build.yml

name: Package builds
on: [push, pull_request]

defaults:
  run:
    shell: bash

jobs:
  verify-builder-sync:
    strategy:
      matrix:
        debian_version:
          - bullseye
          - bookworm
    runs-on: ubuntu-latest
    container: debian:${{ matrix.debian_version }}
    steps:
      - run: |
          apt-get update && apt-get install --yes git git-lfs sudo make
      - uses: actions/checkout@v4
      - uses: actions/checkout@v4
        with:
          repository: "freedomofpress/securedrop-builder"
          path: "securedrop-builder"
          lfs: true
      - name: Install dependencies
        run: |
          cd securedrop-builder
          make install-deps
      - name: Check differences
        run: |
          source ./securedrop-builder/.venv/bin/activate
          PKG_DIR=../client make -C securedrop-builder requirements
          PKG_DIR=../export make -C securedrop-builder requirements
          PKG_DIR=../log make -C securedrop-builder requirements
          PKG_DIR=../proxy make -C securedrop-builder requirements
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          git diff --ignore-matching-lines=# --exit-code
          

  build-debs:
    strategy:
      matrix:
        debian_version:
          - bullseye
          - bookworm
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/checkout@v4
        with:
          repository: "freedomofpress/securedrop-builder"
          path: "securedrop-builder"
          lfs: true
      - name: Build packages
        run: |
          DEBIAN_VERSION=${{ matrix.debian_version }} BUILDER=securedrop-builder ./scripts/build-debs.sh
      - uses: actions/upload-artifact@v4
        with:
          name: build-${{ matrix.debian_version }}
          path: build
          if-no-files-found: error