name: Unpublish retired packages

# Takes packages out of the channel databases after their recipes are gone
# from master. Deleting a recipe stops it building; this stops pacman
# offering it. Files stay in the bucket (see bin/unpublish-packages).
#
# Only packages with no recipe on master: one that still has a recipe would
# come back on its next publish, and refusing it keeps a typo from pulling a
# live package out of every channel.

on:
  workflow_dispatch:
    inputs:
      packages:
        description: "Space-separated pkgbases whose recipes were removed from master"
        required: true
      channels:
        description: "Channels to remove them from"
        required: true
        default: "edge rc stable"

jobs:
  unpublish:
    runs-on: ubuntu-latest
    environment: publish
    timeout-minutes: 15
    # The publish job's group: one writer per channel database at a time.
    # queue: max, as there: a waiting job is queued, not replaced.
    concurrency:
      group: publish
      cancel-in-progress: false
      queue: max
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Refuse packages that still have a recipe
        env:
          PACKAGES: ${{ github.event.inputs.packages }}
          CHANNELS: ${{ github.event.inputs.channels }}
        run: |
          set -euo pipefail
          for c in $CHANNELS; do
            [[ $c == edge || $c == rc || $c == stable ]] || { echo "::error::Unknown channel: $c"; exit 1; }
          done
          for p in $PACKAGES; do
            [[ $p =~ ^[a-z0-9@._+-]+$ ]] || { echo "::error::Not a package name: $p"; exit 1; }
            if [[ -e pkgbuilds/$p ]]; then
              echo "::error::pkgbuilds/$p still exists on master; remove the recipe first"
              exit 1
            fi
          done

      - name: Unpublish
        env:
          PACKAGES: ${{ github.event.inputs.packages }}
          CHANNELS: ${{ github.event.inputs.channels }}
          RCLONE_CONFIG_R2_TYPE: s3
          RCLONE_CONFIG_R2_PROVIDER: Cloudflare
          RCLONE_CONFIG_R2_NO_CHECK_BUCKET: "true"
          RCLONE_CONFIG_R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          RCLONE_CONFIG_R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          RCLONE_CONFIG_R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
          OMARCHY_PUBLISH_PREFIX: ${{ vars.OMARCHY_PUBLISH_PREFIX }}
        run: |
          set -euo pipefail
          # repo-remove and bsdtar are Arch tools: run in the tested builder
          # image, as the publish job does.
          builder=ghcr.io/omacom/omarchy-pkg-builder:$(bin/builder-image key --arch x86_64 --mirror edge)
          docker pull --quiet "$builder"
          for mirror in $CHANNELS; do
            for arch in x86_64 aarch64; do
              docker run --rm \
                -e OMARCHY_PUBLISH_PREFIX \
                -e RCLONE_CONFIG_R2_TYPE -e RCLONE_CONFIG_R2_PROVIDER -e RCLONE_CONFIG_R2_ENDPOINT -e RCLONE_CONFIG_R2_NO_CHECK_BUCKET \
                -e RCLONE_CONFIG_R2_ACCESS_KEY_ID -e RCLONE_CONFIG_R2_SECRET_ACCESS_KEY \
                -v "$PWD:/w:ro" -w /w "$builder" \
                bin/unpublish-packages --remote R2:omarchy-pkgs --mirror "$mirror" --arch "$arch" $PACKAGES
            done
          done