CI_flatpak.yml

name: Flatpak

on:
  push:
    branches-ignore:
      - 'l10n_**' # Push events to translation service branches (that begin with "l10n_")
  pull_request:
    # Match all pull requests...
    paths-ignore:
      # Except some text-only files / documentation
      - 'ChangeLog'
      # Except those that only include changes to stats
      - 'data/base/stats/**'
      - 'data/mp/stats/**'
      - 'data/mp/multiplay/script/functions/camTechEnabler.js'
      # Linux-specific example scripts
      - 'doc/hosting/linux_scripts/**'
  # Support running after "Draft Tag Release" workflow completes, as part of automated release process
  workflow_run:
    workflows: ["Draft Tag Release"]
    push:
      tags:
        - '*'
    types:
      - completed
  # Support running on Release "publish" event to build and publish to Flathub
  release:
    types:
      - published

jobs:
  build-flatpak:
    strategy:
      matrix:
        include:
          - name: "Flatpak"
            arch: "x86_64"
            flatpak-arch: "x86_64"
          - name: "Flatpak"
            arch: "arm64"
            flatpak-arch: "aarch64"
      fail-fast: false
    name: '${{ matrix.name }} (${{ matrix.arch }})'
    permissions:
      contents: read
      # needed to generate artifact attestations, see: https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds
      id-token: write
      attestations: write
    runs-on: ubuntu-latest
    if: "!contains(github.event.head_commit.message, '[ci skip]')"
    env:
      WZ_FLATPAK_BUILD_DIR: flatpak_app
      WZ_FLATPAK_TARGET_ARCH: ${{ matrix.flatpak-arch }}
      WZ_FLATPAK_BUILD_ARCH: x86_64
      WZ_FREEDESKTOP_RUNTIME_VERSION: 23.08 # should match runtime-version in .ci/flatpak/net.wz2100.wz2100.yaml.in
    outputs:
      # Needed by the release job - despite this being a matrix job, this should be the same for all, so we can allow whatever is last to persist it
      WZ_GITHUB_REF: ${{ steps.checkout-config.outputs.WZ_GITHUB_REF }}
      WZ_FLATPAK_BRANCH: ${{ steps.settings.outputs.WZ_FLATPAK_BRANCH }}
      WZ_FLATPAK_APPID: ${{ steps.settings.outputs.WZ_FLATPAK_APPID }}
    steps:
    - name: Install Dependencies
      run: |
        echo "::group::apt-get install dependencies"
        sudo apt-get -u update
        DEBIAN_FRONTEND=noninteractive sudo apt-get -y install flatpak python3-aiohttp python3-tenacity dbus-daemon curl
        echo "::endgroup::"

