release.yml

name: release

on:
  push:
    tags:
      - v*
  workflow_dispatch:

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

permissions:
  contents: write

jobs:
  rust-stable:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Build
        run: cargo build --verbose

  # -------------------------------------------------------------------------
  # STANDARD LINUX TARGETS (Musl, GNU x86/ARM)
  # Builds: minimal, coord, mt-pubsub
  # -------------------------------------------------------------------------

  linux-x86_64-musl:
    runs-on: ubuntu-latest
    needs: [rust-stable]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Dependencies
        run: sudo apt-get update && sudo apt-get install -y musl-tools
      - name: Build Variants
        env:
          RUST_TARGET: x86_64-unknown-linux-musl
        run: |
          rustup target add $RUST_TARGET
          # Helper alias for static linking
          CARGO_CMD="cargo build --target $RUST_TARGET --profile full-release"
          export RUSTFLAGS="-C target-feature=+crt-static"

          $CARGO_CMD --package minot --bin minot --no-default-features
          mkdir -p dist/min && cp target/$RUST_TARGET/full-release/minot dist/min/

          $CARGO_CMD --package minot --bin minot --features embed-coord
          mkdir -p dist/co && cp target/$RUST_TARGET/full-release/minot dist/co/

          $CARGO_CMD --package minot --bin minot --features embed-coord,embed-mt-pubsub
          mkdir -p dist/rat && cp target/$RUST_TARGET/full-release/minot dist/rat/

          $CARGO_CMD --package minot --bin minot-coord
          $CARGO_CMD --package mt_wind --bin wind-mt-pubsub --features mt_pubsub
          $CARGO_CMD --package mt_wind --bin wind-ros2-native --features ros2-native
          $CARGO_CMD --package mt_rat --lib 

          cp target/$RUST_TARGET/full-release/minot-coord dist/
          cp target/$RUST_TARGET/full-release/wind-mt-pubsub dist/
          cp target/$RUST_TARGET/full-release/wind-ros2-native dist/
          cp target/$RUST_TARGET/full-release/librat.a dist/
          cp mt_rat/rat.h dist/

      - name: "Archive binary"
        run: |
          TARGET=x86_64-unknown-linux-musl
          mv dist minot-$TARGET
          tar czvf minot-$TARGET.tar.gz minot-$TARGET
          shasum -a 256 minot-$TARGET.tar.gz > minot-$TARGET.tar.gz.sha256

      - name: "Upload binary"
        uses: actions/upload-artifact@v4
        with:
          name: artifacts-x86_64-unknown-linux-musl
          path: |
            *.tar.gz
            *.sha256

  linux-x86_64-gnu:
    runs-on: ubuntu-latest
    needs: [rust-stable]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Install cargo-deb --locked
        run: cargo install cargo-deb --locked
      - name: Build Variants
        env:
          RUST_TARGET: x86_64-unknown-linux-gnu
        run: |
          rustup target add $RUST_TARGET
          CARGO_CMD="cargo build --target $RUST_TARGET --profile full-release"

          $CARGO_CMD --package minot --bin minot --no-default-features
          mkdir -p dist/min && cp target/$RUST_TARGET/full-release/minot dist/min/

          $CARGO_CMD --package minot --bin minot --features embed-coord
          mkdir -p dist/co && cp target/$RUST_TARGET/full-release/minot dist/co/

          $CARGO_CMD --package minot --bin minot --features embed-coord,embed-mt-pubsub
          mkdir -p dist/rat && cp target/$RUST_TARGET/full-release/minot dist/rat/

          $CARGO_CMD --package minot --bin minot-coord
          $CARGO_CMD --package mt_wind --bin wind-mt-pubsub --features mt_pubsub
          $CARGO_CMD --package mt_wind --bin wind-ros2-native --features ros2-native
          $CARGO_CMD --package mt_wind --bin wind-ros1-native --features ros1-native
          $CARGO_CMD --package mt_rat --lib 

          cp target/$RUST_TARGET/full-release/minot-coord dist/
          cp target/$RUST_TARGET/full-release/wind-mt-pubsub dist/
          cp target/$RUST_TARGET/full-release/wind-ros2-native dist/
          cp target/$RUST_TARGET/full-release/wind-ros1-native dist/
          cp target/$RUST_TARGET/full-release/librat.a dist/
          cp target/$RUST_TARGET/full-release/librat.so dist/
          cp mt_rat/rat.h dist/

          # Prepare pkg-config and cmake files
          VERSION="${GITHUB_REF_NAME#v}"
          sed "s/VERSION_PLACEHOLDER/${VERSION}/g" mt_rat/librat.pc > mt_rat/librat.pc.tmp && mv mt_rat/librat.pc.tmp mt_rat/librat.pc
          sed "s/VERSION_PLACEHOLDER/${VERSION}/g" mt_rat/libratConfig.cmake > mt_rat/libratConfig.cmake.tmp && mv mt_rat/libratConfig.cmake.tmp mt_rat/libratConfig.cmake

          # Create Debian Package
          cargo deb --package mt_rat --target $RUST_TARGET --no-build --profile full-release
          cargo deb --package minot --target $RUST_TARGET --no-build --profile full-release
          find target/$RUST_TARGET/debian -name "*.deb" -exec cp {} dist/ \;
          find target/$RUST_TARGET/debian -name "*.deb" -exec cp {} . \;

      - name: "Archive binary"
        run: |
          TARGET=x86_64-unknown-linux-gnu
          mv dist minot-$TARGET
          tar czvf minot-$TARGET.tar.gz minot-$TARGET
          shasum -a 256 minot-$TARGET.tar.gz > minot-$TARGET.tar.gz.sha256

