Medplum

name: Build deb

concurrency:
  group: ci-build-deb-${{ github.sha }}
  cancel-in-progress: true

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build_deb:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      NODE_VERSION: '22'
      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
      TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
      TURBO_CACHE: 'remote:rw'
    permissions:
      actions: read
      contents: write
      id-token: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Setup Node.js
        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        with:
          node-version: '24'
          registry-url: 'https://registry.npmjs.org'

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build:fast
        env:
          MEDPLUM_BASE_URL: '__MEDPLUM_BASE_URL__'
          MEDPLUM_CLIENT_ID: '__MEDPLUM_CLIENT_ID__'
          MEDPLUM_REGISTER_ENABLED: '__MEDPLUM_REGISTER_ENABLED__'
          GOOGLE_CLIENT_ID: '__GOOGLE_CLIENT_ID__'
          RECAPTCHA_SITE_KEY: '__RECAPTCHA_SITE_KEY__'

      - name: Build Deb
        shell: bash
        run: ./scripts/build-deb.sh

      - name: Set up Ruby
        uses: ruby/setup-ruby@cf7216d52fba1017929b4d7162fabe2b30af5b49 # v1.262.0
        with:
          ruby-version: '3.0'

      - name: Install deb-s3
        run: gem install deb-s3

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Import GPG key
        run: echo "${{ secrets.MEDPLUM_GPG_KEY }}" | gpg --batch --no-tty --import

      - name: Upload to APT repository
        run: |
          deb-s3 upload \
            --bucket apt.medplum.com \
            --prefix debian \
            --component main \
            --visibility nil \
            --preserve-versions \
            --sign=${{ secrets.MEDPLUM_GPG_KEY_ID }} \
            --gpg-options="--passphrase-fd 0 --pinentry-mode loopback" \
            --cache-control="max-age=300" \
            medplum_*.deb \
            < <(echo "${{ secrets.MEDPLUM_GPG_PASSPHRASE }}")