include:
  - /gitlab-templates/blocks/snap-base.yml
  - /gitlab-templates/blocks/workflow.yml

snap_image_signed:
  extends: .snap_base
  inherit:
    default: true
  script:
    # make sure there is a snap specific so gpg deosn't freak out
    - mkdir -p -m 0700 ¬/.snap/gnupg/
    - mkdir -p -m 0700 ¬/.snap/gnupg/private-keys-v1.d/
    # export it as a env var for convenience
    - export GNUPGHOME=¬/.snap/gnupg/
    # test the env var
    - echo $GNUPGHOME
    # copy in the required exported login creds so that snapcraft whoami works
    - echo $KDE_NEON_CORE_IMAGE_KEY > kde-neon-core-image-key
    # feed snap's gpg the required key
    - echo $PRIVATE_KEY | base64 --decode | gpg --batch --import
    # make sure the key is trusted
    - gpg --import-ownertrust <(echo "$OWNER_TRUST")
    # test the keys
    - gpg --list-keys
    # test the login
    - snapcraft whoami
    # build the image with the project's tooling
    - echo building $KDE_SNAP_MODULE_NAME in signed mode ...
    - make signed 2>&1 | tee task.log
    # make the artifacts dir
    - mkdir -p $CI_PROJECT_DIR/kde-ci-packages/
    # copy the gun zipped tar to the artifacts dir
    - cp -vf ./*.tar.gz  $CI_PROJECT_DIR/kde-ci-packages/
  interruptible: true
  after_script:
    # delete the gpg keyring
    - rm -rf ¬/.snap/gnupg
    # delete the snapcraft auth creds
    - rm kde-neon-core-image-key