      - name: "Upload binary"
        uses: actions/upload-artifact@v4
        with:
          name: artifacts-x86_64-unknown-linux-gnu
          path: |
            *.tar.gz
            *.sha256
            *.deb

  linux-aarch64-gnu:
    runs-on: ubuntu-latest
    needs: [rust-stable]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Dependencies
        run: |
          sudo apt-get update && sudo apt-get install -y gcc-aarch64-linux-gnu
          cargo install cargo-deb --locked
      - name: Build Variants
        env:
          RUST_TARGET: aarch64-unknown-linux-gnu
        run: |
          rustup target add $RUST_TARGET
          CARGO_CMD="cargo build --target $RUST_TARGET --profile full-release"

          # Variants
          $CARGO_CMD --package minot --bin minot --no-default-features
          mkdir -p dist/min && cp target/$RUST_TARGET/full-release/minot dist/min/

          $CARGO_CMD --package minot --bin minot --features embed-coord
          mkdir -p dist/co && cp target/$RUST_TARGET/full-release/minot dist/co/

          $CARGO_CMD --package minot --bin minot --features embed-coord,embed-mt-pubsub
          mkdir -p dist/rat && cp target/$RUST_TARGET/full-release/minot dist/rat/

          # Sidecars
          $CARGO_CMD --package minot --bin minot-coord
          $CARGO_CMD --package mt_rat --lib 

          cp target/$RUST_TARGET/full-release/minot-coord dist/
          cp target/$RUST_TARGET/full-release/librat.a dist/
          cp target/$RUST_TARGET/full-release/librat.so dist/
          cp mt_rat/rat.h dist/

          # Prepare pkg-config and cmake files
          VERSION="${GITHUB_REF_NAME#v}"
          sed "s/VERSION_PLACEHOLDER/${VERSION}/g" mt_rat/librat.pc > mt_rat/librat.pc.tmp && mv mt_rat/librat.pc.tmp mt_rat/librat.pc
          sed "s/VERSION_PLACEHOLDER/${VERSION}/g" mt_rat/libratConfig.cmake > mt_rat/libratConfig.cmake.tmp && mv mt_rat/libratConfig.cmake.tmp mt_rat/libratConfig.cmake

          # Create Debian Package
          cargo deb --package mt_rat --target $RUST_TARGET --no-build --profile full-release
          cargo deb --package minot --target $RUST_TARGET --no-build --profile full-release
          find target/$RUST_TARGET/debian -name "*.deb" -exec cp {} dist/ \;
          find target/$RUST_TARGET/debian -name "*.deb" -exec cp {} . \;

      - name: "Archive binary"
        run: |
          TARGET=aarch64-unknown-linux-gnu
          mv dist minot-$TARGET
          tar czvf minot-$TARGET.tar.gz minot-$TARGET
          shasum -a 256 minot-$TARGET.tar.gz > minot-$TARGET.tar.gz.sha256

      - name: "Upload binary"
        uses: actions/upload-artifact@v4
        with:
          name: artifacts-aarch64-unknown-linux-gnu
          path: |
            *.tar.gz
            *.sha256
            *.deb

  linux-armv7-gnu:
    runs-on: ubuntu-latest
    needs: [rust-stable]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Dependencies
        run: |
          sudo apt-get update && sudo apt-get install -y gcc-arm-linux-gnueabihf
          cargo install cargo-deb --locked
      - name: Build Variants
        env:
          RUST_TARGET: armv7-unknown-linux-gnueabihf
        run: |
          rustup target add $RUST_TARGET
          CARGO_CMD="cargo build --target $RUST_TARGET --profile full-release"

          # Variants
          $CARGO_CMD --package minot --bin minot --no-default-features
          mkdir -p dist/min && cp target/$RUST_TARGET/full-release/minot dist/min/

          $CARGO_CMD --package minot --bin minot --features embed-coord
          mkdir -p dist/co && cp target/$RUST_TARGET/full-release/minot dist/co/

          $CARGO_CMD --package minot --bin minot --features embed-coord,embed-mt-pubsub
          mkdir -p dist/rat && cp target/$RUST_TARGET/full-release/minot dist/rat/

          # Sidecars
          $CARGO_CMD --package minot --bin minot-coord
          $CARGO_CMD --package mt_wind --bin wind-mt-pubsub --features mt_pubsub
          $CARGO_CMD --package mt_rat --lib 

          cp target/$RUST_TARGET/full-release/minot-coord dist/
          cp target/$RUST_TARGET/full-release/wind-mt-pubsub dist/
          cp target/$RUST_TARGET/full-release/librat.a dist/
          cp target/$RUST_TARGET/full-release/librat.so dist/
          cp mt_rat/rat.h dist/

          # Prepare pkg-config and cmake files
          VERSION="${GITHUB_REF_NAME#v}"
          sed "s/VERSION_PLACEHOLDER/${VERSION}/g" mt_rat/librat.pc > mt_rat/librat.pc.tmp && mv mt_rat/librat.pc.tmp mt_rat/librat.pc
          sed "s/VERSION_PLACEHOLDER/${VERSION}/g" mt_rat/libratConfig.cmake > mt_rat/libratConfig.cmake.tmp && mv mt_rat/libratConfig.cmake.tmp mt_rat/libratConfig.cmake

          # Create Debian Package
          cargo deb --package mt_rat --target $RUST_TARGET --no-build --profile full-release
          cargo deb --package minot --target $RUST_TARGET --no-build --profile full-release
          find target/$RUST_TARGET/debian -name "*.deb" -exec cp {} dist/ \;
          find target/$RUST_TARGET/debian -name "*.deb" -exec cp {} . \;

      - name: "Archive binary"
        run: |
          TARGET=armv7-unknown-linux-gnueabihf
          mv dist minot-$TARGET
          tar czvf minot-$TARGET.tar.gz minot-$TARGET
          shasum -a 256 minot-$TARGET.tar.gz > minot-$TARGET.tar.gz.sha256

      - name: "Upload binary"
        uses: actions/upload-artifact@v4
        with:
          name: artifacts-armv7-unknown-linux-gnueabihf
          path: |
            *.tar.gz
            *.sha256
            *.deb

