ipcheck-domains/.github/workflows/build.yml

name: build

on:
  push:
    branches: [main]
    paths:
      - "data/**"
      - "tools/**"
      - ".github/workflows/build.yml"
  pull_request:
    paths:
      - "data/**"
      - "tools/**"
      - ".github/workflows/build.yml"
  schedule:
    - cron: "17 3 * * *"
  workflow_dispatch:

permissions:
  contents: write

env:
  GH_TOKEN: ${{ github.token }}

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Lint sources
        run: python tools/build.py --check

      - name: Unit tests
        run: python -m unittest discover -s tools -t tools

      - name: Install sing-box
        run: |
          mkdir -p "$GITHUB_WORKSPACE/bin"
          url=$(gh api repos/SagerNet/sing-box/releases/latest \
            --jq '.assets[] | select(.name | test("-linux-amd64\\.tar\\.gz$")) | .browser_download_url')
          echo "sing-box: $url"
          curl -fsSL "$url" | tar -xz --strip-components=1 -C "$GITHUB_WORKSPACE/bin" --wildcards '*/sing-box'
          echo "$GITHUB_WORKSPACE/bin" >> "$GITHUB_PATH"

      - name: Install mihomo
        run: |
          url=$(gh api repos/MetaCubeX/mihomo/releases/latest \
            --jq '.assets[] | select(.name | test("^mihomo-linux-amd64-v[0-9.]+\\.gz$")) | .browser_download_url')
          echo "mihomo: $url"
          curl -fsSL "$url" | gunzip > "$GITHUB_WORKSPACE/bin/mihomo"
          chmod +x "$GITHUB_WORKSPACE/bin/mihomo"

      - name: Build
        run: |
          export SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)
          python tools/build.py

      - name: Validate geosite.dat with Xray
        run: |
          url=$(gh api repos/XTLS/Xray-core/releases/latest \
            --jq '.assets[] | select(.name == "Xray-linux-64.zip") | .browser_download_url')
          curl -fsSL -o xray.zip "$url"
          unzip -o -j xray.zip xray -d "$GITHUB_WORKSPACE/bin"
          chmod +x "$GITHUB_WORKSPACE/bin/xray"

          # Роутинг-правило заставляет Xray реально распарсить geosite.dat.
          # Битый файл или отсутствующий тег -> ненулевой exit code.
          cat > /tmp/xray-test.json <<'EOF'
          {
            "inbounds": [{"port": 10800, "protocol": "socks"}],
            "outbounds": [{"protocol": "freedom", "tag": "direct"}],
            "routing": {
              "rules": [
                {"type": "field", "domain": ["ext:geosite.dat:ipcheck"], "outboundTag": "direct"},
                {"type": "field", "domain": ["ext:geosite.dat:leak-test"], "outboundTag": "direct"}
              ]
            }
          }
          EOF
          XRAY_LOCATION_ASSET="$GITHUB_WORKSPACE/dist" xray run -test -c /tmp/xray-test.json

      - name: Validate sing-box rule-set
        run: |
          sing-box rule-set decompile --output /tmp/ipcheck.json dist/sing-box/ipcheck.srs
          grep -q '"2ip.ru"' /tmp/ipcheck.json

      - name: Release notes
        id: notes
        run: |
          echo "tag=$(date -u '+%Y%m%d%H%M')" >> "$GITHUB_OUTPUT"
          {
            echo "Собрано из \`${GITHUB_SHA::7}\`."
            echo
            echo '| Категория | Правил |'
            echo '| --- | ---: |'
            python -c "import json;[print(f'| {k} | {v} |') for k,v in json.load(open('dist/metadata.json'))['categories'].items()]"
            echo
            echo "sha256(geosite.dat) = \`$(cut -d' ' -f1 dist/geosite.dat.sha256sum)\`"
          } > /tmp/notes.md
          cat /tmp/notes.md >> "$GITHUB_STEP_SUMMARY"

      - uses: actions/upload-artifact@v4
        with:
          name: ipcheck-domains
          path: dist/
          if-no-files-found: error

      - name: Publish to release branch
        if: github.event_name != 'pull_request'
        run: |
          cp README.md dist/README.md
          cp LICENSE dist/LICENSE
          cd dist
          git init -q -b release
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add .
          git commit -q -m "build: $(date -u '+%Y-%m-%d %H:%M UTC') ($GITHUB_SHA)"
          git push -qf "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" release
          cd ..
          rm -f dist/README.md dist/LICENSE

      - name: Create release
        if: github.event_name != 'pull_request'
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.notes.outputs.tag }}
          name: ${{ steps.notes.outputs.tag }}
          body_path: /tmp/notes.md
          files: |
            dist/geosite.dat
            dist/geosite.dat.sha256sum
            dist/metadata.json
            dist/sing-box/*.srs
            dist/mihomo/*.mrs
            dist/clash/*
            dist/txt/*
            dist/json/*
            dist/adguard/*