fireworld-build.yml

name: Base Build the RustDesk for fireworld

on:
  workflow_call:
    inputs:
      upload-artifact:
        type: boolean
        default: true
      upload-tag:
        type: string
        default: "nightly"

# NOTE: F-Droid builder script 'flutter/build_fdroid.sh' reads environment
# variables from this workflow!
#
# It does NOT read build steps, however, so please fix 'flutter/build_fdroid.sh
# whenever you add changes to Android CI build action ('build-rustdesk-android')
# in this file!

env:
  SCITER_RUST_VERSION: "1.75" # https://github.com/rustdesk/rustdesk/discussions/7503, also 1.78 has ABI change which causes our sciter version not working, https://blog.rust-lang.org/2024/03/30/i128-layout-update.html
  RUST_VERSION: "1.75" # sciter failed on m1 with 1.78 because of https://blog.rust-lang.org/2024/03/30/i128-layout-update.html
  MAC_RUST_VERSION: "1.81" # 1.81 is requred for macos, because of https://github.com/yury/cidre requires 1.81
  CARGO_NDK_VERSION: "3.1.2"
  SCITER_ARMV7_CMAKE_VERSION: "3.29.7"
  SCITER_NASM_DEBVERSION: "2.15.05-1"
  LLVM_VERSION: "15.0.6"
  FLUTTER_VERSION: "3.24.5"
  ANDROID_FLUTTER_VERSION: "3.24.5"
  # Windows arm64 only: the first stable Flutter to ship a native arm64 Windows Dart SDK +
  # engine is 3.44. Every other platform stays on FLUTTER_VERSION (3.24.5) until Windows 7
  # support is restored after the upstream-wide Flutter bump. The arm64 job patches the few
  # 3.44-only source/pubspec changes on the fly (see "Patch RustDesk sources for Flutter 3.44").
  FLUTTER_WINDOWS_ARM_VERSION: "3.44.0"
  # for arm64 linux because official Dart SDK does not work
  FLUTTER_ELINUX_VERSION: "3.16.9"
  TAG_NAME: "${{ inputs.upload-tag }}"
  VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
  # vcpkg version: 2025.08.27
  # If we change the `VCPKG COMMIT_ID`, please remember:
  # 1. Call `$VCPKG_ROOT/vcpkg x-update-baseline` to update the baseline in `vcpkg.json`.
  #  Or we may face build issue like 
  #  https://github.com/rustdesk/rustdesk/actions/runs/14414119794/job/40427970174
  # 2. Update the `VCPKG_COMMIT_ID` in `ci.yml` and `playground.yml`.
  VCPKG_COMMIT_ID: "120deac3062162151622ca4860575a33844ba10b"
  ARMV7_VCPKG_COMMIT_ID: "6f29f12e82a8293156836ad81cc9bf5af41fe836" # 2025.01.13, got "/opt/artifacts/vcpkg/vcpkg: No such file or directory" with latest version
  VERSION: "1.4.9"
  NDK_VERSION: "r28c"
  #signing keys env variable checks
  ANDROID_SIGNING_KEY: "${{ secrets.ANDROID_SIGNING_KEY }}"
  # To make a custom build with your own servers set the below secret values
  RS_PUB_KEY: "${{ secrets.RS_PUB_KEY }}"
  RENDEZVOUS_SERVER: "${{ secrets.RENDEZVOUS_SERVER }}"
  API_SERVER: "${{ secrets.API_SERVER }}"
  UPLOAD_ARTIFACT: "${{ inputs.upload-artifact }}"
  SIGN_BASE_URL: "${{ secrets.SIGN_BASE_URL }}-2"

jobs:
  generate-bridge:
    uses: ./.github/workflows/bridge.yml

  build-RustDeskTempTopMostWindow:
    uses: ./.github/workflows/third-party-RustDeskTempTopMostWindow.yml
    strategy:
      fail-fast: false
      matrix:
        job:
          - {
              target: windows-2022,
              platform: x64,
            }
          # - {
          #     target: windows-11-arm,
          #     platform: ARM64,
          #   }
    with:
      upload-artifact: ${{ inputs.upload-artifact }}
      target: ${{ matrix.job.target }}
      configuration: Release
      platform: ${{ matrix.job.platform }}
      target_version: Windows10