  # -------------------------------------------------------------------------
  # MACOS TARGETS
  # Builds: minimal, coord, mt_pubsub
  # -------------------------------------------------------------------------

  macos-aarch64:
    runs-on: macos-latest
    needs: [rust-stable]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Build Variants
        env:
          RUST_TARGET: aarch64-apple-darwin
        run: |
          rustup target add $RUST_TARGET
          CARGO_CMD="cargo build --target $RUST_TARGET --profile full-release"

          $CARGO_CMD --package minot --bin minot --no-default-features
          mkdir -p dist/min && cp target/$RUST_TARGET/full-release/minot dist/min/

          $CARGO_CMD --package minot --bin minot --features embed-coord
          mkdir -p dist/co && cp target/$RUST_TARGET/full-release/minot dist/co/

          $CARGO_CMD --package minot --bin minot --features embed-coord,embed-mt-pubsub
          mkdir -p dist/rat && cp target/$RUST_TARGET/full-release/minot dist/rat/

          $CARGO_CMD --package minot --bin minot-coord
          $CARGO_CMD --package mt_wind --bin wind-mt-pubsub --features mt_pubsub
          $CARGO_CMD --package mt_wind --bin wind-ros2-native --features ros2-native
          $CARGO_CMD --package mt_wind --bin wind-ros1-native --features ros1-native
          $CARGO_CMD --package mt_rat --lib 

          cp target/$RUST_TARGET/full-release/minot-coord dist/
          cp target/$RUST_TARGET/full-release/wind-mt-pubsub dist/
          cp target/$RUST_TARGET/full-release/wind-ros2-native dist/
          cp target/$RUST_TARGET/full-release/wind-ros1-native dist/
          cp target/$RUST_TARGET/full-release/librat.a dist/
          cp target/$RUST_TARGET/full-release/librat.dylib dist/
          cp mt_rat/rat.h dist/

          # Prepare pkg-config and cmake files
          VERSION="${GITHUB_REF_NAME#v}"
          sed "s/VERSION_PLACEHOLDER/${VERSION}/g" mt_rat/librat.pc > dist/librat.pc
          sed "s/VERSION_PLACEHOLDER/${VERSION}/g" mt_rat/libratConfig.cmake > dist/libratConfig.cmake

      - name: "Archive binary"
        run: |
          TARGET=aarch64-apple-darwin
          mv dist minot-$TARGET
          tar czvf minot-$TARGET.tar.gz minot-$TARGET
          shasum -a 256 minot-$TARGET.tar.gz > minot-$TARGET.tar.gz.sha256

      - name: "Upload binary"
        uses: actions/upload-artifact@v4
        with:
          name: artifacts-aarch64-apple-darwin
          path: |
            *.tar.gz
            *.sha256

  # -------------------------------------------------------------------------
  # ROS TARGETS (Jazzy / Humble)
  # Builds: minimal, coord, mt_pubsub AND ros2, wind-ros2
  # -------------------------------------------------------------------------

  jazzy-linux-x86_64-gnu:
    runs-on: ubuntu-24.04
    needs: [rust-stable]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Dependencies
        run: |
          sudo apt-get install -y curl git unzip clang
          sudo apt-get update --assume-yes && sudo apt-get install locales --assume-yes
          sudo locale-gen en_US en_US.UTF-8
          export LANG=en_US.UTF-8
          sudo apt-get install software-properties-common --assume-yes
          # ROS2 Jazzy
          sudo add-apt-repository universe -y
          sudo apt-get update --assume-yes
          sudo curl -sSL https://raw.githubusercontent.com/ros/rosdistro/master/ros.key -o /usr/share/keyrings/ros-archive-keyring.gpg
          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/ros-archive-keyring.gpg] http://packages.ros.org/ros2/ubuntu $(. /etc/os-release && echo $UBUNTU_CODENAME) main" | sudo tee /etc/apt/sources.list.d/ros2.list > /dev/null
          sudo apt-get update --assume-yes && sudo apt-get install ros-dev-tools ros-jazzy-ros-base --assume-yes

      - name: Build Variants
        env:
          RUST_TARGET: x86_64-unknown-linux-gnu
        run: |
          source /opt/ros/jazzy/setup.bash
          rustup target add $RUST_TARGET
          CARGO_CMD="cargo build --target $RUST_TARGET --profile full-release"

          # Feature: embed-ros2-c
          $CARGO_CMD --package minot --bin minot --features embed-coord,embed-ros2-c
          mkdir -p dist/ros2 && cp target/$RUST_TARGET/full-release/minot dist/ros2/

          $CARGO_CMD --package mt_wind --bin wind-ros2-c --features ros2-c
          $CARGO_CMD --package minot --bin minot-coord

          # Copy root artifacts
          cp target/$RUST_TARGET/full-release/wind-ros2-c dist/

      - name: "Archive binary"
        run: |
          TARGET=x86_64-unknown-linux-gnu
          mv dist minot-jazzy-$TARGET
          tar czvf minot-jazzy-$TARGET.tar.gz minot-jazzy-$TARGET
          shasum -a 256 minot-jazzy-$TARGET.tar.gz > minot-jazzy-$TARGET.tar.gz.sha256

