: bash
        run: |
          set -eu
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            debhelper devscripts dput gnupg

      - name: Assemble unsigned Debian source package
        id: source-package
        shell: bash
        run: |
          set -eu
          case "$RELEASE_TAG" in
            v[0-9]*) ;;
            *)
              printf 'Invalid release tag: %s\n' "$RELEASE_TAG" >&2
              exit 2
              ;;
          esac
          upstream_version=${RELEASE_TAG#v}
          case "$upstream_version" in
            ''|[!0-9]*|*[!0-9A-Za-z.+~-]*)
              printf 'Invalid upstream version: %s\n' "$upstream_version" >&2
              exit 2
              ;;
            *) ;;
          esac
          archive="$GITHUB_WORKSPACE/usbdisplay-stack_${upstream_version}.orig.tar.gz"

          git -C source archive \
            --format=tar.gz \
            --prefix="usbdisplay-stack-${upstream_version}/" \
            --output="$archive" \
            HEAD
          chmod 0755 source/debian/rules
          if [ -f "source/debian/launchpad/${UBUNTU_SERIES}.control" ]; then
            cp "source/debian/launchpad/${UBUNTU_SERIES}.control" \
              source/debian/control
          elif [ "$UBUNTU_SERIES" != bionic ]; then
            printf 'Missing Debian control file for %s.\n' "$UBUNTU_SERIES" >&2
            exit 2
          fi
          if grep -q '^[[:space:]]*debhelper-compat' source/debian/control; then
            rm -f source/debian/compat
          fi
          rm -rf source/debian/launchpad

          current_version=$(dpkg-parsechangelog -l source/debian/changelog \
            -S Version)
          package_version="${upstream_version}-1~${UBUNTU_SERIES}1"
          if [ "$current_version" != "$package_version" ]; then
            (
              cd source
              dch --force-distribution \
                --newversion "$package_version" \
                --distribution "$UBUNTU_SERIES" \
                --urgency medium \
                "Publish upstream release $upstream_version for Ubuntu $UBUNTU_SERIES $PACKAGE_ARCHITECTURE."
            )
          fi

          (
            cd source
            # Launchpad, not this ubuntu-latest runner, resolves series-specific build dependencies.
            dpkg-buildpackage -S -sa -us -uc -d
          )
          changes="$GITHUB_WORKSPACE/usbdisplay-stack_${package_version}_source.changes"
          test -f "$changes"
          printf 'changes=%s\n' "$changes" >> "$GITHUB_OUTPUT"
          printf 'package-version=%s\n' "$package_version" >> "$GITHUB_OUTPUT"

      - name: Import Launchpad signing key
        shell: bash
        env:
          LAUNCHPAD_GPG_FINGERPRINT: ${{ secrets.LAUNCHPAD_GPG_FINGERPRINT }}
          LAUNCHPAD_GPG_PRIVATE_KEY: ${{ secrets.LAUNCHPAD_GPG_PRIVATE_KEY }}
        run: |
          set -eu
          if [ -z "$LAUNCHPAD_GPG_FINGERPRINT" ] ||
             [ -z "$LAUNCHPAD_GPG_PRIVATE_KEY" ]; then
            printf '%s\n' \
              'LAUNCHPAD_GPG_FINGERPRINT and LAUNCHPAD_GPG_PRIVATE_KEY are required.' >&2
            exit 2
          fi
          expected_fingerprint=$(printf '%s' "$LAUNCHPAD_GPG_FINGERPRINT" |
            tr -d '[:space:]' | tr '[:lower:]' '[:upper:]')
          printf '%s\n' "$LAUNCHPAD_GPG_PRIVATE_KEY" | gpg --batch --import
          actual_fingerprint=$(gpg --batch --with-colons --fingerprint \
            "$expected_fingerprint" | awk -F: '$1 == "fpr" { print toupper($10); exit }')
          if [ "$actual_fingerprint" != "$expected_fingerprint" ]; then
            printf '%s\n' 'Imported signing key does not match the configured fingerprint.' >&2
            exit 2
          fi

      - name: Sign and upload source package
        shell: bash
        env:
          CHANGES_FILE: ${{ steps.source-package.outputs.changes }}
          LAUNCHPAD_GPG_FINGERPRINT: ${{ secrets.LAUNCHPAD_GPG_FINGERPRINT }}
        run: |
          set -eu
          fingerprint=$(printf '%s' "$LAUNCHPAD_GPG_FINGERPRINT" |
            tr -d '[:space:]' | tr '[:lower:]' '[:upper:]')
          debsign -k"$fingerprint" "$CHANGES_FILE"
          dput "$PPA_TARGET" "$CHANGES_FILE"

      - name: Preserve signed source package
        uses: actions/upload-artifact@v4
        with:
          name: usbdisplay-stack-launchpad-source-${{ steps.source-package.outputs.package-version }}
          if-no-files-found: error
          retention-days: 30
          path: |
            usbdisplay-stack_*.dsc
            usbdisplay-stack_*.orig.tar.*
            usbdisplay-stack_*.debian.tar.*
            usbdisplay-stack_*_source.buildinfo
            usbdisplay-stack_*_source.changes