use brewkit@1

.github/actions/complain/action.yml

@@ -2,8 +2,8 @@ name: pkgx/pantry/complain
 description: creates an issue for failure conditions
 
 inputs:
-  projects:
-    description: projects to complain about
+  pkg:
+    description: project to complain about
     required: true
   platform:
     description: platform key
@@ -12,12 +12,6 @@ inputs:
     description: github token
     required: true
     default: ${{ github.token }}
-  # slack-webhook:
-  #   description: slack webhook
-  #   required: false
-  # slack-channel:
-  #   description: slack channel
-  #   required: false
 
 runs:
   using: composite
@@ -29,7 +23,7 @@ runs:
         actions: 'find-issues'
         token: ${{ inputs.token }}
         issue-state: 'open'
-        title-includes: "❌ build issues: ${{ inputs.projects }}"
+        title-includes: "❌ build issues: ${{ inputs.pkg }}"
         labels: 'build-failure'
 
     - name: Create Issue
@@ -39,8 +33,8 @@ runs:
       with:
         actions: 'create-issue'
         token: ${{ inputs.token }}
-        title: "❌ build issues: ${{ inputs.projects }}"
-        body: "Running log of build failures for ${{ inputs.projects }}"
+        title: "❌ build issues: ${{ inputs.pkg }}"
+        body: "Running log of build failure for ${{ inputs.pkg }}"
         labels: 'build-failure'
         assignees: 'jhheider'
 
@@ -52,18 +46,7 @@ runs:
         issue-number: ${{ steps.create.outputs.issue-number || fromJSON(steps.find.outputs.issues)[0].number }}
         body: |
           # Build failure
-          ## ${{ inputs.projects }}
+          ## ${{ inputs.pkg }}
           ### ${{ inputs.platform }}
 
           logs: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-
-    # - uses: martialonline/workflow-status@v3
-    #   id: status
-
-    # - uses: rtCamp/action-slack-notify@v2
-    #   if: ${{ inputs.slack-webhook != '' }}
-    #   env:
-    #     SLACK_WEBHOOK: ${{ inputs.slack-webhook }}
-    #     SLACK_CHANNEL: ${{ inputs.slack-channel }}
-    #     SLACK_MESSAGE: new-version:${{ inputs.projects }} (${{ inputs.platform }}) ${{ steps.status.outputs.status }}
-    #     SLACK_COLOR: ${{ steps.status.outputs.status }}

.github/actions/setup/action.yml

@@ -0,0 +1,54 @@
+name: pkgx/brewkit/setup-codesign
+description: Codesigns macOS binaries using Apple tools
+
+inputs:
+  p12-file-base64:
+    description: Base64 encoded p12 file
+    required: true
+  p12-password:
+    description: Password for p12 file
+    required: true
+  APPLE_IDENTITY:
+    required: false
+
+runs:
+  using: composite
+  steps:
+    # - name: purge tool PATH
+    #   run: |
+    #     if [ -d /usr/local/bin ]; then
+    #       tmp=$(mktemp -d)
+    #       sudo mv /usr/local/bin $tmp
+    #     fi
+    #   shell: bash
+
+    - name: export APPLE_IDENTITY
+      run: echo 'APPLE_IDENTITY=${{inputs.identity || '-'}}' >> $GITHUB_ENV
+      shell: bash
+
+    # the next three steps bless our code for Apple. It might be the case they should be
+    # encapulated separately.
+    # FIXME: using an explicit commit in a PR isn't great, but the last release was almost 3 years
+    # ago, and we need bugfixes.
+    # FIXME: replace this with a pkgx script based on https://localazy.com/blog/how-to-automatically-sign-macos-apps-using-github-actions
+    # github has a doc with similar content, but it's not returning to me atm.
+
+    # apple-actions/import-codesign-certs will fail if the keychain already exists, so we prophylactically
+    # delete it if it does.
+    - name: Delete keychain
+      shell: sh
+      if: runner.os == 'macOS' && inputs.p12-file-password && inputs.p12-file-base64
+      run: security delete-keychain signing_temp.keychain || true
+
+    - uses: apple-actions/import-codesign-certs@v2
+      if: runner.os == 'macOS' && inputs.p12-file-password && inputs.p12-file-base64
+      with:
+        p12-file-base64: ${{ inputs.p12-file-base64 }}
+        p12-password: ${{ inputs.p12-password }}
+
+    # Needed for self-hosted runner, since it doesn't destroy itself automatically.
+    - name: Delete keychain
+      uses: webiny/action-post-run@3.0.0
+      if: runner.os == 'macOS' && inputs.p12-file-password && inputs.p12-file-base64
+      with:
+        run: security delete-keychain signing_temp.keychain

