ca-certificates-brazil/.github/workflows/ci.yml

name: Build and Release CI
on:
  push:
  schedule:
    - cron: '30 4 1,15 * *'
  workflow_dispatch:

jobs:
  release-ci:
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.get_metadata.outputs.tag }}
      to_release: ${{ steps.newtag.outputs.to_release }}

    steps:
      - name: Local checkout
        uses: actions/checkout@v4

      - name: Install CI dependencies
        run: |
          sudo apt-get update
          sudo apt-get -y -qq install cmake openssl g++ gcc

      - name: Get latest package metadata
        id: get_metadata
        run: |
          cmake --fresh -B build -S .
          echo "tag=v$(cat build/version)" >> $GITHUB_OUTPUT
          echo "hash=$(sha256sum build/hash | sed 's/\s.*//g')" >> $GITHUB_OUTPUT
          
      - name: Check if package version has corresponding git tag
        id: tagged
        shell: bash
        run: |
          git show-ref \
            --tags --verify --quiet -- \
            "refs/tags/${{ steps.get_metadata.outputs.tag }}" \
          && echo tagged=1 >> $GITHUB_OUTPUT \
          || echo tagged=0 >> $GITHUB_OUTPUT

      - name: Create new tag and set to_release
        id: newtag
        if: steps.tagged.outputs.tagged == 0
        run: |
          git config --global user.name "github-actions[bot]"
          git config --global user.email "github-actions[bot]@users.noreply.github.com"
          git tag -a ${{ steps.get_metadata.outputs.tag }} \
            -m "New cert chain was released" \
            --trailer "SHA256:${{ steps.get_metadata.outputs.hash }}" \
          && echo to_release=1 >> $GITHUB_OUTPUT \
          && git push origin ${{ steps.get_metadata.outputs.tag  }} \
          || exit 0

  build-fedora:
    needs: release-ci
    uses: ./.github/workflows/fedora.yml
    with:
      containers: "['fedora:latest', 'fedora:41']"
      to_release: ${{ needs.release-ci.outputs.to_release }}
      tag: ${{ needs.release-ci.outputs.tag }}