      - name: "Upload binary"
        uses: actions/upload-artifact@v4
        with:
          name: artifacts-jazzy-x86_64-unknown-linux-gnu
          path: |
            *.tar.gz
            *.sha256

  deb-jazzy-amd64:
    runs-on: ubuntu-24.04
    needs: [rust-stable]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Dependencies
        run: |
          sudo apt-get install -y curl git unzip clang
          sudo apt-get update --assume-yes && sudo apt-get install locales --assume-yes
          sudo locale-gen en_US en_US.UTF-8
          export LANG=en_US.UTF-8
          sudo apt-get install software-properties-common --assume-yes
          # ROS2 Jazzy
          sudo add-apt-repository universe -y
          sudo apt-get update --assume-yes
          sudo curl -sSL https://raw.githubusercontent.com/ros/rosdistro/master/ros.key -o /usr/share/keyrings/ros-archive-keyring.gpg
          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/ros-archive-keyring.gpg] http://packages.ros.org/ros2/ubuntu $(. /etc/os-release && echo $UBUNTU_CODENAME) main" | sudo tee /etc/apt/sources.list.d/ros2.list > /dev/null
          sudo apt-get update --assume-yes && sudo apt-get install ros-dev-tools ros-jazzy-ros-base --assume-yes
          sudo rosdep init
          rosdep update

      - name: Build
        run: |
          source /opt/ros/jazzy/setup.bash
          rustup default stable
          bash ./scripts/make-deb.bash

      - name: "Upload deb"
        uses: actions/upload-artifact@v4
        with:
          name: artifacts-deb-jazzy-amd64
          path: |
            *.deb

  deb-jazzy-arm64:
    runs-on: ubuntu-24.04-arm
    needs: [rust-stable]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Dependencies
        run: |
          sudo apt-get install -y curl git unzip clang
          sudo apt-get update --assume-yes && sudo apt-get install locales --assume-yes
          sudo locale-gen en_US en_US.UTF-8
          export LANG=en_US.UTF-8
          sudo apt-get install software-properties-common --assume-yes
          # ROS2 Jazzy
          sudo add-apt-repository universe -y
          sudo apt-get update --assume-yes
          sudo curl -sSL https://raw.githubusercontent.com/ros/rosdistro/master/ros.key -o /usr/share/keyrings/ros-archive-keyring.gpg
          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/ros-archive-keyring.gpg] http://packages.ros.org/ros2/ubuntu $(. /etc/os-release && echo $UBUNTU_CODENAME) main" | sudo tee /etc/apt/sources.list.d/ros2.list > /dev/null
          sudo apt-get update --assume-yes && sudo apt-get install ros-dev-tools ros-jazzy-ros-base --assume-yes
          sudo rosdep init
          rosdep update

      - name: Build
        run: |
          source /opt/ros/jazzy/setup.bash
          rustup default stable
          bash ./scripts/make-deb.bash

      - name: "Upload deb"
        uses: actions/upload-artifact@v4
        with:
          name: artifacts-deb-jazzy-arm
          path: |
            *.deb

  deb-humble-amd64:
    runs-on: ubuntu-22.04
    needs: [rust-stable]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Dependencies
        run: |
          sudo apt-get install -y curl git unzip clang
          sudo apt-get update --assume-yes && sudo apt-get install locales --assume-yes
          sudo locale-gen en_US en_US.UTF-8
          export LANG=en_US.UTF-8
          sudo apt-get install software-properties-common --assume-yes
          # ROS2 Humble
          sudo add-apt-repository universe -y
          sudo apt-get update --assume-yes
          sudo curl -sSL https://raw.githubusercontent.com/ros/rosdistro/master/ros.key -o /usr/share/keyrings/ros-archive-keyring.gpg
          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/ros-archive-keyring.gpg] http://packages.ros.org/ros2/ubuntu $(. /etc/os-release && echo $UBUNTU_CODENAME) main" | sudo tee /etc/apt/sources.list.d/ros2.list > /dev/null
          sudo apt-get update --assume-yes && sudo apt-get install ros-dev-tools ros-humble-ros-base --assume-yes
          sudo rosdep init
          rosdep update

      - name: Build
        run: |
          source /opt/ros/humble/setup.bash
          rustup default stable
          bash ./scripts/make-deb.bash

      - name: "Upload deb"
        uses: actions/upload-artifact@v4
        with:
          name: artifacts-deb-humble-amd64
          path: |
            *.deb

  deb-humble-arm64:
    runs-on: ubuntu-22.04-arm
    needs: [rust-stable]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Dependencies
        run: |
          sudo apt-get install -y curl git unzip clang
          sudo apt-get update --assume-yes && sudo apt-get install locales --assume-yes
          sudo locale-gen en_US en_US.UTF-8
          export LANG=en_US.UTF-8
          sudo apt-get install software-properties-common --assume-yes
          # ROS2 Humble
          sudo add-apt-repository universe -y
          sudo apt-get update --assume-yes
          sudo curl -sSL https://raw.githubusercontent.com/ros/rosdistro/master/ros.key -o /usr/share/keyrings/ros-archive-keyring.gpg
          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/ros-archive-keyring.gpg] http://packages.ros.org/ros2/ubuntu $(. /etc/os-release && echo $UBUNTU_CODENAME) main" | sudo tee /etc/apt/sources.list.d/ros2.list > /dev/null
          sudo apt-get update --assume-yes && sudo apt-get install ros-dev-tools ros-humble-ros-base --assume-yes
          sudo rosdep init
          rosdep update

      - name: Build
        run: |
          source /opt/ros/humble/setup.bash
          rustup default stable
          bash ./scripts/make-deb.bash

      - name: "Upload deb"
        uses: actions/upload-artifact@v4
        with:
          name: artifacts-deb-humble-arm64
          path: |
            *.deb

  jazzy-linux-aarch64-gnu:
    runs-on: ubuntu-24.04-arm
    needs: [rust-stable]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Dependencies
        run: |
          sudo apt-get install -y curl git unzip clang
          sudo apt-get update --assume-yes && sudo apt-get install locales --assume-yes
          sudo locale-gen en_US en_US.UTF-8
          export LANG=en_US.UTF-8
          sudo apt-get install software-properties-common --assume-yes
          # ROS2 Jazzy
          sudo add-apt-repository universe -y
          sudo apt-get update --assume-yes
          sudo curl -sSL https://raw.githubusercontent.com/ros/rosdistro/master/ros.key -o /usr/share/keyrings/ros-archive-keyring.gpg
          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/ros-archive-keyring.gpg] http://packages.ros.org/ros2/ubuntu $(. /etc/os-release && echo $UBUNTU_CODENAME) main" | sudo tee /etc/apt/sources.list.d/ros2.list > /dev/null
          sudo apt-get update --assume-yes && sudo apt-get install ros-dev-tools ros-jazzy-ros-base --assume-yes

