debian.yml

name: debian

# workflow_call is what release.yml builds with, so a tag runs these jobs once,
# as part of the release, rather than once here and once there against the same
# commit. Nothing tag-shaped is triggered from this file for that reason.
#
# There is no push trigger either: packaging is slow and most commits land
# straight on main, so the run would be after the fact anyway. Open a PR, or
# dispatch this manually, when you want the packaging exercised before a tag.
on:
  pull_request:
  workflow_dispatch:
  workflow_call:

permissions:
  contents: read

jobs:
  # Both architectures run the same native build on their own runner. GitHub's
  # arm64 runners are free for public repositories, which is what makes that
  # possible: cross-compiling would be quicker but debhelper skips the test
  # suite whenever the host architecture differs from the build one, and qemu
  # would turn a four-minute job into half an hour.
  package:
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            runner: ubuntu-latest
          - arch: arm64
            runner: ubuntu-24.04-arm
    name: ${{ matrix.arch }}
    runs-on: ${{ matrix.runner }}
    # The package targets Debian trixie, which is what the uConsole runs; the
    # runner's own distribution only supplies the kernel and the CPU.
    container: debian:trixie
    steps:
      # A stock Debian image has no git, and checkout silently falls back to
      # downloading a tarball over the REST API when it cannot find one.
      # ca-certificates is only a Recommends of git, so --no-install-recommends
      # leaves the image with no CA bundle at all and the clone dies on "Problem
      # with the SSL CA cert" -- apt itself is fine, its sources are plain http.
      - name: Install git
        run: |
          apt-get update -qq
          apt-get install -y --no-install-recommends git ca-certificates

      # Whole history and every tag: the binary takes its version from git
      # describe, and checkout's default shallow clone has no tag to find, so a
      # post-release build would lose the tag component and use 0.0.0-hash.
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install build dependencies
        run: ./scripts/build-deb.sh deps

      - name: Build package
        run: ./scripts/build-deb.sh

      # Named to match the DMG jobs' artifacts: release.yml collects every
      # platform's output with one corelet-* pattern.
      - uses: actions/upload-artifact@v4
        with:
          name: corelet-deb-${{ matrix.arch }}
          path: dist/*.deb
          if-no-files-found: error