        echo "::group::flatpak remote-add"
        flatpak --user remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
        flatpak --user remote-add --if-not-exists flathub-beta https://flathub.org/beta-repo/flathub-beta.flatpakrepo
        flatpak --user remote-add --if-not-exists gnome-nightly https://nightly.gnome.org/gnome-nightly.flatpakrepo
        echo "::endgroup::"
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0
        path: 'src'
        set-safe-directory: true
    - name: Configure Repo Checkout
      id: checkout-config
      working-directory: '${{ github.workspace }}/src'
      env:
        WORKFLOW_RUN_CONCLUSION: ${{ github.event.workflow_run.conclusion }}
        WORKFLOW_RUN_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
      run: |
        . .ci/githubactions/checkout_config.sh
    - name: Prepare Git Repo for autorevision
      working-directory: '${{ github.workspace }}/src'
      run: cmake -P .ci/githubactions/prepare_git_repo.cmake
    - name: Init Git Submodules
      working-directory: '${{ github.workspace }}/src'
      run: git submodule update --init --recursive
    - name: Compute build variables
      id: settings
      working-directory: '${{ github.workspace }}/src'
      env:
        WZ_TARGET_ARCH: ${{ matrix.arch }}
      run: |
        . .ci/githubactions/export_build_output_desc.sh
        echo "WZ_BUILD_DESC_IS_TAG=${WZ_BUILD_DESC_IS_TAG}" >> $GITHUB_ENV
        echo "WZ_BUILD_DESC_PREFIX=${WZ_BUILD_DESC_PREFIX}" >> $GITHUB_ENV
        WZ_OUTPUT_NAME_SUFFIX=""
        WZ_OUTPUT_FLATPAK_BUNDLE_SUFFIX=""
        WZ_NAME_SUFFIX=""
        if [ "$WZ_BUILD_DESC_IS_TAG" == "false" ]; then
          WZ_OUTPUT_NAME_SUFFIX=".dev_$(echo "${WZ_BUILD_DESC_PREFIX}" | sed 's/[^a-zA-Z0-9]/_/g')"
          WZ_OUTPUT_FLATPAK_BUNDLE_SUFFIX="_$(echo "${WZ_BUILD_DESC_PREFIX}" | sed 's/[^a-zA-Z0-9]/_/g')"
          WZ_NAME_SUFFIX=" ($(echo "${WZ_BUILD_DESC_PREFIX}" | sed 's/[^a-zA-Z0-9\.]/_/g'))"
        fi
        echo "WZ_OUTPUT_NAME_SUFFIX=${WZ_OUTPUT_NAME_SUFFIX}"
        echo "WZ_OUTPUT_NAME_SUFFIX=${WZ_OUTPUT_NAME_SUFFIX}" >> $GITHUB_ENV
        echo "WZ_OUTPUT_NAME_SUFFIX=${WZ_OUTPUT_NAME_SUFFIX}" >> $GITHUB_OUTPUT
        echo "WZ_OUTPUT_FLATPAK_BUNDLE_SUFFIX=${WZ_OUTPUT_FLATPAK_BUNDLE_SUFFIX}"
        echo "WZ_OUTPUT_FLATPAK_BUNDLE_SUFFIX=${WZ_OUTPUT_FLATPAK_BUNDLE_SUFFIX}" >> $GITHUB_OUTPUT
        echo "WZ_NAME_SUFFIX=${WZ_NAME_SUFFIX}" >> $GITHUB_ENV

        WZ_DISTRIBUTOR="UNKNOWN"
        if [ "${GITHUB_REPOSITORY}" == "Warzone2100/warzone2100" ]; then
          WZ_DISTRIBUTOR="wz2100.net"
        fi
        echo "WZ_DISTRIBUTOR=${WZ_DISTRIBUTOR}"
        echo "WZ_DISTRIBUTOR=${WZ_DISTRIBUTOR}" >> $GITHUB_ENV

        WZ_FLATPAK_BRANCH="${WZ_BUILD_DESC_PREFIX}"
        if [ "$WZ_BUILD_DESC_IS_TAG" == "true" ]; then
          SOURCE_TAG="${WZ_GITHUB_REF#refs/tags/}"
          # Verify tag format (three-component version + optional trailing qualifier like "-beta1" or "-rc1") if on a tag
          regex="^([0-9][0-9]*\\.[0-9][0-9]*\\.[0-9][0-9]*)([\-][A-Za-z0-9]+)?$";
          if [[ ! "${SOURCE_TAG}" =~ $regex ]]; then
            echo "Invalid tag version format: \"${SOURCE_TAG}\""
            exit 1
          fi
          SOURCE_TAG_VERSION="${BASH_REMATCH[1]}"
          SOURCE_TAG_QUALIFIER="${BASH_REMATCH[2]:1}"
          echo "SOURCE_TAG_VERSION=\"${SOURCE_TAG_VERSION}\""
          echo "SOURCE_TAG_QUALIFIER=\"${SOURCE_TAG_QUALIFIER}\""

          if [ ! -z "${SOURCE_TAG_QUALIFIER}" ]; then
            WZ_FLATPAK_BRANCH="beta"
            SOURCE_TAG_IS_PRERELEASE="true"
          else
            WZ_FLATPAK_BRANCH="stable"
            SOURCE_TAG_IS_PRERELEASE="false"
          fi