      - name: Build Variants
        env:
          RUST_TARGET: aarch64-unknown-linux-gnu
        run: |
          source /opt/ros/jazzy/setup.bash
          rustup target add $RUST_TARGET
          CARGO_CMD="cargo build --target $RUST_TARGET --profile full-release"

          $CARGO_CMD --package minot --bin minot --features embed-coord,embed-ros2-c
          mkdir -p dist/ros2 && cp target/$RUST_TARGET/full-release/minot dist/ros2/

          $CARGO_CMD --package mt_wind --bin wind-ros2-c --features ros2-c

          cp target/$RUST_TARGET/full-release/wind-ros2-c dist/

      - name: "Archive binary"
        run: |
          TARGET=aarch64-unknown-linux-gnu
          mv dist minot-jazzy-$TARGET
          tar czvf minot-jazzy-$TARGET.tar.gz minot-jazzy-$TARGET
          shasum -a 256 minot-jazzy-$TARGET.tar.gz > minot-jazzy-$TARGET.tar.gz.sha256

      - name: "Upload binary"
        uses: actions/upload-artifact@v4
        with:
          name: artifacts-jazzy-aarch64-unknown-linux-gnu
          path: |
            *.tar.gz
            *.sha256

  humble-linux-x86_64-gnu:
    runs-on: ubuntu-22.04
    needs: [rust-stable]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Dependencies
        run: |
          sudo apt-get install -y curl git unzip clang
          sudo apt-get update --assume-yes && sudo apt-get install locales --assume-yes
          sudo locale-gen en_US en_US.UTF-8
          export LANG=en_US.UTF-8
          sudo apt-get install software-properties-common --assume-yes
          # ROS2 Humble
          sudo add-apt-repository universe -y
          sudo apt-get update --assume-yes
          sudo curl -sSL https://raw.githubusercontent.com/ros/rosdistro/master/ros.key -o /usr/share/keyrings/ros-archive-keyring.gpg
          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/ros-archive-keyring.gpg] http://packages.ros.org/ros2/ubuntu $(. /etc/os-release && echo $UBUNTU_CODENAME) main" | sudo tee /etc/apt/sources.list.d/ros2.list > /dev/null
          sudo apt-get update --assume-yes && sudo apt-get install ros-dev-tools ros-humble-ros-base --assume-yes

      - name: Build Variants
        env:
          RUST_TARGET: x86_64-unknown-linux-gnu
        run: |
          source /opt/ros/humble/setup.bash
          rustup target add $RUST_TARGET
          CARGO_CMD="cargo build --target $RUST_TARGET --profile full-release"

          $CARGO_CMD --package minot --bin minot --features embed-coord,embed-ros2-c-humble
          mkdir -p dist/ros2 && cp target/$RUST_TARGET/full-release/minot dist/ros2/

          # 3. ROS2 + ROS1 Combined (ros2_1)
          # Feature: embed-ros2-c-humble,embed-ros1-native
          $CARGO_CMD --package minot --bin minot --features embed-coord,embed-ros2-c-humble,embed-ros1-native
          mkdir -p dist/ros2_1 && cp target/$RUST_TARGET/full-release/minot dist/ros2_1/

          # 4. Sidecars (wind-ros2-c, wind-ros1-native, minot-coord)
          $CARGO_CMD --package mt_wind --bin wind-ros2-c --features ros2-c,humble
          $CARGO_CMD --package mt_wind --bin wind-ros1-native --features ros1-native

          cp target/$RUST_TARGET/full-release/wind-ros2-c dist/
          cp target/$RUST_TARGET/full-release/wind-ros1-native dist/

      - name: "Archive binary"
        run: |
          TARGET=x86_64-unknown-linux-gnu
          mv dist minot-humble-$TARGET
          tar czvf minot-humble-$TARGET.tar.gz minot-humble-$TARGET
          shasum -a 256 minot-humble-$TARGET.tar.gz > minot-humble-$TARGET.tar.gz.sha256

      - name: "Upload binary"
        uses: actions/upload-artifact@v4
        with:
          name: artifacts-humble-x86_64-unknown-linux-gnu
          path: |
            *.tar.gz
            *.sha256

  humble-linux-aarch64-gnu:
    runs-on: ubuntu-22.04-arm
    needs: [rust-stable]
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Dependencies
        run: |
          sudo apt-get install -y curl git unzip clang
          sudo apt-get update --assume-yes && sudo apt-get install locales --assume-yes
          sudo locale-gen en_US en_US.UTF-8
          export LANG=en_US.UTF-8
          sudo apt-get install software-properties-common --assume-yes
          # ROS2 Humble
          sudo add-apt-repository universe -y
          sudo apt-get update --assume-yes
          sudo curl -sSL https://raw.githubusercontent.com/ros/rosdistro/master/ros.key -o /usr/share/keyrings/ros-archive-keyring.gpg
          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/ros-archive-keyring.gpg] http://packages.ros.org/ros2/ubuntu $(. /etc/os-release && echo $UBUNTU_CODENAME) main" | sudo tee /etc/apt/sources.list.d/ros2.list > /dev/null
          sudo apt-get update --assume-yes && sudo apt-get install ros-dev-tools ros-humble-ros-base --assume-yes

      - name: Build Variants
        env:
          RUST_TARGET: aarch64-unknown-linux-gnu
        run: |
          source /opt/ros/humble/setup.bash
          rustup target add $RUST_TARGET
          CARGO_CMD="cargo build --target $RUST_TARGET --profile full-release"

