name: Build portable releases

run-name: >-
  ${{ github.event_name == 'push' && github.ref_type == 'branch' && 'Warm build caches' || 'Portable release' }} ${{ (github.ref_type == 'tag' && github.ref_name) || inputs.release_tag || github.ref_name }}

on:
  workflow_dispatch:
    inputs:
      release_tag:
        description: Optional tag to create after all builds pass (leave empty to build artifacts only)
        required: false
        type: string
      prerelease:
        description: Mark a manually published release as a pre-release
        required: true
        default: true
        type: boolean
  push:
    branches:
      - main
    tags:
      - 'v*'

concurrency:
  group: portable-${{ github.ref }}-${{ github.event_name == 'push' && github.ref_type == 'branch' && 'cache' || 'release' }}
  cancel-in-progress: ${{ github.event_name == 'push' && github.ref_type == 'branch' }}

permissions:
  contents: read

jobs:
  version:
    name: Resolve app version
    runs-on: ubuntu-24.04
    outputs:
      version: ${{ steps.resolve.outputs.version }}
      tag: ${{ steps.resolve.outputs.tag }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.ref }}
      - name: Resolve release version
        id: resolve
        shell: bash
        env:
          REQUESTED_VERSION: ${{ (github.ref_type == 'tag' && github.ref_name) || inputs.release_tag }}
        run: |
          set -euo pipefail

          source_version="$(node scripts/version.mjs)"
          release_tag="$REQUESTED_VERSION"
          if [ -z "$release_tag" ]; then
            release_tag="v$source_version"
          else
            case "$release_tag" in
              v*) ;;
              *) release_tag="v$release_tag" ;;
            esac
          fi

          version="$(node scripts/version.mjs "${release_tag#v}")"

          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "tag=$release_tag" >> "$GITHUB_OUTPUT"

  build:
    name: Build ${{ matrix.os }}-${{ matrix.arch }}
    needs: version
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-22.04
            os: linux
            display_os: Linux
            arch: amd64
            suffix: tar.gz
          - runner: ubuntu-22.04-arm
            os: linux
            display_os: Linux
            arch: aarch64
            suffix: tar.gz
          - runner: macos-15-intel
            os: darwin
            display_os: Darwin
            arch: amd64
            suffix: dmg
          - runner: macos-15
            os: darwin
            display_os: Darwin
            arch: aarch64
            suffix: dmg
          - runner: windows-2025
            os: windows
            display_os: Windows
            arch: amd64
            suffix: zip
          - runner: windows-11-arm
            os: windows
            display_os: Windows
            arch: aarch64
            suffix: zip
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    env:
      PACKAGE_RELEASE: ${{ github.event_name == 'workflow_dispatch' || github.ref_type == 'tag' }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.ref }}
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.14
      - uses: dtolnay/rust-toolchain@1.97.0
      - name: Restore Bun packages
        id: bun-cache
        uses: actions/cache/restore@v5
        with:
          path: ~/.bun/install/cache
          key: bun-${{ matrix.runner }}-1.3.14-${{ hashFiles('bun.lock') }}
          restore-keys: |
            bun-${{ matrix.runner }}-1.3.14-
      - name: Cache Rust dependencies and build outputs
        uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.runner }}
          workspaces: src-tauri -> target
          cache-workspace-crates: true
          save-if: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
      - name: Restore bundled core archive
        id: core-cache
        uses: actions/cache/restore@v5
        with:
          path: cpa-core
          key: core-v2-${{ matrix.os }}-${{ matrix.arch }}-${{ hashFiles('core-version.txt') }}
      - name: Apply release version
        run: node scripts/set-version.mjs "${{ needs.version.outputs.version }}"
      - name: Resolve release package name
        id: package
        shell: bash
        env:
          APP_VERSION: ${{ needs.version.outputs.version }}
        run: |
          echo "stem=EasyCLIProxyAPI-v${APP_VERSION}-${{ matrix.display_os }}-${{ matrix.arch }}" >> "$GITHUB_OUTPUT"
          echo "version=$APP_VERSION" >> "$GITHUB_OUTPUT"
      - name: Install Linux dependencies
        if: matrix.os == 'linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
      - name: Build GUI
        env:
          GITCODE_GUI_REPOSITORY: ${{ vars.GITCODE_GUI_REPOSITORY }}
          GITCODE_CORE_REPOSITORY: ${{ vars.GITCODE_CORE_REPOSITORY }}
        run: |
          bun install --frozen-lockfile
          bun tauri build --no-bundle
        shell: bash
      - name: Prepare portable directory
        run: >-
          node scripts/portable.mjs
          --binary "src-tauri/target/release/cpa-gui${{ matrix.os == 'windows' && '.exe' || '' }}"
          --output "release/${{ steps.package.outputs.stem }}"
          --os "${{ matrix.os }}"
          --arch "${{ matrix.arch }}"
          --download true
        shell: bash
      - name: Save Bun packages
        if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && steps.bun-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@v5
        with:
          path: ~/.bun/install/cache
          key: ${{ steps.bun-cache.outputs.cache-primary-key }}
      - name: Save bundled core archive
        if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && steps.core-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@v5
        with:
          path: cpa-core
          key: ${{ steps.core-cache.outputs.cache-primary-key }}
      - name: Build signed macOS DMG
        if: env.PACKAGE_RELEASE == 'true' && matrix.os == 'darwin'
        shell: bash
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          set -euo pipefail