          echo "publish-to-flathub=true" >> $GITHUB_OUTPUT
          echo "SOURCE_TAG_IS_PRERELEASE=${SOURCE_TAG_IS_PRERELEASE}" >> $GITHUB_OUTPUT
        else
          # Verify the "branch" doesn't equal "stable" or "beta" (which are reserved for tag builds)
          # Otherwise reset it to default ("master")
          if [[ "$WZ_FLATPAK_BRANCH" =~ ^(stable|beta)$ ]]; then
            echo "NOTE: Invalid default branch specified for non-release / tag build ($WZ_FLATPAK_BRANCH)... will override"
            WZ_FLATPAK_BRANCH="master"
          fi
          echo "publish-to-flathub=false" >> $GITHUB_OUTPUT
          echo "SOURCE_TAG_IS_PRERELEASE=false" >> $GITHUB_OUTPUT
        fi
        echo "WZ_FLATPAK_BRANCH=${WZ_FLATPAK_BRANCH}"
        echo "WZ_FLATPAK_BRANCH=${WZ_FLATPAK_BRANCH}" >> $GITHUB_OUTPUT

        WZ_FLATPAK_APPID="net.wz2100.wz2100${WZ_OUTPUT_NAME_SUFFIX}"
        echo "WZ_FLATPAK_APPID=${WZ_FLATPAK_APPID}" >> $GITHUB_ENV
        echo "WZ_FLATPAK_APPID=${WZ_FLATPAK_APPID}" >> $GITHUB_OUTPUT
        WZ_FLATPAK_BUNDLE="warzone2100${WZ_OUTPUT_FLATPAK_BUNDLE_SUFFIX}_linux_${WZ_TARGET_ARCH}.flatpak"
        echo "WZ_FLATPAK_BUNDLE=${WZ_FLATPAK_BUNDLE}" >> $GITHUB_ENV
        echo "WZ_FLATPAK_BUNDLE=${WZ_FLATPAK_BUNDLE}" >> $GITHUB_OUTPUT
        WZ_FLATPAK_MIRROR_SCREENSHOTS_URL="https://dl.flathub.org/media/"
        echo "WZ_FLATPAK_MIRROR_SCREENSHOTS_URL=${WZ_FLATPAK_MIRROR_SCREENSHOTS_URL}" >> $GITHUB_ENV
    - name: Generate Flatpak manifest
      working-directory: '${{ github.workspace }}/src'
      shell: bash
      run: |
        ADDITIONAL_CONFIG_OPTIONS=""
        if [[ "$WZ_FLATPAK_TARGET_ARCH" != "$WZ_FLATPAK_BUILD_ARCH" ]]; then
          # Cross compilation is needed
          ADDITIONAL_CONFIG_OPTIONS="-DWZ_CROSS_COMPILE_TARGET_ARCH=${WZ_FLATPAK_TARGET_ARCH}"
        fi
        echo "::group::Generate manifest"
        cmake "-DTEMPLATE_FILE=.ci/flatpak/net.wz2100.wz2100.yaml.in" "-DOUTPUT_FILE=.ci/flatpak/net.wz2100.wz2100.yaml" "-DPROJECT_ROOT=./" "-DWZ_OUTPUT_NAME_SUFFIX=${WZ_OUTPUT_NAME_SUFFIX}" ${ADDITIONAL_CONFIG_OPTIONS} -P .ci/flatpak/generate_flatpak_config.cmake
        echo "::endgroup::"

        echo "::group::Output manifest"
        cat ".ci/flatpak/net.wz2100.wz2100.yaml"
        echo "::endgroup::"
    - name: Install Flatpak manifest deps
      run: |
        # Build SDK
        flatpak install --user -y --noninteractive flathub org.freedesktop.Sdk//${WZ_FREEDESKTOP_RUNTIME_VERSION}
        # Target runtime
        flatpak install --user -y --noninteractive flathub org.freedesktop.Platform/${WZ_FLATPAK_TARGET_ARCH}/${WZ_FREEDESKTOP_RUNTIME_VERSION}

