name: Build KAMOS ISO

# Builds the KAMOS installer ISO on a runner whose kernel permits the
# mounts osbuild needs. It only *pulls* the finished KAMOS image from
# fcs.tgsad.ae — all source, image builds and the registry stay self-hosted.

on:
  workflow_dispatch:
    inputs:
      variant:
        description: "Which KAMOS variant"
        required: true
        default: "kamos"
        type: choice
        options:
          - kamos
          - kamos-nvidia

jobs:
  iso:
    runs-on: ubuntu-latest
    steps:
      - name: Free disk space (ISO needs ~30 GB)
        uses: jlumbroso/free-disk-space@v1.3.1
        with:
          tool-cache: true
          android: true
          dotnet: true
          haskell: true
          large-packages: true
          docker-images: true
          swap-storage: true

      - name: Allow container mounts (Ubuntu userns hardening)
        run: |
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true

      - name: Pull KAMOS image from self-hosted registry
        run: |
          sudo podman pull "fcs.tgsad.ae/mkm1971_admin/${{ inputs.variant }}:stable"

      - name: Build installer ISO
        run: |
          mkdir -p output
          sudo podman run --rm --privileged \
            -v "$PWD/output:/output" \
            -v /var/lib/containers/storage:/var/lib/containers/storage \
            quay.io/centos-bootc/bootc-image-builder:latest \
            --type anaconda-iso \
            --rootfs btrfs \
            "fcs.tgsad.ae/mkm1971_admin/${{ inputs.variant }}:stable"
          sudo mv output/bootiso/install.iso "output/${{ inputs.variant }}-$(date +%Y%m%d).iso"
          ls -lh output/

      - name: Upload ISO to your Forgejo package registry
        run: |
          RUSER="$(printf "%s" "${{ secrets.REGISTRY_USER }}" | tr -d ' \r\n')"
          RTOKEN="$(printf "%s" "${{ secrets.REGISTRY_TOKEN }}" | tr -d ' \r\n')"
          ISO=$(ls output/*.iso)
          NAME=$(basename "$ISO")
          DATE_TAG=$(date +%Y%m%d)
          sudo chmod a+r "$ISO"
          curl --fail --progress-bar -u "${RUSER}:${RTOKEN}" \
            --upload-file "$ISO" \
            "https://fcs.tgsad.ae/api/packages/mkm1971_admin/generic/kamos-iso/${DATE_TAG}/${NAME}" \
            -o /dev/null
          echo "Done: https://fcs.tgsad.ae/mkm1971_admin/-/packages/generic/kamos-iso/${DATE_TAG}"