          $CARGO_CMD --package minot --bin minot --features embed-coord,embed-ros2-c-humble
          mkdir -p dist/ros2 && cp target/$RUST_TARGET/full-release/minot dist/ros2/

          $CARGO_CMD --package minot --bin minot --features embed-coord,embed-ros2-c-humble,embed-ros1-native
          mkdir -p dist/ros2_1 && cp target/$RUST_TARGET/full-release/minot dist/ros2_1/

          $CARGO_CMD --package mt_wind --bin wind-ros2-c --features ros2-c,humble
          $CARGO_CMD --package mt_wind --bin wind-ros1-native --features ros1-native

          cp target/$RUST_TARGET/full-release/wind-ros2-c dist/
          cp target/$RUST_TARGET/full-release/wind-ros1-native dist/

      - name: "Archive binary"
        run: |
          TARGET=aarch64-unknown-linux-gnu
          mv dist minot-humble-$TARGET
          tar czvf minot-humble-$TARGET.tar.gz minot-humble-$TARGET
          shasum -a 256 minot-humble-$TARGET.tar.gz > minot-humble-$TARGET.tar.gz.sha256

      - name: "Upload binary"
        uses: actions/upload-artifact@v4
        with:
          name: artifacts-humble-aarch64-unknown-linux-gnu
          path: |
            *.tar.gz
            *.sha256

  generate-manifest:
    runs-on: ubuntu-latest
    needs:
      [
        macos-aarch64,
        linux-x86_64-musl,
        linux-aarch64-gnu,
        linux-armv7-gnu,
        linux-x86_64-gnu,
        jazzy-linux-x86_64-gnu,
        humble-linux-x86_64-gnu,
        humble-linux-aarch64-gnu,
        jazzy-linux-aarch64-gnu,
      ]
    steps:
      - name: Generate feature manifest
        run: |
          cat > manifest.json <<'EOF'
          {
            "description": "Feature manifest for Minot releases. Each archive contains minot variants in subdirectories and shared artifacts in root.",
            "subdirs": {
              "min": "Minimal (no embeds)",
              "co": "Coord only (embed-coord)",
              "rat": "Coord + mt_pubsub (embed-coord, embed-mt-pubsub)",
              "ros2": "Coord + ROS2-C (embed-coord, embed-ros2-c or embed-ros2-c-humble)",
              "ros2_1": "Coord + ROS2-C + ROS1 (embed-coord, embed-ros2-c-humble, embed-ros1-native)"
            },
            "targets": {
              "minot-x86_64-unknown-linux-musl": {
                "subdirs": ["min", "co", "rat"],
                "features": ["embed-coord", "embed-mt-pubsub"],
                "root_artifacts": ["minot-coord", "wind-mt-pubsub", "wind-ros2-native", "librat.a", "rat.h"]
              },
              "minot-x86_64-unknown-linux-gnu": {
                "subdirs": ["min", "co", "rat"],
                "features": ["embed-coord", "embed-mt-pubsub"],
                "root_artifacts": ["minot-coord", "wind-mt-pubsub", "wind-ros2-native", "wind-ros1-native", "librat.a", "librat.so", "rat.h"]
              },
              "minot-aarch64-unknown-linux-gnu": {
                "subdirs": ["min", "co", "rat"],
                "features": ["embed-coord", "embed-mt-pubsub"],
                "root_artifacts": ["minot-coord", "wind-mt-pubsub", "wind-ros2-native", "wind-ros1-native", "librat.a", "librat.so", "rat.h"]
              },
              "minot-armv7-unknown-linux-gnueabihf": {
                "subdirs": ["min", "co", "rat"],
                "features": ["embed-coord", "embed-mt-pubsub"],
                "root_artifacts": ["minot-coord", "wind-mt-pubsub", "librat.a", "librat.so", "rat.h"]
              },
              "minot-aarch64-apple-darwin": {
                "subdirs": ["min", "co", "rat"],
                "features": ["embed-coord", "embed-mt-pubsub"],
                "root_artifacts": ["minot-coord", "wind-mt-pubsub", "wind-ros2-native", "wind-ros1-native", "librat.a", "librat.dylib", "rat.h"]
              },
              "minot-jazzy-x86_64-unknown-linux-gnu": {
                "subdirs": ["ros2"],
                "features": ["embed-coord", "embed-ros2-c"],
                "ros_distro": "jazzy",
                "root_artifacts": ["wind-ros2-c"],
                "requires_base_target": "minot-x86_64-unknown-linux-gnu"
              },
              "minot-jazzy-aarch64-unknown-linux-gnu": {
                "subdirs": ["ros2"],
                "features": ["embed-coord", "embed-ros2-c"],
                "ros_distro": "jazzy",
                "root_artifacts": ["wind-ros2-c"],
                "requires_base_target": "minot-aarch64-unknown-linux-gnu"
              },
              "minot-humble-x86_64-unknown-linux-gnu": {
                "subdirs": ["ros2", "ros2_1"],
                "features": ["embed-coord", "embed-ros2-c-humble", "embed-ros1-native"],
                "ros_distro": "humble",
                "root_artifacts": ["wind-ros2-c", "wind-ros1-native"],
                "requires_base_target": "minot-x86_64-unknown-linux-gnu"
              },
              "minot-humble-aarch64-unknown-linux-gnu": {
                "subdirs": ["ros2", "ros2_1"],
                "features": ["embed-coord", "embed-ros2-c-humble", "embed-ros1-native"],
                "ros_distro": "humble",
                "root_artifacts": ["wind-ros2-c", "wind-ros1-native"],
                "requires_base_target": "minot-aarch64-unknown-linux-gnu"
              }
            }
          }
          EOF
          cat manifest.json
      - name: Upload manifest
        uses: actions/upload-artifact@v4
        with:
          name: manifest
          path: manifest.json

