name: Build release firmware

on:
  release:
    types:
      - published

env:
  PICO_SDK_REF: 2.2.0
  TINYUSB_REF: 0.20.0
  PICO_SDK_PATH: ${{ github.workspace }}/pico-sdk
  APT_PACKAGES: >-
    cmake
    python3
    build-essential
    gcc-arm-none-eabi
    libnewlib-arm-none-eabi
    libstdc++-arm-none-eabi-newlib
    ninja-build

permissions:
  contents: write

jobs:
  build:
    name: Build and upload release UF2
    runs-on: ubuntu-latest

    steps:
      - name: Checkout release ref
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.release.tag_name }}
          submodules: recursive

      - name: Set firmware version
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: printf 'FIRMWARE_VERSION=%s\n' "$RELEASE_TAG" >> "$GITHUB_ENV"

      - name: Prepare build dependency cache
        id: apt-cache
        run: |
          mkdir -p "$RUNNER_TEMP/apt-cache/partial"
          . /etc/os-release
          package_hash="$(printf '%s' "$APT_PACKAGES" | sha256sum | cut -d ' ' -f 1)"
          echo "dir=$RUNNER_TEMP/apt-cache" >> "$GITHUB_OUTPUT"
          echo "os=${ID}-${VERSION_ID}" >> "$GITHUB_OUTPUT"
          echo "package-hash=$package_hash" >> "$GITHUB_OUTPUT"

      - name: Cache build dependencies
        uses: actions/cache@v4
        with:
          path: ${{ steps.apt-cache.outputs.dir }}
          key: ${{ runner.os }}-${{ runner.arch }}-apt-${{ steps.apt-cache.outputs.os }}-${{ steps.apt-cache.outputs.package-hash }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-apt-${{ steps.apt-cache.outputs.os }}-

      - name: Install build dependencies
        run: |
          sudo apt-get update
          sudo apt-get -o Dir::Cache::archives="${{ steps.apt-cache.outputs.dir }}" install --download-only -y $APT_PACKAGES
          sudo apt-get -o Dir::Cache::archives="${{ steps.apt-cache.outputs.dir }}" install -y $APT_PACKAGES
          sudo chmod -R a+rX "${{ steps.apt-cache.outputs.dir }}"

      - name: Cache Pico SDK
        id: cache-pico-sdk
        uses: actions/cache@v4
        with:
          path: ${{ env.PICO_SDK_PATH }}
          key: ${{ runner.os }}-${{ runner.arch }}-pico-sdk-${{ env.PICO_SDK_REF }}-tinyusb-${{ env.TINYUSB_REF }}

      - name: Download Pico SDK
        if: steps.cache-pico-sdk.outputs.cache-hit != 'true'
        run: |
          git clone --depth 1 --branch "$PICO_SDK_REF" https://github.com/raspberrypi/pico-sdk.git "$PICO_SDK_PATH"
          git -C "$PICO_SDK_PATH" submodule update --init --recursive

      - name: Switch TinyUSB to configured tag
        run: |
          if ! git -C "$PICO_SDK_PATH/lib/tinyusb" rev-parse -q --verify "refs/tags/$TINYUSB_REF" >/dev/null; then
            git -C "$PICO_SDK_PATH/lib/tinyusb" fetch --depth 1 origin "refs/tags/$TINYUSB_REF:refs/tags/$TINYUSB_REF"
          fi
          git -C "$PICO_SDK_PATH/lib/tinyusb" checkout --detach "$TINYUSB_REF"

      - name: Build standard firmware
        run: |
          cmake -S . -B build/standard -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DPICO_SDK_PATH="$PICO_SDK_PATH" \
            -DVERSION="$FIRMWARE_VERSION"
          cmake --build build/standard --target ds5-bridge
          mkdir -p artifacts
          cp build/standard/ds5-bridge-oled.uf2 "artifacts/ds5-bridge-oled-${{ github.event.release.tag_name }}.uf2"

      # The debug build (ENABLE_SERIAL=ON) compiles out tud_connect/disconnect and
      # comes up as a serial console rather than a working HID/audio bridge — a
      # developer diagnostic, not an end-user UF2. It is NOT published as a release
      # download (footgun) — build it on demand with -DENABLE_SERIAL=ON, or use the
      # PR-CI compile in build.yml. See CHANGELOG/CLAUDE.md.

      - name: Compute UF2 checksums + append to release notes
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.event.release.tag_name }}
        run: |
          # Generate SHA256SUMS.txt next to the UF2s
          ( cd artifacts && sha256sum *.uf2 > SHA256SUMS.txt )
          cat artifacts/SHA256SUMS.txt
          # Append the same hashes (markdown-formatted) to the existing release body
          BODY=$(gh release view "$TAG" --json body --jq .body)
          {
            printf '%s\n' "$BODY"
            printf '\n---\n\n## Checksums\n\n```\n'
            cat artifacts/SHA256SUMS.txt
            printf '```\n'
          } > /tmp/release-notes.md
          gh release edit "$TAG" --notes-file /tmp/release-notes.md

      - name: Upload UF2 files + SHA256SUMS to release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release upload "${{ github.event.release.tag_name }}" artifacts/*.uf2 artifacts/SHA256SUMS.txt --clobber

      # Notify the web config repo so its GH Pages deploy rebuilds and
      # bundles this fresh UF2 into the site. If the WEB_REPO_DISPATCH_PAT
      # secret isn't configured on this repo, the dispatch call fails 401
      # and continue-on-error swallows it — the web app keeps serving the
      # previously-bundled UF2 until its own deploy is manually triggered.
      - name: Trigger web config rebuild
        continue-on-error: true
        uses: peter-evans/repository-dispatch@v3
        with:
          token: ${{ secrets.WEB_REPO_DISPATCH_PAT }}
          repository: MarcelineVPQ/DS5Dongle-OLED-Config-Web
          event-type: firmware-released
          client-payload: '{"tag": "${{ github.event.release.tag_name }}", "title": "${{ github.event.release.name }}"}'