          certificate_path="$RUNNER_TEMP/apple-signing-certificate.p12"
          keychain_path="$RUNNER_TEMP/apple-signing.keychain-db"
          keychain_password="$(uuidgen)"
          signed_core_dir="$RUNNER_TEMP/signed-core"
          unsigned_core_archive="$RUNNER_TEMP/unsigned-core-${{ matrix.arch }}.tar.gz"
          core_archive=""
          staging_dir="$RUNNER_TEMP/easycli-dmg-staging"
          bundle_dir="src-tauri/target/release/bundle"
          output_dmg="${{ steps.package.outputs.stem }}.dmg"
          keychain_list="$(security list-keychains -d user)"
          existing_keychains=()
          while IFS= read -r existing_keychain; do
            existing_keychain="${existing_keychain#*\"}"
            existing_keychain="${existing_keychain%\"*}"
            if [ -n "$existing_keychain" ]; then
              existing_keychains+=("$existing_keychain")
            fi
          done <<< "$keychain_list"

          cleanup() {
            set +e
            if [ -n "$core_archive" ] && [ -f "$unsigned_core_archive" ]; then
              cp "$unsigned_core_archive" "$core_archive"
            fi
            rm -f "$certificate_path"
            rm -f "$unsigned_core_archive"
            rm -rf "$signed_core_dir" "$staging_dir"
            security delete-keychain "$keychain_path"
          }
          trap cleanup EXIT

          (umask 077; printf '%s' "$APPLE_CERTIFICATE" | base64 -D > "$certificate_path")
          security create-keychain -p "$keychain_password" "$keychain_path"
          if [ "${#existing_keychains[@]}" -gt 0 ]; then
            security list-keychains -d user -s "$keychain_path" "${existing_keychains[@]}"
          else
            security list-keychains -d user -s "$keychain_path"
          fi
          security set-keychain-settings -lut 21600 "$keychain_path"
          security unlock-keychain -p "$keychain_password" "$keychain_path"
          security import "$certificate_path" -k "$keychain_path" -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$keychain_password" "$keychain_path"

          core_archive="$(find cpa-core -maxdepth 1 -type f -name 'CLIProxyAPI_*_darwin_${{ matrix.arch }}.tar.gz' -print -quit)"
          cp "$core_archive" "$unsigned_core_archive"
          mkdir -p "$signed_core_dir"
          tar -xzf "$core_archive" -C "$signed_core_dir"
          core_binary="$(find "$signed_core_dir" -type f -name 'cli-proxy-api' -print -quit)"
          codesign --force --options runtime --timestamp --sign "$APPLE_SIGNING_IDENTITY" --keychain "$keychain_path" "$core_binary"
          signed_archive="$RUNNER_TEMP/$(basename "$core_archive")"
          COPYFILE_DISABLE=1 tar -czf "$signed_archive" -C "$signed_core_dir" .
          mv "$signed_archive" "$core_archive"

          cp "release/${{ steps.package.outputs.stem }}/portable-app.json" portable-app.json