  linux-pypi:
    runs-on: ${{ matrix.platform.runner }}
    needs: [rust-stable]
    strategy:
      matrix:
        # omitting ppc64le and s390x since they do not compile and probably have other problems than running this software
        platform:
          - runner: ubuntu-22.04
            target: x86_64
          - runner: ubuntu-22.04
            target: x86
          - runner: ubuntu-22.04
            target: aarch64
          - runner: ubuntu-22.04
            target: armv7
    steps:
      - uses: actions/checkout@v4
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        env:
          # Manually define ARM architecture for ring 0.17+ on older GCC
          CFLAGS_aarch64_unknown_linux_gnu: "-D__ARM_ARCH=8"
        with:
          target: ${{ matrix.platform.target }}
          args: --profile full-release --out dist --manifest-path minot/Cargo.toml
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
          manylinux: auto
      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-linux-${{ matrix.platform.target }}
          path: dist

  musllinux-pypi:
    runs-on: ${{ matrix.platform.runner }}
    needs: [rust-stable]
    strategy:
      matrix:
        platform:
          - runner: ubuntu-22.04
            target: x86_64
          - runner: ubuntu-22.04
            target: x86
          - runner: ubuntu-22.04
            target: aarch64
          - runner: ubuntu-22.04
            target: armv7
    steps:
      - uses: actions/checkout@v4
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.platform.target }}
          args: --profile full-release --out dist --manifest-path minot/Cargo.toml
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
          manylinux: musllinux_1_2
      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-musllinux-${{ matrix.platform.target }}
          path: dist

  macos-pypi:
    runs-on: ${{ matrix.platform.runner }}
    needs: [rust-stable]
    strategy:
      matrix:
        platform:
          - runner: macos-14
            target: aarch64
    steps:
      - uses: actions/checkout@v4
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.platform.target }}
          args: --profile full-release --out dist --manifest-path minot/Cargo.toml
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-macos-${{ matrix.platform.target }}
          path: dist

  # Source code to wheel, pip will try to build from source.
  sdist-pypi:
    runs-on: ubuntu-latest
    needs: [rust-stable]
    steps:
      - uses: actions/checkout@v4
      - name: Build sdist
        uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: --out dist --manifest-path minot/Cargo.toml
      - name: Upload sdist
        uses: actions/upload-artifact@v4
        with:
          name: wheels-sdist
          path: dist

  create-release:
    runs-on: ubuntu-latest
    needs:
      [
        generate-manifest,
        deb-humble-amd64,
        deb-humble-arm64,
        deb-jazzy-amd64,
        deb-jazzy-arm64,
        linux-pypi,
        musllinux-pypi,
        macos-pypi,
        sdist-pypi,
      ]
    permissions:
      # Use to sign the release artifacts
      id-token: write
      # Used to upload release artifacts
      contents: write
      # Used to generate artifact attestation
      attestations: write
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts
      - name: List downloaded artifacts (for verification)
        run: ls -R artifacts
      - name: Create Release
        id: create_release
        uses: softprops/action-gh-release@v1
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: artifacts/**/*
          draft: true
          prerelease: false
      - uses: actions/download-artifact@v4
      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: "wheels-*/*"
      - name: Publish to PyPI
        if: startsWith(github.ref, 'refs/tags/')
        uses: PyO3/maturin-action@v1
        env:
          MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
        with:
          command: upload
          args: --non-interactive --skip-existing wheels-*/*

  humble-release-uos-ppa:
    runs-on: ubuntu-latest
    needs: [create-release, deb-humble-arm64, deb-humble-amd64]
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v5
        with:
          pattern: "artifacts-deb-humble-*"
          merge-multiple: true
      - name: Push to PPA
        if: startsWith(github.ref, 'refs/tags/')
        env:
          PPA_DEPLOY_KEY: ${{ secrets.PPA_DEPLOY_KEY }}
          SERIES: "jammy"
          DEB_PATH: "*.deb"
        run: |
          set -euo pipefail
          mkdir -p ~/.ssh
          printf '%s\n' "$PPA_DEPLOY_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan codeberg.org >> ~/.ssh/known_hosts
          export GIT_SSH_COMMAND='ssh -i ~/.ssh/deploy_key -o UserKnownHostsFile=~/.ssh/known_hosts -o StrictHostKeyChecking=yes'
          git clone --depth 1 --filter=blob:none --sparse ssh://git@codeberg.org/uos-robotics/ppa.git ppa
          cd ppa
          git sparse-checkout init --cone
          for s in $SERIES; do
            git sparse-checkout set "ubuntu/pool/main/$s"
            mkdir -p "ubuntu/pool/main/$s"
            cp ../$DEB_PATH "ubuntu/pool/main/$s/"
            git add "ubuntu/pool/main/$s/"*.deb || true
          done
          git config --global user.email $(git log -1 --pretty=format:'%ae')
          git config --global user.name $(git log -1 --pretty=format:'%an')
          git commit -m "ci: add deb(s) from $GITHUB_REPOSITORY@$GITHUB_SHA" || echo "No changes"
          git push origin pages
          shred -u ~/.ssh/deploy_key || rm -f ~/.ssh/deploy_key
          cd ..

