name: Build simd Nightlies

on:
  push:
    branches:
      - main
      - release/v*
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}-simd-nightlies
  cancel-in-progress: true

jobs:
  build:
    timeout-minutes: 15
    runs-on: depot-ubuntu-22.04-4
    permissions:
      contents: read
      id-token: write
      attestations: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - goos: linux
            goarch: amd64
          - goos: linux
            goarch: arm64
          - goos: darwin
            goarch: amd64
          - goos: darwin
            goarch: arm64

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-go@v7
        with:
          go-version-file: "go.mod"
          cache: true

      - name: Install aarch64 cross-compiler
        if: matrix.goos == 'linux' && matrix.goarch == 'arm64'
        run: sudo apt-get update && sudo apt-get install -y gcc-aarch64-linux-gnu binutils-aarch64-linux-gnu

      - name: Build simd
        run: make build-${{ matrix.goos }}-${{ matrix.goarch }}

      - name: Package
        run: |
          set -euo pipefail
          mkdir -p dist
          bin="simd-${{ matrix.goos }}-${{ matrix.goarch }}"
          cp build/simd "dist/$bin"
          chmod +x "dist/$bin"
          tar -C dist -czf "dist/$bin.tar.gz" "$bin"
          sha256sum "dist/$bin.tar.gz" > "dist/$bin.tar.gz.sha256"

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: dist/*.tar.gz

      - uses: actions/upload-artifact@v4
        with:
          name: simd-${{ matrix.goos }}-${{ matrix.goarch }}
          path: dist/*
          if-no-files-found: error
          retention-days: 7

  publish:
    timeout-minutes: 15
    needs: build
    runs-on: depot-ubuntu-22.04-4
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    permissions:
      pages: write
      id-token: write
      contents: read
      actions: read

    steps:
      - uses: actions/checkout@v6

      - name: Install dependencies
        run: sudo apt-get update && sudo apt-get install -y jq gh unzip

      - name: Prepare scripts
        run: chmod +x .github/nightlies/*.sh

      - name: Determine channel
        id: channel
        run: .github/nightlies/determine-channel.sh

      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: Download existing Pages content
        continue-on-error: true
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          EXPECTED_WORKFLOW: .github/workflows/build-simd-nightlies.yml
        run: |
          set -euo pipefail

          mkdir -p existing
          candidates=$(gh api --paginate \
            "repos/$GITHUB_REPOSITORY/actions/artifacts?name=github-pages&per_page=100" \
            --jq '.artifacts
              | map(select(.expired == false))
              | map(select(.workflow_run.repository_id == .workflow_run.head_repository_id))
              | map(select(.workflow_run.head_branch == "main"
                  or (.workflow_run.head_branch | test("^release/v[0-9]+\\.[0-9]+\\.x$"))))
              | .[]
              | "\(.created_at)\t\(.workflow_run.id)\t\(.archive_download_url)"' \
            | sort -r)

          artifact_url=""
          while IFS=$'\t' read -r created_at run_id url; do
            [ -n "$run_id" ] || continue
            run_path=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$run_id" \
              --jq '.path // ""')
            if [ "$run_path" = "$EXPECTED_WORKFLOW" ]; then
              artifact_url="$url"
              break
            fi
            echo "Skipping github-pages artifact from untrusted run $run_id (workflow: ${run_path:-unknown})"
          done <<< "$candidates"

          if [ -z "$artifact_url" ]; then
            echo "No existing Pages artifact found"
            exit 0
          fi

          tmp_zip=$(mktemp /tmp/github-pages-XXXXXX.zip)

          curl -fLsS \
              -H "Authorization: Bearer $GH_TOKEN" \
              "$artifact_url" \
              -o "$tmp_zip"

          unzip -q "$tmp_zip" -d existing
          rm -f "$tmp_zip"

          # upload-pages-artifact stores the site payload as artifact.tar inside the zip.
          if [ -f existing/artifact.tar ]; then
            tar -xf existing/artifact.tar -C existing
            rm -f existing/artifact.tar
          fi

      - name: Build site
        run: |
          .github/nightlies/build-site.sh \
            "${{ steps.channel.outputs.channel }}" \
            "${{ steps.channel.outputs.is_main }}"

      - uses: actions/configure-pages@v6

      - uses: actions/upload-pages-artifact@v5
        with:
          path: site
          retention-days: 90

      - uses: actions/deploy-pages@v5