        if [[ "$WZ_FLATPAK_TARGET_ARCH" != "$WZ_FLATPAK_BUILD_ARCH" ]]; then
          # Cross compiler
          flatpak install --user -y --noninteractive flathub org.freedesktop.Sdk.Extension.toolchain-${WZ_FLATPAK_TARGET_ARCH}//${WZ_FREEDESKTOP_RUNTIME_VERSION}
          # SDK For target runtime
          flatpak install --user -y --noninteractive flathub org.freedesktop.Sdk.Compat.${WZ_FLATPAK_TARGET_ARCH}//${WZ_FREEDESKTOP_RUNTIME_VERSION}
        fi

        # Builder (which includes flatpak-builder-lint)
        flatpak install --user flathub -y --noninteractive org.flatpak.Builder
    - name: Build Flatpak
      id: build
      env:
        WZ_FLATPAK_MANIFEST_PATH: src/.ci/flatpak/net.wz2100.wz2100.yaml
        WZ_FLATPAK_LOCAL_REPO_NAME: repo
        WZ_FLATPAK_BRANCH: ${{ steps.settings.outputs.WZ_FLATPAK_BRANCH }}
        SENTRY_IO_DSN: '${{ secrets.CRASHREPORTING_SENTRY_IO_DSN }}'
        DISCORD_RPC_APPID: '${{ secrets.DISCORD_RPC_APPID }}'
      run: |
        dbus-run-session -- bash src/.ci/flatpak/build.sh
    - name: Output generated files listing
      shell: bash
      working-directory: flatpak_app/files
      run: |
        find . -type f
    - name: Lint Flatpak
      continue-on-error: true
      env:
        WZ_FLATPAK_LOCAL_REPO_NAME: ${{ steps.build.outputs.WZ_FLATPAK_LOCAL_REPO_NAME }}
      run: |
        WZ_FLATPAK_BUILD_PATH="${WZ_FLATPAK_BUILD_DIR}/files/share"
        echo "::group::.metainfo.xml file"
        cat "${WZ_FLATPAK_BUILD_PATH}/metainfo/${WZ_FLATPAK_APPID}.metainfo.xml"
        echo "::endgroup::"
        echo "::group::.desktop file"
        cat "${WZ_FLATPAK_BUILD_PATH}/applications/${WZ_FLATPAK_APPID}.desktop"
        echo "::endgroup::"
        dbus-run-session flatpak run --command=flatpak-builder-lint org.flatpak.Builder --exceptions repo "${WZ_FLATPAK_LOCAL_REPO_NAME}"
        echo "flatpak-builder-lint - OK"
    ###############################################################
    # Upload the .flatpak and debugsymbols artifacts
    - name: Upload Artifact
      uses: actions/upload-artifact@v4
      with:
        name: 'warzone2100_linux_flatpak_${{ matrix.arch }}'
        path: ${{ steps.settings.outputs.WZ_FLATPAK_BUNDLE }}
    - name: Upload debug info
      uses: actions/upload-artifact@v4
      with:
        name: 'debugsymbols_linux_flatpak_${{ matrix.arch }}'
        path: |
          flatpak_app/files/bin
          flatpak_app/files/lib/*.so.*
          flatpak_app/files/lib/debug/bin
          flatpak_app/files/lib/debug/lib
        if-no-files-found: 'error'
    - name: Collect additional debug dependency info
      shell: bash
      run: |
        mkdir output_debug_dependency_snapshot
        # Get path to runtime files
        TARGET_FREEDESKTOP_RUNTIME_PATH="$(flatpak info --show-location org.freedesktop.Platform/${WZ_FLATPAK_TARGET_ARCH}/${WZ_FREEDESKTOP_RUNTIME_VERSION})"
        echo "TARGET_FREEDESKTOP_RUNTIME_PATH=${TARGET_FREEDESKTOP_RUNTIME_PATH}"
