archive.yml

name: archive

on:
    schedule:
        # Observium publishes one tarball and overwrites it in place, so a
        # weekly check is what keeps a build from disappearing unnoticed.
        - cron: "40 4 * * 1"
    workflow_dispatch:

permissions:
    contents: write

concurrency:
    group: archive
    cancel-in-progress: false

jobs:
    archive:
        runs-on: ubuntu-latest
        env:
            GH_TOKEN: ${{ github.token }}
            GH_REPO: ${{ github.repository }}
        steps:
            - name: Checkout
              uses: actions/checkout@v7

            - name: Download the current tarball
              run: |
                  curl -fsSL -o "$RUNNER_TEMP/current.tar.gz" \
                      https://www.observium.org/observium-community-latest.tar.gz
                  echo "sha=$(sha256sum "$RUNNER_TEMP/current.tar.gz" | cut -d' ' -f1)" >> "$GITHUB_ENV"

            - name: Read the CE version
              run: |
                  version=$(tar -xzOf "$RUNNER_TEMP/current.tar.gz" observium/includes/definitions/version.inc.php 2>/dev/null \
                      | sed -n "s/^define('OBSERVIUM_VERSION',[[:space:]]*'\([^']*\)').*/\1/p")
                  # a layout change upstream must not cost us the build itself
                  [ -n "$version" ] || version="unknown-$(date -u +%Y%m%d)"
                  echo "version=$version" >> "$GITHUB_ENV"

            - name: Compare against the last archived tarball
              run: |
                  previous=$(gh release list --limit 1 --json tagName --jq '.[0].tagName // empty')
                  if [ -n "$previous" ]; then
                      gh release download "$previous" --pattern "*.sha256" --dir "$RUNNER_TEMP/previous" || true
                      if [ "$(cut -d' ' -f1 "$RUNNER_TEMP/previous"/*.sha256 2>/dev/null)" = "$sha" ]; then
                          echo "unchanged=1" >> "$GITHUB_ENV"
                          echo "Unchanged since $previous, nothing to archive."
                      fi
                  fi

            - name: Unpack the build into the tree
              if: env.unchanged != '1'
              run: |
                  tar -xzf "$RUNNER_TEMP/current.tar.gz" -C "$RUNNER_TEMP"
                  # keep our own files; logs and rrd ship empty
                  rsync -a --delete-after \
                      --exclude .git \
                      --exclude .github \
                      --exclude README.md \
                      --exclude LICENSE \
                      --exclude logs \
                      --exclude rrd \
                      "$RUNNER_TEMP/observium/" .

                  git config user.name "github-actions[bot]"
                  git config user.email "github-actions[bot]@users.noreply.github.com"
                  git add -A
                  if git diff --cached --quiet; then
                      echo "Tree already matches this build."
                  else
                      git commit -q -m "Update to Observium CE $version"
                      git push
                  fi

            - name: Publish the release
              if: env.unchanged != '1'
              run: |
                  tag="v$version"
                  # same version number, different bytes: keep both
                  if gh release view "$tag" >/dev/null 2>&1; then
                      tag="$tag-$(date -u +%Y%m%d)"
                  fi

                  name="observium-community-$version.tar.gz"
                  mv "$RUNNER_TEMP/current.tar.gz" "$RUNNER_TEMP/$name"
                  (cd "$RUNNER_TEMP" && sha256sum "$name" > "$name.sha256")

                  printf 'Tarball as published by observium.org on %s.\n\nsha256 `%s`\n' \
                      "$(date -u +%Y-%m-%d)" "$sha" > "$RUNNER_TEMP/notes.md"

                  gh release create "$tag" \
                      "$RUNNER_TEMP/$name" "$RUNNER_TEMP/$name.sha256" \
                      --title "Observium CE $version" \
                      --notes-file "$RUNNER_TEMP/notes.md"