name: Build and Release ISO Images

on:
  workflow_dispatch:
  schedule:
    - cron: "0 4 1,15 * *" # Run on the 1st and 15th of every month at 4:00 AM UTC

permissions:
  attestations: write
  contents: write

jobs:
  build-isos:
    runs-on: ubuntu-latest

    steps:
      - name: Maximize Space
        uses: easimon/maximize-build-space@fc881a613ad2a34aca9c9624518214ebc21dfc0c # v10
        with:
          overprovision-lvm: true
          remove-android: true
          remove-dotnet: true
          remove-codeql: true
          remove-haskell: true
          remove-docker-images: true

      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install Lix
        uses: ./.github/actions/install-lix

      # we shouldn't really be needing to do this, but sometimes lix isn't
      # build before we get here
      # https://git.lix.systems/lix-project/lix/issues/545
      - name: Loosen apparmor restrictions
        run: |
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

      - name: Build Lilith Iso
        continue-on-error: false
        run: |
          nix build -L .#nixosConfigurations.lilith.config.system.build.isoImage
          cp result/iso/*.iso ./lilith.iso

      - name: Build config
        run: |
          nix build -L .#nixosConfigurations.amaterasu.config.home-manager.users.isabel.home-files
          tar -czvhf dotfiles.tar.gz result/

      - name: Upload Release Artifacts
        run: gh release create "$(date +"%Y-%m-%d")" ./lilith.iso ./dotfiles.tar.gz
        env:
          GH_TOKEN: ${{ github.token }}