        export TARGET_FREEDESKTOP_RUNTIME_PATH=${TARGET_FREEDESKTOP_RUNTIME_PATH}
        set +e
        # Note: These libraries will be from the runtime that is installed at the time of the build
        ldd flatpak_app/files/bin/warzone2100 | grep -E -v 'linux-vdso|ld-linux-' | awk 'NF == 4 { system("echo " $1) }'
        ret="$?"
        if [ $ret -eq 0 ]; then
          ldd flatpak_app/files/bin/warzone2100 | grep -E -v 'linux-vdso|ld-linux-' | awk 'NF == 4 { system("cp ${TARGET_FREEDESKTOP_RUNTIME_PATH}/files/lib/${WZ_FLATPAK_TARGET_ARCH}-linux-gnu/" $1 " output_debug_dependency_snapshot") }'
        else
          # ldd fails for non-native architecture, so use objdump for cross-compiled builds
          objdump -p flatpak_app/files/bin/warzone2100 | grep NEEDED | grep -E -v 'linux-vdso|ld-linux-' | awk 'NF == 2 { system("echo " $2 " && cp ${TARGET_FREEDESKTOP_RUNTIME_PATH}/files/lib/${WZ_FLATPAK_TARGET_ARCH}-linux-gnu/" $2 " output_debug_dependency_snapshot") }'
        fi
    - name: Upload additional debug dependency info
      uses: actions/upload-artifact@v4
      with:
        name: 'debugdependencylibsnapshot_linux_flatpak_${{ matrix.arch }}'
        path: |
          output_debug_dependency_snapshot
        if-no-files-found: 'error'
    - name: Generate artifact attestation
      # Run on push to master branch (development build), or tag release automation build
      if: success() && ((github.event_name == 'push' && github.ref == 'refs/heads/master') || (github.event_name == 'workflow_run' && github.event.workflow_run.name == 'Draft Tag Release'))
      uses: actions/attest-build-provenance@v1
      continue-on-error: true
      with:
        subject-path: '${{ steps.settings.outputs.WZ_FLATPAK_BUNDLE }}'
    ###############################################################
    # Package the ostree repo (for use in later publish-release-to-flathub job)
    - name: Tar ostree repo
      if: success() && (github.event_name == 'release' && github.event.action == 'published')
      id: repo-tar
      shell: bash
      env:
        WZ_FLATPAK_LOCAL_REPO_NAME: ${{ steps.build.outputs.WZ_FLATPAK_LOCAL_REPO_NAME }}
        WZ_FLATPAK_BRANCH: ${{ steps.settings.outputs.WZ_FLATPAK_BRANCH }}
      run: |
        REPO_TAR_FILE="repo_${WZ_FLATPAK_BRANCH}.tar"
        tar cvf "${REPO_TAR_FILE}" "${WZ_FLATPAK_LOCAL_REPO_NAME}"
        echo "REPO_TAR_FILE=${REPO_TAR_FILE}" >> $GITHUB_OUTPUT
        echo "Generated: \"${REPO_TAR_FILE}\""
        echo "  -> SHA512: $(sha512sum "${REPO_TAR_FILE}")"
        echo "  -> Size (bytes): $(stat -c %s "${REPO_TAR_FILE}")"
    - name: Upload ostree repo
      if: success() && (github.event_name == 'release' && github.event.action == 'published')
      uses: actions/upload-artifact@v4
      with:
        name: 'ostree_repo_flatpak_${{ matrix.arch }}_${{ steps.settings.outputs.WZ_FLATPAK_BRANCH }}'
        path: '${{ steps.repo-tar.outputs.REPO_TAR_FILE }}'

