GitHub CI/CD: Upload package to apt repository via R2

linux-debian-apt.yaml

name: Publish Debian Package to R2

on:
  push:
    tags:
      - 'v*.*.*' # Triggers only when you push a version tag (e.g., v1.0.0)

jobs:
  build-and-publish:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # --- 1. Build the .deb (Rust Example - Replace with your build tool if different) ---
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install cargo-deb
        run: cargo install cargo-deb

      - name: Build .deb package
        run: cargo deb

      # --- 2. Setup Repository Environment ---
      - name: Install APT Repository Tools
        # awscli is pre-installed on ubuntu-latest, but we ensure it's up to date alongside apt tools
        run: sudo apt-get update && sudo apt-get install -y dpkg-dev apt-utils awscli gnupg

      - name: Import GPG Key
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
        run: echo "$GPG_PRIVATE_KEY" | gpg --batch --import

      # --- 3. Sync and Update Repository ---
      - name: Pull Existing Repository from R2
        env:
          # Map GitHub Secrets to standard AWS CLI env variables
          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: "auto"
          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
        run: |
          mkdir -p my-apt-repo
          aws s3 sync s3://my-apt-repo ./my-apt-repo --endpoint-url $R2_ENDPOINT

      - name: Update APT Metadata
        run: |
          # Create directories if this is the very first run
          mkdir -p my-apt-repo/pool/main
          mkdir -p my-apt-repo/dists/stable/main/binary-amd64
          
          # Move the newly built package (adjust the source path if not using cargo-deb)
          cp target/debian/*.deb my-apt-repo/pool/main/

          cd my-apt-repo

          # Generate Packages file
          dpkg-scanpackages pool/main /dev/null > dists/stable/main/binary-amd64/Packages
          gzip -k -f dists/stable/main/binary-amd64/Packages

          # Generate Release file
          # (Ensure you have 'apt-release.conf' in the root of your git repository)
          apt-ftparchive -c ../apt-release.conf release dists/stable/ > dists/stable/Release

      - name: Sign Metadata
        env:
          GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: |
          cd my-apt-repo
          
          # Remove old signatures if they exist to prevent signing errors
          rm -f dists/stable/InRelease dists/stable/Release.gpg
          
          # Create InRelease (clearsigned)
          gpg --default-key $GPG_KEY_ID --batch --yes --pinentry-mode loopback \
              --passphrase $GPG_PASSPHRASE \
              --clearsign -o dists/stable/InRelease dists/stable/Release

          # Create Release.gpg (detached signature)
          gpg --default-key $GPG_KEY_ID --batch --yes --pinentry-mode loopback \
              --passphrase $GPG_PASSPHRASE \
              -abs -o dists/stable/Release.gpg dists/stable/Release

      # --- 4. Push Back to R2 ---
      - name: Upload to Cloudflare R2
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: "auto"
          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
        run: |
          aws s3 sync ./my-apt-repo s3://my-apt-repo \
            --endpoint-url $R2_ENDPOINT \
            --delete