configuration.nix/.forgejo/workflows/iso-nixos-installer.yaml

on: [push]
jobs:
  build-installer:
    runs-on: builder
    steps:
      - uses: https://code.forgejo.org/actions/checkout@v4
      - run: nix build ./installer
      - name: Publish release if ISO changed
        env:
          TOKEN: ${{ gitea.token }}
          SERVER: ${{ gitea.server_url }}
          REPO: ${{ gitea.repository }}
        run: |
          ISO="result/iso/mirea-nixos-installer.iso"
          NEW_SHA=$(sha256sum "$ISO" | awk '{print $1}')

          LATEST_BODY=$(curl -sf \
            -H "Authorization: token $TOKEN" \
            "$SERVER/api/v1/repos/$REPO/releases/latest" \
            | jq -r '.body // ""' || echo "")
          OLD_SHA=$(echo "$LATEST_BODY" | grep -oE '[a-f0-9]{64}' | head -1 || echo "")

          if [ "$NEW_SHA" = "$OLD_SHA" ]; then
            echo "ISO unchanged (sha256: $NEW_SHA), skipping release."
            exit 0
          fi

          TAG="iso-$(date -u +%Y%m%d-%H%M%S)"
          RELEASE_ID=$(curl -sf -X POST \
            -H "Authorization: token $TOKEN" \
            -H "Content-Type: application/json" \
            "$SERVER/api/v1/repos/$REPO/releases" \
            -d "$(jq -n --arg tag "$TAG" --arg sha "$NEW_SHA" \
              '{tag_name: $tag, name: ("NixOS Installer " + $tag), body: $sha}')" \
            | jq -r '.id')

          curl -sf -X POST \
            -H "Authorization: token $TOKEN" \
            -H "Content-Type: application/octet-stream" \
            "$SERVER/api/v1/repos/$REPO/releases/$RELEASE_ID/assets?name=mirea-nixos-installer.iso" \
            --data-binary "@$ISO"

          echo "Published release $TAG (sha256: $NEW_SHA)"