  upload-debug-symbols:
    name: 'Upload Debug Symbols'
    permissions:
      contents: read
    runs-on: ubuntu-latest
    # Run on push to master branch (development build), or tag release automation build, or release publish event
    if: (github.repository == 'Warzone2100/warzone2100') && ((github.event_name == 'push' && github.ref == 'refs/heads/master') || (github.event_name == 'workflow_run' && github.event.workflow_run.name == 'Draft Tag Release') || (github.event_name == 'release' && github.event.action == 'published'))
    needs: build-flatpak
    environment: upload_symbols
    # For this job to work, the following secrets must be set in the 'upload_symbols' environment:
    # SENTRY_AUTH_TOKEN
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1
          path: 'src'
      - name: Prep Environment
        run: |
          mkdir -p dl-debug/symbols
          mkdir -p dl-debug/additional
          echo "WZ_REPO_PATH=$(pwd)/src" >> $GITHUB_ENV
      - name: Download Debug Symbols
        uses: actions/download-artifact@v4
        with:
          pattern: 'debugsymbols_linux_flatpak_*'
          path: ./dl-debug/symbols
          merge-multiple: false
      - name: Download Additional Debug Files
        uses: actions/download-artifact@v4
        with:
          pattern: 'debugdependencylibsnapshot_linux_flatpak_*'
          path: ./dl-debug/additional
          merge-multiple: false
      - name: Display structure of downloaded files
        run: ls -R
        working-directory: ./dl-debug
      - name: 'Upload debug symbols'
        env:
          SENTRY_AUTH_TOKEN: '${{ secrets.SENTRY_AUTH_TOKEN }}'
          WZ_ARCHIVE_DIR: './dl-debug'
          WZ_GITHUB_REF: ${{needs.build-flatpak.outputs.WZ_GITHUB_REF}}
        run: |
          echo "WZ_GITHUB_REF=${WZ_GITHUB_REF}"
          if [[ -z "${SENTRY_AUTH_TOKEN}" ]]; then
            echo "No SENTRY_AUTH_TOKEN - skipping"
            exit 0
          fi
          # Download sentry-cli
          echo "::group::Downloading sentry-cli ..."
          cmake -P "${WZ_REPO_PATH}/.ci/githubactions/FetchSentryCLI.cmake"
          echo "Downloading sentry-cli ... Done"
          echo "::endgroup::"
          # Upload symbols
          echo "::group::sentry-cli debug-files upload"
          ./sentry-cli/sentry-cli debug-files upload --no-zips -o warzone2100 -p warzone2100 "${WZ_ARCHIVE_DIR}"
          echo "::endgroup::"

  upload-release-builds:
    strategy:
      matrix:
        include:
          - arch: "x86_64"
          - arch: "arm64"
      fail-fast: false
    name: 'Upload Release Build (${{ matrix.arch }})'
    permissions:
      contents: write # Needed to upload to releases
    runs-on: ubuntu-latest
    # Run on tag release automation build
    if: (github.event_name == 'workflow_run' && github.event.workflow_run.name == 'Draft Tag Release') && (github.repository == 'Warzone2100/warzone2100')
    needs: build-flatpak
    steps:
      - name: Prep Environment
        run: |
          mkdir dl-artifacts
      - name: Download Artifacts
        uses: actions/download-artifact@v4
        with:
          name: 'warzone2100_linux_flatpak_${{ matrix.arch }}'
          path: ./dl-artifacts
      - name: Display structure of downloaded files
        run: ls -R
        working-directory: ./dl-artifacts
      - name: Upload .flatpak to release
        working-directory: ./dl-artifacts
        run: |
          SOURCE_TAG="${WZ_GITHUB_REF#refs/tags/}"
          echo "SOURCE_TAG=${SOURCE_TAG}"
          for i in warzone2100*.flatpak; do
            echo "Uploading: ${i}"
            gh release upload "${SOURCE_TAG}" "${i}"
          done
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          WZ_GITHUB_REF: ${{needs.build-flatpak.outputs.WZ_GITHUB_REF}}