  jazzy-release-uos-ppa:
    runs-on: ubuntu-latest
    needs:
      [create-release, deb-jazzy-arm64, deb-jazzy-amd64, humble-release-uos-ppa]
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v5
        with:
          pattern: "artifacts-deb-jazzy-*"
          merge-multiple: true
      - name: Push to PPA
        if: startsWith(github.ref, 'refs/tags/')
        env:
          PPA_DEPLOY_KEY: ${{ secrets.PPA_DEPLOY_KEY }}
          SERIES: "noble"
          DEB_PATH: "*.deb"
        run: |
          sleep 120 # ensure previous PPA pushes are processed before and CI did run
          set -euo pipefail
          mkdir -p ~/.ssh
          printf '%s\n' "$PPA_DEPLOY_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan codeberg.org >> ~/.ssh/known_hosts
          export GIT_SSH_COMMAND='ssh -i ~/.ssh/deploy_key -o UserKnownHostsFile=~/.ssh/known_hosts -o StrictHostKeyChecking=yes'
          git clone --depth 1 --filter=blob:none --sparse ssh://git@codeberg.org/uos-robotics/ppa.git ppa
          cd ppa
          git sparse-checkout init --cone
          for s in $SERIES; do
            git sparse-checkout set "ubuntu/pool/main/$s"
            mkdir -p "ubuntu/pool/main/$s"
            cp ../$DEB_PATH "ubuntu/pool/main/$s/"
            git add "ubuntu/pool/main/$s/"*.deb || true
          done
          git config --global user.email $(git log -1 --pretty=format:'%ae')
          git config --global user.name $(git log -1 --pretty=format:'%an')
          git commit -m "ci: add deb(s) from $GITHUB_REPOSITORY@$GITHUB_SHA" || echo "No changes"
          git push origin pages
          shred -u ~/.ssh/deploy_key || rm -f ~/.ssh/deploy_key
          cd ..

  aur-publish-src:
    runs-on: ubuntu-latest
    needs: [create-release]
    steps:
      - uses: actions/checkout@v4
      - name: Publish AUR package
        uses: KSXGitHub/github-actions-deploy-aur@v4.1.2
        with:
          pkgname: minot
          pkgbuild: ./packaging/arch/PKGBUILD
          commit_username: stelzo
          commit_email: stelzo@steado.de
          ssh_private_key: ${{ secrets.AUR_SSH_KEY }}
          commit_message: Update AUR package
          ssh_keyscan_types: rsa,ecdsa,ed25519

  aur-publish-bin:
    runs-on: ubuntu-latest
    needs: [create-release]
    steps:
      - uses: actions/checkout@v4
      - name: Publish AUR package
        uses: KSXGitHub/github-actions-deploy-aur@v4.1.2
        with:
          pkgname: minot-bin
          pkgbuild: ./packaging/arch-bin/PKGBUILD
          commit_username: stelzo
          commit_email: stelzo@steado.de
          ssh_private_key: ${{ secrets.AUR_SSH_KEY }}
          commit_message: Update AUR package
          ssh_keyscan_types: rsa,ecdsa,ed25519

  homebrew-publish:
    runs-on: ubuntu-latest
    needs: [create-release]
    steps:
      - uses: actions/checkout@v4
      - name: Download macOS artifact
        uses: actions/download-artifact@v4
        with:
          name: artifacts-aarch64-apple-darwin
          merge-multiple: true
      - name: Compute checksum and update formula
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          ARM_SHA=$(sha256sum minot-aarch64-apple-darwin.tar.gz | awk '{print $1}')
          sed "s/VERSION_PLACEHOLDER/${VERSION}/g; \
               s/ARM_SHA256_PLACEHOLDER/${ARM_SHA}/g" \
            packaging/homebrew/minot.rb > minot.rb
      - name: Push to Homebrew tap
        if: startsWith(github.ref, 'refs/tags/')
        env:
          HOMEBREW_TAP_KEY: ${{ secrets.HOMEBREW_TAP_KEY }}
        run: |
          set -euo pipefail
          mkdir -p ~/.ssh
          printf '%s\n' "$HOMEBREW_TAP_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan github.com >> ~/.ssh/known_hosts
          export GIT_SSH_COMMAND='ssh -i ~/.ssh/deploy_key -o UserKnownHostsFile=~/.ssh/known_hosts -o StrictHostKeyChecking=yes'
          git clone --depth 1 git@github.com:uos/homebrew-minot.git tap
          mkdir -p tap/Formula
          cp minot.rb tap/Formula/minot.rb
          cd tap
          git config user.email "stelzo@steado.de"
          git config user.name "stelzo"
          git add Formula/minot.rb
          git commit -m "Update minot to ${GITHUB_REF_NAME}" || echo "No changes"
          git push origin main
          shred -u ~/.ssh/deploy_key || rm -f ~/.ssh/deploy_key

  minot-rat-release-uos-ppa:
    runs-on: ubuntu-latest
    needs: [create-release, jazzy-release-uos-ppa]
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v5
        with:
          pattern: "artifacts-*-unknown-linux-gnu*"
          merge-multiple: true
      - name: Push to PPA
        if: startsWith(github.ref, 'refs/tags/')
        env:
          PPA_DEPLOY_KEY: ${{ secrets.PPA_DEPLOY_KEY }}
          SERIES: "jammy noble"
          DEB_PATH: "*.deb"
        run: |
          sleep 120 # ensure previous PPA pushes are processed before and CI did run
          set -euo pipefail
          mkdir -p ~/.ssh
          printf '%s\n' "$PPA_DEPLOY_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan codeberg.org >> ~/.ssh/known_hosts
          export GIT_SSH_COMMAND='ssh -i ~/.ssh/deploy_key -o UserKnownHostsFile=~/.ssh/known_hosts -o StrictHostKeyChecking=yes'
          git clone --depth 1 --filter=blob:none --sparse ssh://git@codeberg.org/uos-robotics/ppa.git ppa
          cd ppa
          git sparse-checkout init --cone
          for s in $SERIES; do
            git sparse-checkout set "ubuntu/pool/main/$s"
            mkdir -p "ubuntu/pool/main/$s"
            cp ../$DEB_PATH "ubuntu/pool/main/$s/"
            git add "ubuntu/pool/main/$s/"*.deb || true
          done
          git config --global user.email $(git log -1 --pretty=format:'%ae')
          git config --global user.name $(git log -1 --pretty=format:'%an')
          git commit -m "ci: add deb(s) from $GITHUB_REPOSITORY@$GITHUB_SHA" || echo "No changes"
          git push origin pages
          shred -u ~/.ssh/deploy_key || rm -f ~/.ssh/deploy_key
          cd ..