jh-version.yml

name: JH Version

on:
  workflow_dispatch:
    inputs:
      files:
        description: 'File(s) to run action against (space separated)'
        required: true
  pull_request:
    branches: ["master-jethub"]
  push:
    branches: ["master-jethub"]
    paths:
    - '*.txt'
    - '*.json'
    - '*.png'
    - '.github/workflows/version.yml'
    - homeassistant.pub

env:
  PYTHON_VERSION: "3.12"
  COSIGN_VERSION: "v2.2.3"
  SIGNED_FILES: "apparmor.txt apparmor_beta.txt apparmor_dev.txt apparmor_stable.txt beta.json dev.json stable.json"

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
    - name: Checkout the repository
      uses: actions/checkout@v4

    - name: Lint with JQ
      uses: jethub-homeassistant/actions/helpers/jq@master-jethub

  prepare:
    name: Prepare
    needs: ["lint"]
    runs-on: ubuntu-latest
    outputs:
      files: ${{ steps.calc_file_list.outputs.changed_files }}
      sign_matrix: ${{ steps.calc_file_list.outputs.result }}
    steps:
    - name: Checkout the repository
      uses: actions/checkout@v4

    - name: Get changed files for push
      if: github.event_name == 'push'
      id: changed_files_push
      uses: masesgroup/retrieve-changed-files@v3.0.0
      with:
        format: 'json'

    - name: Calculate files to sign and push
      uses: actions/github-script@v7
      id: calc_file_list
      with:
        script: |
          const signed_files = "${{ env.SIGNED_FILES }}".split(' ')
          if ("${{ github.event_name }}" === "push") {
            changed_files = JSON.parse('${{ steps.changed_files_push.outputs.all }}')
            // Sign all files in case this workflow changes.
            if (changed_files.includes(".github/workflows/version.yml")) {
              changed_files = [...new Set([...changed_files, ...signed_files])]
            }
            core.setOutput("changed_files", changed_files.join(' '))
            return changed_files.filter(value => signed_files.includes(value))
          } else {
            input_files = "${{ github.event.inputs.files }}".split(' ')
            core.setOutput("changed_files", input_files.join(' '))
            return input_files.filter(value => signed_files.includes(value))
          }

  signing:
    name: Sign ${{ matrix.path }}
    needs: ["prepare"]
    if: ${{ (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && needs.prepare.outputs.sign_matrix != '[]' }}
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      packages: write
    strategy:
      matrix:
        path: ${{ fromJson(needs.prepare.outputs.sign_matrix) }}
    steps:
      - name: Checkout the repository
        uses: actions/checkout@v4

      - name: Install SSH key for storage
        uses: shimataro/ssh-key-action@v2
        with:
          key: ${{ secrets.SSH_KEY }}
          known_hosts: ${{ secrets.SSH_KNOWNHOSTS_UPLOAD }}
          if_key_exists: replace

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3.3.0
        with:
          registry: ghcr.io
          username: jethub-homeassistant
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: sigstore/cosign-installer@main
        with:
          cosign-release: ${{ env.COSIGN_VERSION }}

      - name: Setup Python version ${{ env.PYTHON_VERSION }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Upload file
        run: |
          cosign upload blob -f ${{ matrix.path }} ghcr.io/jethub-homeassistant/version/${{ matrix.path }}

      - name: Sign Cosign
        run: |
          cosign sign --yes ghcr.io/jethub-homeassistant/version/${{ matrix.path }}
          cosign sign-blob --yes ${{ matrix.path }} --bundle ${{ matrix.path }}.sig
          #cosign sign --yes --key env://COSIGN_PRIVATE_KEY --output-signature ${{ matrix.path }}.sig ghcr.io/jethub-homeassistant/version/${{ matrix.path }}
        #env:
        #  COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_KEY }}

      - name: Upload signature
        run: |
          #ssh-keyscan update.jethome.ru >"${HOME}/.ssh/known_hosts"
          rsync "${{ matrix.path }}.sig" repo@repo.jethome.ru:/var/www/haversion.jethome.ru/


  upload:
    name: Upload
    needs: ["signing", "prepare"]
    # Make sure to run this job even if signing has been skipped.
    if: ${{ !failure() && !cancelled() && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
    runs-on: ubuntu-latest
    steps:
    - name: Checkout the repository
      uses: actions/checkout@v4

    - name: Install SSH key for storage
      uses: shimataro/ssh-key-action@v2
      with:
        key: ${{ secrets.SSH_KEY }}
        known_hosts: ${{ secrets.SSH_KNOWNHOSTS_UPLOAD }}
        if_key_exists: replace

    - name: Setup Python version ${{ env.PYTHON_VERSION }}
      uses: actions/setup-python@v5
      with:
        python-version: ${{ env.PYTHON_VERSION }}

    - name: Check diff
      id: checkdiff
      run: |
        MESSAGE="Upload new versions: "
        MESSAGESEND=false
        for file in ${{ needs.prepare.outputs.files }}; do
          if [[ "$file" =~ \.json ]]; then
            if [[ "$file" == "dev.json" ]]; then
              continue
            fi
            JSON2=${file}
            JSON=$(mktemp).json
            rsync repo@repo.jethome.ru:/var/www/haversion.jethome.ru/"$file" ${JSON}

            OUTPUT=$(mktemp).json
            OUTPUT2=$(mktemp).json

            cat ${JSON} | jq "{supervisor,cli,dns,audio,multicast,observer}" | jq .core+="$(jq .homeassistant[\"jethub-d1\"] ${JSON})" | jq .hassos+="$(jq .hassos[\"jethub-d1\"] ${JSON})"> ${OUTPUT}
            cat ${JSON2} | jq "{supervisor,cli,dns,audio,multicast,observer}" | jq .core+="$(jq .homeassistant[\"jethub-d1\"] ${JSON2})" | jq .hassos+="$(jq .hassos[\"jethub-d1\"] ${JSON2})"> ${OUTPUT2}

            DIFF=$(diff -y --suppress-common-lines  ${OUTPUT} ${OUTPUT2} | cut -d '|' -f 2 | xargs | sed 's/,$//g' | sed 's/\"//g')
            if [[ -n "${DIFF}" ]]; then

              echo "file${file}=${DIFF}" >> $GITHUB_OUTPUT
              MESSAGE="${MESSAGE}"$'\n'"${file}:"$'\n'"${DIFF}"$'\n'
              MESSAGESEND=true
            fi
            rm -f ${JSON} ${OUTPUT} ${OUTPUT2}
          fi
        done
        if [[ "$MESSAGESEND" == "true" ]]; then
          echo "message<<EOF" >> $GITHUB_OUTPUT
          echo "${MESSAGE}" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT
        fi

    - name: Upload files
      run: |
        for file in ${{ needs.prepare.outputs.files }}; do
          if [[ "$file" =~ \.txt|\.json|\.png ]]; then
            #ssh-keyscan update.jethome.ru >"${HOME}/.ssh/known_hosts"
            rsync "$file" repo@repo.jethome.ru:/var/www/haversion.jethome.ru/
          fi
        done

    - name: Notify
      if: ${{ steps.checkdiff.outputs.message != null }}
      uses: appleboy/telegram-action@master
      with:
        to: ${{ secrets.TELEGRAM_TO }}
        token: ${{ secrets.TELEGRAM_TOKEN }}
        message: |
          ${{ steps.checkdiff.outputs.message }}