  publish-release-to-flathub:
    strategy:
      matrix:
        include:
          - arch: "x86_64"
            flatpak-arch: "x86_64"
          - arch: "arm64"
            flatpak-arch: "aarch64"
      fail-fast: false
    name: 'Publish Release to Flathub (${{ matrix.arch }})'
    permissions:
      contents: read
    runs-on: ubuntu-latest
    # For this job to work, the following secrets must be set in the 'flathub_publish_release' environment:
    # FLATHUB_TOKEN
    # FLATHUB_BETA_TOKEN
    environment: flathub_publish_release
    # Run on release publish event
    if: (github.event_name == 'release' && github.event.action == 'published') && (github.repository == 'Warzone2100/warzone2100')
    needs: build-flatpak
    env:
      WZ_GITHUB_REF: ${{needs.build-flatpak.outputs.WZ_GITHUB_REF}}
      WZ_FLATPAK_BRANCH: ${{needs.build-flatpak.outputs.WZ_FLATPAK_BRANCH}}
      WZ_FLATPAK_APPID: ${{needs.build-flatpak.outputs.WZ_FLATPAK_APPID}}
      WZ_TARGET_ARCH: ${{ matrix.arch }}
      WZ_FLATPAK_TARGET_ARCH: ${{ matrix.flatpak-arch }}
    container:
      image: fedora:latest
      options: --privileged
    steps:
      - name: Install Dependencies
        run: |
          cat /etc/fedora-release

          echo "::group::dnf update"
          dnf update -y
          echo "::endgroup::"
          echo "::group::dnf install dependencies"
          dnf install -y cmake git git-lfs dbus-daemon flatpak flatpak-builder python3-aiohttp python3-tenacity python3-gobject ccache zstd curl appstream
          echo "::endgroup::"

          echo "::group::flatpak remote-add"
          flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
          flatpak remote-add --if-not-exists flathub-beta https://flathub.org/beta-repo/flathub-beta.flatpakrepo
          flatpak remote-add --if-not-exists gnome-nightly https://nightly.gnome.org/gnome-nightly.flatpakrepo
          echo "::endgroup::"

          echo "::group::fetch flat-manager-client"
          curl -Lf https://raw.githubusercontent.com/flatpak/flat-manager/master/flat-manager-client --output /usr/bin/flat-manager-client
          chmod +x /usr/bin/flat-manager-client
          echo "::endgroup::"
      - uses: actions/checkout@v4
        with:
          path: 'src'
          set-safe-directory: true
      - name: Prep Environment
        run: |
          mkdir dl-artifacts
      - name: Download Artifacts
        uses: actions/download-artifact@v4
        with:
          name: 'ostree_repo_flatpak_${{ matrix.arch }}_${{ needs.build-flatpak.outputs.WZ_FLATPAK_BRANCH }}'
          path: ./dl-artifacts
      - name: Display structure of downloaded files
        run: ls -R
        working-directory: ./dl-artifacts
      - name: Untar repo .tar
        shell: bash
        id: untar-repo
        run: |
          REPO_TAR_FILE="repo_${WZ_FLATPAK_BRANCH}.tar"
          WZ_FLATPAK_LOCAL_REPO_NAME="repo_${WZ_FLATPAK_BRANCH}"
          mkdir "${WZ_FLATPAK_LOCAL_REPO_NAME}"
          echo "Retrieved: \"${REPO_TAR_FILE}\""
          echo "  -> SHA512: $(sha512sum "./dl-artifacts/${REPO_TAR_FILE}")"
          echo "  -> Size (bytes): $(stat -c %s "./dl-artifacts/${REPO_TAR_FILE}")"
          echo "::group::tar extract"
          tar --strip-components 1 -xvf "./dl-artifacts/${REPO_TAR_FILE}" -C "${WZ_FLATPAK_LOCAL_REPO_NAME}"
          echo "::endgroup::"
          echo "WZ_FLATPAK_LOCAL_REPO_NAME=${WZ_FLATPAK_LOCAL_REPO_NAME}"
          echo "WZ_FLATPAK_LOCAL_REPO_NAME=${WZ_FLATPAK_LOCAL_REPO_NAME}" >> $GITHUB_ENV
          echo "WZ_FLATPAK_LOCAL_REPO_NAME=${WZ_FLATPAK_LOCAL_REPO_NAME}" >> $GITHUB_OUTPUT
      - name: Display structure of extracted files
        run: ls -R
        working-directory: ./
      - name: Upload Flatpak repo to Flathub
        env:
          FLAT_MANAGER_URL: 'https://hub.flathub.org/'
          FH_REPOSITORY: '${{ env.WZ_FLATPAK_BRANCH }}'
          FH_STABLE_TOKEN: ${{ secrets.FLATHUB_TOKEN }}
          FH_BETA_TOKEN: ${{ secrets.FLATHUB_BETA_TOKEN }}
          WZ_BUILD_LOG_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
        shell: bash --noprofile --norc {0} # no pipefail
        run: |
          # choose which token to use, based on the WZ_FLATPAK_BRANCH
          if [[ "$WZ_FLATPAK_BRANCH" == "stable" ]]; then
            FH_TOKEN="${FH_STABLE_TOKEN}"
          elif [[ "$WZ_FLATPAK_BRANCH" == "beta" ]]; then
            FH_TOKEN="${FH_BETA_TOKEN}"
          else
            echo "ERROR: Invalid branch: ${WZ_FLATPAK_BRANCH}"
            exit 1
          fi
          . src/.ci/flatpak/publish_to_flathub.sh
      ###############################################################
      # If stable release: Also publish to the beta branch
      - name: Build separate beta branch repo from stable repo
        id: build-beta
        if: success() && (needs.build-flatpak.outputs.WZ_FLATPAK_BRANCH == 'stable')
        shell: bash
        env:
          SRC_LOCAL_REPO_NAME: ${{ steps.untar-repo.outputs.WZ_FLATPAK_LOCAL_REPO_NAME }}
        run: |
          # Create a new repository for the beta branch
          echo "::group::Creating new local repo for beta branch"
          WZ_FLATPAK_LOCAL_REPO_NAME="${WZ_FLATPAK_TARGET_ARCH}-repo-beta"
          ostree init --mode archive-z2 --repo=${WZ_FLATPAK_LOCAL_REPO_NAME}
          echo "::endgroup::"