          # Build the notarized app with Tauri, then create the DMG with hdiutil.
          # Tauri's generated create-dmg script is unreliable on GitHub's macOS runners.
          env -u APPLE_CERTIFICATE -u APPLE_CERTIFICATE_PASSWORD \
            bun tauri bundle --bundles app --ci --config src-tauri/tauri.dmg.conf.json

          app_path="$bundle_dir/macos/EasyCLIProxyAPI.app"
          resources_dir="$app_path/Contents/Resources"
          test -d "$app_path"
          test ! -e "$app_path/Contents/MacOS/oauth"
          test ! -e "$resources_dir/oauth"
          test -s "$resources_dir/core-version.txt"

          rm -rf "$staging_dir"
          mkdir -p "$staging_dir"
          ditto "$app_path" "$staging_dir/EasyCLIProxyAPI.app"
          ln -s /Applications "$staging_dir/Applications"
          hdiutil create \
            -volname "EasyCLIProxyAPI" \
            -srcfolder "$staging_dir" \
            -format UDZO \
            -ov \
            "$output_dmg"
          codesign --force --timestamp --sign "$APPLE_SIGNING_IDENTITY" --keychain "$keychain_path" "$output_dmg"
          xcrun notarytool submit "$output_dmg" \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait
          xcrun stapler staple "$output_dmg"
      - name: Archive Linux release
        if: env.PACKAGE_RELEASE == 'true' && matrix.os == 'linux'
        run: tar -czf "${{ steps.package.outputs.stem }}.tar.gz" -C release "${{ steps.package.outputs.stem }}"
      - name: Archive Windows release
        if: env.PACKAGE_RELEASE == 'true' && matrix.os == 'windows'
        shell: pwsh
        run: |
          Compress-Archive -Path "release/${{ steps.package.outputs.stem }}" -DestinationPath "${{ steps.package.outputs.stem }}.zip"
      - uses: actions/upload-artifact@v7
        if: env.PACKAGE_RELEASE == 'true'
        with:
          name: ${{ steps.package.outputs.stem }}
          path: ${{ steps.package.outputs.stem }}.${{ matrix.suffix }}
          if-no-files-found: error
          retention-days: 14
  publish:
    name: Publish GitHub release
    if: >-
      startsWith(github.ref, 'refs/tags/')
      || inputs.release_tag != ''
    needs:
      - version
      - build
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.ref }}
      - uses: actions/download-artifact@v8
        with:
          path: artifacts
          merge-multiple: true
      - name: Prepare shared release notes
        shell: bash
        env:
          RELEASE_TAG: ${{ needs.version.outputs.tag }}
        run: |
          set -euo pipefail
          node scripts/release-notes.mjs \
            --tag "$RELEASE_TAG" \
            --output "$RUNNER_TEMP/easycli-release-notes.json" \
            --body-output "$RUNNER_TEMP/easycli-release-notes.md"
      - name: Generate portable update manifests
        shell: bash
        env:
          RELEASE_TAG: ${{ needs.version.outputs.tag }}
        run: |
          set -euo pipefail
          for platform in windows linux darwin; do
            node scripts/manifest.mjs \
              --directory artifacts \
              --platform "$platform" \
              --repository "${{ github.repository }}" \
              --gitcode-repository "${{ vars.GITCODE_GUI_REPOSITORY }}" \
              --tag "$RELEASE_TAG" \
              --release-notes "$RUNNER_TEMP/easycli-release-notes.json"
          done
      - name: Publish release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          RELEASE_TAG: ${{ needs.version.outputs.tag }}
          MANUAL_PRERELEASE: ${{ inputs.prerelease }}
        run: |
          set -euo pipefail

          case "$RELEASE_TAG" in
            v*) ;;
            *) RELEASE_TAG="v$RELEASE_TAG" ;;
          esac

          prerelease="$MANUAL_PRERELEASE"
          release_args=(--title "EasyCLIProxyAPI $RELEASE_TAG" --notes-file "$RUNNER_TEMP/easycli-release-notes.md")
          if [[ "$GITHUB_REF_TYPE" == "tag" ]]; then
            if [[ "$RELEASE_TAG" == *-* ]]; then
              prerelease=true
            else
              prerelease=false
            fi
          else
            release_args+=(--target "$GITHUB_SHA")
          fi
          if [[ "$prerelease" == "true" ]]; then
            release_args+=(--prerelease)
          fi

          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            gh release upload "$RELEASE_TAG" artifacts/* --clobber
            gh release edit "$RELEASE_TAG" --notes-file "$RUNNER_TEMP/easycli-release-notes.md"
          else
            gh release create "$RELEASE_TAG" "${release_args[@]}" artifacts/*
          fi