.github/deno.jsonc

@@ -10,6 +10,7 @@
   },
   "imports": {
     "pkgx": "https://deno.land/x/libpkgx@v0.15.1/mod.ts",
-    "pkgx/": "https://deno.land/x/libpkgx@v0.15.1/src/"
+    "pkgx/": "https://deno.land/x/libpkgx@v0.15.1/src/",
+    "is-what": "https://deno.land/x/is_what@v4.1.15/src/index.ts"
   }
 }

.github/scripts/get-matrix.ts

@@ -0,0 +1,86 @@
+#!/usr/bin/env -S pkgx deno run -A
+
+import { hooks, utils } from "pkgx"
+import { isString, isArray } from "is-what"
+
+const pkg = utils.pkg.parse(Deno.args[0])
+const config = await get_config(pkg)
+
+const rv = {} as Record<string, any>
+for (const platform of config.platforms) {
+  const key = platform.replace('/', '+')
+  rv[key] = get_matrix(platform)
+}
+
+const ghout = Deno.env.get("GITHUB_OUTPUT")
+if (ghout) {
+  const json = JSON.stringify(Object.values(rv))
+  Deno.writeTextFileSync(ghout, `matrix=${json}`, {append: true})
+} else {
+  const json = JSON.stringify(rv, null, 2)
+  console.log(json)
+}
+
+///////////////////////////////////////////////////////////////////////
+
+//TODO should be in libpkgx!
+async function get_config(pkg: {project: string}) {
+  let { platforms, test } = await hooks.usePantry().project(pkg).yaml()
+  const get_platforms = (() => {
+    if (!platforms) return ["linux/x86-64", "linux/aarch64", "darwin/x86-64", "darwin/aarch64"]
+    if (isString(platforms)) platforms = [platforms]
+    if (!isArray(platforms)) throw new Error(`invalid platform node: ${platforms}`)
+    const rv = []
+    for (const platform of platforms) {
+      if (platform.match(/^(linux|darwin)\/(aarch64|x86-64)$/)) rv.push(platform)
+      else if (platform.match(/^(linux|darwin)$/)) rv.push(`${platform}/x86-64`, `${platform}/aarch64`)
+      else throw new Error(`invalid platform: ${platform}`)
+    }
+    return rv
+  })
+
+  const qaRequired = test?.["qa-required"] === true
+
+  return {
+    platforms: get_platforms(),
+    qaRequired
+  }
+}
+
+function get_matrix(platform: string) {
+  const name = platform.replace('/', '+')
+  switch (platform) {
+    case 'darwin/aarch64': {
+      const os = ["self-hosted", "macOS", "ARM64"]
+      return {
+        os, name,
+        "test-os": [os],
+        "test-container": [null],
+        tinyname: "²"
+      }}
+    case 'darwin/x86-64': {
+      const os = ["self-hosted", "macOS", "X64"]
+      return {
+        os, name,
+        "test-os": ["macos-11", "macos-12"],
+        "test-container": [null],
+        tinyname: "x64"
+      }}
+    case 'linux/x86-64': {
+      const os = {group: "linux-x86-64"}
+      return {
+        os, name,
+        container: "debian:buster-slim",
+        "test-os": [os],
+        "test-container": ["debian:buster-slim", "ubuntu", "archlinux"],
+        tinyname: "Lnx·x64"
+      }}
+    case 'linux/aarch64': {
+      const os = ["self-hosted", "linux", "ARM64"]
+      return {
+        os, name,
+        "test-os": [os],
+        "test-container": [null],
+        tinyname: "Lnx·ARM64"
+  }}}
+}

.github/scripts/qa-required.ts

@@ -0,0 +1,9 @@
+#!/usr/bin/env -S pkgx deno run --allow-read
+
+import { hooks } from "pkgx"
+
+const project = Deno.args[0]
+
+const yml = await hooks.usePantry().project(project).yaml()
+const qaRequired = yml?.["test"]?.["qa-required"] === true
+Deno.exit(qaRequired ? 0 : 1)