          echo "::group::Build commit from stable repo"
          for i in app/${WZ_FLATPAK_APPID} \
            runtime/${WZ_FLATPAK_APPID}.Debug
          do
            # Move the commits to the beta repo
            echo "Processing: --src-ref=${i}/${WZ_FLATPAK_TARGET_ARCH}/${WZ_FLATPAK_BRANCH}"
            flatpak build-commit-from --update-appstream --no-update-summary --src-ref=${i}/${WZ_FLATPAK_TARGET_ARCH}/${WZ_FLATPAK_BRANCH} --src-repo=${SRC_LOCAL_REPO_NAME} \
              ${WZ_FLATPAK_LOCAL_REPO_NAME} ${i}/${WZ_FLATPAK_TARGET_ARCH}/beta
          done
          echo "::endgroup::"
          echo "WZ_FLATPAK_LOCAL_REPO_NAME=${WZ_FLATPAK_LOCAL_REPO_NAME}"
          echo "WZ_FLATPAK_LOCAL_REPO_NAME=${WZ_FLATPAK_LOCAL_REPO_NAME}" >> $GITHUB_OUTPUT
      - name: Upload additional beta Flatpak repo to Flathub
        if: success() && (needs.build-flatpak.outputs.WZ_FLATPAK_BRANCH == 'stable')
        env:
          FLAT_MANAGER_URL: 'https://hub.flathub.org/'
          FH_REPOSITORY: beta
          FH_TOKEN: ${{ secrets.FLATHUB_BETA_TOKEN }}
          WZ_BUILD_LOG_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
          WZ_FLATPAK_LOCAL_REPO_NAME: ${{ steps.build-beta.outputs.WZ_FLATPAK_LOCAL_REPO_NAME }}
        shell: bash --noprofile --norc {0} # no pipefail
        run: |
          . src/.ci/flatpak/publish_to_flathub.sh