build.yml

name: Build Debian Package
on:
  workflow_call:
    inputs:
      version:
        description: 'Version to build'
        required: false
        type: string
        default: "1.0.0"
      environment:
        description: 'Environment where the secrets are stored'
        required: false
        type: string
    secrets:
      GPG_PRIVATE_KEY:
        description: 'GPG private key'
        required: false
      GPG_PASSPHRASE:
        description: 'GPG passphrase'
        required: false
    outputs:
      version: 
        description: 'Version of the built package'
        value: ${{ jobs.build-deb.outputs.version }}

jobs:
  build-deb:
    name: Build and attach .deb and .whl packages
    runs-on: 'ubuntu-latest'
    environment: ${{ inputs.environment }}
    outputs:
      version: ${{ steps.is-signed-build.outputs.built-version }}
    permissions: 
      contents: read
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.12"]
        architecture: ["amd64"]
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit
          allowed-endpoints: >
            azure.archive.ubuntu.com:80
            esm.ubuntu.com:443
            files.pythonhosted.org:443
            github.com:443
            motd.ubuntu.com:443
            packages.microsoft.com:443
            pypi.org:443
            repo.anaconda.com:443
            registry-1.docker.io:443
            
      - uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        id: buildx

      - name: Set up Poetry
        uses: pantos-io/ci-workflows/.github/actions/install-poetry@v1
        with:
          python-version: ${{ matrix.python-version }}
          runner-os: 'ubuntu-latest'

      - name: Check secrets
        id: is-signed-build
        run: |
          echo "HAS_SECRETS=$(if [ -n "$GPG_PRIVATE_KEY" ] && [ -n "$GPG_PASSPHRASE" ]; then echo 'true'; else echo 'false'; fi)" >> $GITHUB_OUTPUT
          echo "built-version=$(poetry version --short)" >> $GITHUB_OUTPUT
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
      
      - name: Import GPG key
        if: steps.is-signed-build.outputs.HAS_SECRETS == 'true'
        id: import-gpg
        uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # v6.1.0
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}

      - name: Install signing dependencies
        if: steps.is-signed-build.outputs.HAS_SECRETS == 'true'
        run: |
          sudo apt-get update
          sudo apt-get install -y debsigs

      - name: Ensure version
        if: steps.is-signed-build.outputs.HAS_SECRETS == 'true'
        run: |
          make check-version VERSION=${{ inputs.version }}

      - name: Build package
        run: |
          make docker-debian-build ARGS='--platform=linux/${{ matrix.architecture }} \
            --cache-from=type=gha \
            --builder ${{ steps.buildx.outputs.name }}'

      - name: Sign package
        if: steps.is-signed-build.outputs.HAS_SECRETS == 'true'
        run: |
          debsigs --sign=origin -k ${{ steps.import-gpg.outputs.keyid }} dist/*.deb

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: build-${{ matrix.architecture }}
          path: dist/*