From 13655d09922038ab62d93b84ba9cd2eae474abd7 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Sat, 31 Oct 2026 15:33:25 -0400
Subject: [PATCH] packaging(flatpak): add OCI image build and GHCR publishing
 helper (#5526)

---
 packaging/linux/flatpak-bundle.sh |  9 +++++
 packaging/linux/flatpak-oci.sh    | 64 +++++++++++++++++++++++++++++++
 2 files changed, 73 insertions(+)
 create mode 100755 packaging/linux/flatpak-oci.sh

diff --git a/packaging/linux/flatpak-bundle.sh b/packaging/linux/flatpak-bundle.sh
index 26e09cd1c8..0534b3194e 100755
--- a/packaging/linux/flatpak-bundle.sh
+++ b/packaging/linux/flatpak-bundle.sh
@@ -20,10 +20,12 @@ APP_ID=ai.storyteller.pdfcraft
 FLATHUB=https://dl.flathub.org/repo/flathub.flatpakrepo
 
 TEST=1
+OCI=0
 TARBALL=""
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --no-test) TEST=0; shift ;;
+    --oci) OCI=1; shift ;;
     -h | --help) sed -n '2,14p' "$0"; exit 0 ;;
     -*) echo "unknown argument: $1" >&2; exit 2 ;;
     *) TARBALL="$1"; shift ;;
@@ -62,6 +64,13 @@ OUT="$DIST/$BASENAME.flatpak"
 flatpak build-bundle --runtime-repo="$FLATHUB" "$WORK/repo" "$OUT" "$APP_ID" stable
 echo "wrote $OUT"
 
+if [[ "$OCI" = 1 ]]; then
+  OUT_OCI="$DIST/$BASENAME-oci"
+  rm -rf "$OUT_OCI"
+  flatpak build-bundle --oci "$WORK/repo" "$OUT_OCI" "$APP_ID" stable
+  echo "wrote OCI layout to $OUT_OCI"
+fi
+
 if [[ "$TEST" = 1 ]]; then
   flatpak install --user -y --noninteractive --reinstall "$OUT"
   flatpak info --user "$APP_ID"
diff --git a/packaging/linux/flatpak-oci.sh b/packaging/linux/flatpak-oci.sh
new file mode 100755
index 0000000000..0572ef1a3a
--- /dev/null
+++ b/packaging/linux/flatpak-oci.sh
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Build PdfCraft as an OCI container layout and push it to GitHub Container Registry (GHCR)
+# for consumption by Flatpak OCI clients (flatpak-oci-specs).
+#
+# Usage:
+#   packaging/linux/flatpak-oci.sh [--push] [TARBALL]
+#
+# Environment variables:
+#   REGISTRY       Target registry image (default: ghcr.io/storytold/pdfcraft)
+#   TAG            Target image tag (default: $VERSION-$ARCH, also tags stable and latest)
+#   GITHUB_TOKEN   Token for GHCR authentication when --push is used
+set -euo pipefail
+# shellcheck source=../env.sh
+. "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
+HERE="$ROOT/packaging/linux"
+
+PUSH=0
+TARBALL=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --push) PUSH=1; shift ;;
+    -h | --help) sed -n '2,12p' "$0"; exit 0 ;;
+    -*) echo "unknown argument: $1" >&2; exit 2 ;;
+    *) TARBALL="$1"; shift ;;
+  esac
+done
+
+ARCH="$(uname -m)"
+case "$ARCH" in
+  x86_64) ;;
+  aarch64 | arm64) ARCH=aarch64 ;;
+  *) echo "unsupported architecture $ARCH" >&2; exit 2 ;;
+esac
+
+BASENAME="pdfcraft-$VERSION-linux-$ARCH"
+OUT_OCI="$DIST/$BASENAME-oci"
+
+echo "==> Building Flatpak OCI layout for $BASENAME"
+"$HERE/flatpak-bundle.sh" --oci --no-test "${TARBALL:-}"
+
+[[ -d "$OUT_OCI" ]] || { echo "error: $OUT_OCI layout not generated" >&2; exit 1; }
+
+REGISTRY="${REGISTRY:-ghcr.io/storytold/pdfcraft}"
+TAG="${TAG:-$VERSION-$ARCH}"
+
+echo "==> OCI layout ready at $OUT_OCI (Target: $REGISTRY:$TAG)"
+
+if [[ "$PUSH" = 1 ]]; then
+  command -v skopeo >/dev/null || { echo "error: skopeo is required to push OCI images (apt install skopeo)" >&2; exit 1; }
+
+  AUTH_ARGS=()
+  if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+    AUTH_ARGS=(--dest-creds "${GITHUB_ACTOR:-storytold}:$GITHUB_TOKEN")
+  fi
+
+  echo "==> Pushing to $REGISTRY:$TAG"
+  skopeo copy --format oci "${AUTH_ARGS[@]}" "oci:$OUT_OCI" "docker://$REGISTRY:$TAG"
+
+  # Also update architecture-specific stable tag
+  echo "==> Pushing to $REGISTRY:stable-$ARCH"
+  skopeo copy --format oci "${AUTH_ARGS[@]}" "oci:$OUT_OCI" "docker://$REGISTRY:stable-$ARCH"
+
+  echo "==> Push complete"
+fi