deployment.yaml

name: deployment

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Version tag to build (e.g. v0.2.0). Empty = use ref name."
        required: false
        default: ""

permissions:
  contents: write

env:
  THEOS: ${{ github.workspace }}/theos
  IOS_SDK_VERSION: "16.5"
  LDID_VERSION: "v2.1.5-procursus7"
  LDID_SHA256: "4b8862b2fefa2cd7fa8f88cb0310779619aeaa8c72d6aff22f019b470f2fa99a"

concurrency:
  group: deployment-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest

    steps:
      - name: Resolve tag
        id: tag
        run: |
          if [ -n "${{ inputs.tag }}" ]; then
            echo "value=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
          else
            echo "value=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
          fi

      - name: Checkout source at tag
        uses: actions/checkout@v5
        with:
          ref: ${{ steps.tag.outputs.value }}
          submodules: recursive
          fetch-depth: 0

      - name: Verify control version matches tag
        run: |
          TAG="${{ steps.tag.outputs.value }}"
          VER="${TAG#v}"
          CTRL_VER=$(grep -E '^Version:' control | awk '{print $2}')
          echo "Tag version    : ${VER}"
          echo "Control version: ${CTRL_VER}"
          if [ "${VER}" != "${CTRL_VER}" ]; then
              echo "::error::control Version (${CTRL_VER}) does not match tag (${VER})"
              exit 1
          fi

      - name: Install host build tools
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
              build-essential curl git make perl xz-utils \
              libplist-utils libc++-dev \
              libtinfo6 libncurses6

      - name: Install ldid
        run: |
          curl -L -o /tmp/ldid \
              "https://github.com/ProcursusTeam/ldid/releases/download/${LDID_VERSION}/ldid_linux_x86_64"
          echo "${LDID_SHA256}  /tmp/ldid" | sha256sum -c -
          sudo install -m 0755 /tmp/ldid /usr/local/bin/ldid
          ldid -V || ldid 2>&1 | head -1 || true

      - name: Cache Theos
        id: theos-cache
        uses: actions/cache@v5
        with:
          path: theos
          key: theos-linux-${{ env.IOS_SDK_VERSION }}-v3

      - name: Install Theos
        if: steps.theos-cache.outputs.cache-hit != 'true'
        run: |
          git clone --recursive https://github.com/theos/theos.git "$THEOS"

          ARCH=$(uname -m)
          curl -fsSL \
              "https://github.com/L1ghtmann/llvm-project/releases/latest/download/iOSToolchain-${ARCH}.tar.xz" \
            | tar xJ -C "$THEOS/toolchain"

          mkdir -p "$THEOS/sdks"
          curl -L -o /tmp/sdk.tar.gz \
              "https://github.com/theos/sdks/archive/master.tar.gz"
          tar -xf /tmp/sdk.tar.gz -C /tmp
          cp -R "/tmp/sdks-master/iPhoneOS${IOS_SDK_VERSION}.sdk" \
                "$THEOS/sdks/"

      - name: Verify Theos
        run: |
          test -d "$THEOS/sdks/iPhoneOS${IOS_SDK_VERSION}.sdk"
          test -x "$THEOS/toolchain/linux/iphone/bin/clang"
          "$THEOS/toolchain/linux/iphone/bin/clang" --version

      - name: Build rootless .deb (MobileSubstrate)
        run: |
          make clean
          make package FINALPACKAGE=1
          ls -la packages/

      - name: Build jailed .dylib (Dobby static)
        run: |
          make jailed FINALPACKAGE=1
          ls -la packages/jailed/

      - name: Build chinlan .dylib (iOS 18, __DATA slot table)
        run: |
          make chinlan FINALPACKAGE=1
          ls -la packages/chinlan/

      - name: Sanity-check dylibs (no external hook engine)
        run: |
          for DYLIB in packages/jailed/KiouEngineBridge.dylib \
                       packages/chinlan/KiouEngineBridge.dylib; do
              test -f "$DYLIB"
              if command -v otool >/dev/null 2>&1; then
                  otool -L "$DYLIB"
                  if otool -L "$DYLIB" | grep -E "libsubstrate|libdobby"; then
                      echo "::error::$DYLIB leaks an external hook-engine dependency"
                      exit 1
                  fi
              else
                  strings "$DYLIB" | grep -E "libsubstrate|libdobby\.dylib" \
                      && { echo "::error::$DYLIB leaks an external hook-engine dependency"; exit 1; } \
                      || echo "$DYLIB: no external hook-engine references found"
              fi
          done

      - name: Stage release assets
        id: assets
        run: |
          mkdir -p dist
          cp packages/*.deb dist/
          DEB=$(basename packages/*.deb .deb)
          cp packages/jailed/KiouEngineBridge.dylib \
             "dist/${DEB}-jailed.dylib"
          cp packages/chinlan/KiouEngineBridge.dylib \
             "dist/${DEB}-chinlan.dylib"
          ls -la dist/

      - name: Compute SHA256 checksums
        run: |
          cd dist
          sha256sum * > SHA256SUMS
          cat SHA256SUMS

      - name: Extract release notes from CHANGELOG
        id: notes
        run: |
          TAG="${{ steps.tag.outputs.value }}"
          VER="${TAG#v}"
          awk -v ver="$VER" '
            $0 ~ "^## \\[" ver "\\]" { in_section = 1; print; next }
            in_section && /^## \[/ { exit }
            in_section { print }
          ' CHANGELOG.md > release_notes.md
          if [ ! -s release_notes.md ]; then
            echo "(no CHANGELOG section for ${TAG}; see CHANGELOG.md for context)" \
              > release_notes.md
          fi
          cat release_notes.md

      - name: Publish release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.tag.outputs.value }}
          name: ${{ steps.tag.outputs.value }}
          body_path: release_notes.md
          files: |
            dist/*.deb
            dist/*.dylib
            dist/SHA256SUMS
          fail_on_unmatched_files: true
          prerelease: ${{ contains(steps.tag.outputs.value, '-') }}