  build-for-windows-flutter:
    name: ${{ matrix.job.target }}
    needs: [build-RustDeskTempTopMostWindow, generate-bridge]
    runs-on: ${{ matrix.job.os }}
    strategy:
      fail-fast: false
      matrix:
        job:
          - {
              target: x86_64-pc-windows-msvc,
              os: windows-2022,
              arch: x86_64,
              flutter-arch: x64,
              vcpkg-triplet: x64-windows-static,
              build-args: "--vram",
            }
          # - {
          #     target: aarch64-pc-windows-msvc,
          #     os: windows-11-arm,
          #     arch: aarch64,
          #     flutter-arch: arm64,
          #     vcpkg-triplet: arm64-windows-static,
          #     # vram is x86/x64-only (NVENC needs CUDA, Intel MediaSDK needs __rdtsc);
          #     # no NV/Intel/AMD hardware exists on Windows-on-ARM, so vram stays disabled here.
          #     build-args: "",
          #   }
    steps:
      - name: Export GitHub Actions cache environment variables
        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
        with:
          script: |
            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');

      - name: Checkout source code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          submodules: recursive

      - name: Restore bridge files
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          # arm64 is on Flutter 3.44, so it needs the bridge generated with the same Flutter
          # (its *.freezed.dart must match the freezed the arm64 build resolves). x64 and every
          # other platform keep the default 3.22.3-generated bridge.
          name: ${{ matrix.job.arch == 'aarch64' && 'bridge-artifact-flutter-3.44' || 'bridge-artifact' }}
          path: ./

      - name: Install LLVM and Clang
        uses: KyleMayes/install-llvm-action@ebc0426251bc40c7cd31162802432c68818ab8f0 # v2.0.9
        with:
          version: ${{ env.LLVM_VERSION }}

      - name: Install flutter
        id: flutter
        # arm64 builds with FLUTTER_WINDOWS_ARM_VERSION (>=3.44); x64 stays on FLUTTER_VERSION.
        # subosito only ships an x64 Windows SDK (Flutter's release manifest lists x64 only),
        # so it installs x64 on both arches. The arm64 runner re-bootstraps Dart to arm64 in
        # the next step.
        uses: subosito/flutter-action@2783a3f08e1baf891508463f8c6653c258246225  # v2.12.0; https://github.com/subosito/flutter-action/issues/277
        with:
          channel: "stable"
          flutter-version: ${{ matrix.job.arch == 'aarch64' && env.FLUTTER_WINDOWS_ARM_VERSION || env.FLUTTER_VERSION }}
          architecture: x64

      - name: Force arm64 Dart SDK + engine
        # The x64 SDK subosito installs bundles an x64 Dart with a matching engine-dart-sdk.stamp,
        # so update_dart_sdk.ps1 short-circuits (stamp matches -> return) and keeps x64 Dart;
        # `flutter build windows` then targets the Dart VM's arch = x64, even on this arm64 host.
        # On this native-arm64 runner (PROCESSOR_ARCHITECTURE=ARM64), deleting the stamp and
        # re-running update_dart_sdk.ps1 pulls the arm64 Dart (available since Flutter 3.44.0).
        # https://github.com/flutter/flutter/issues/186730#issuecomment-4573214964
        if: ${{ matrix.job.arch == 'aarch64' }}
        run: |
          $flutterRoot = "${{ steps.flutter.outputs['CACHE-PATH'] }}"
          Write-Host "PROCESSOR_ARCHITECTURE=$env:PROCESSOR_ARCHITECTURE"
          Write-Host "Flutter root: $flutterRoot"
          Remove-Item -Force "$flutterRoot\bin\cache\engine-dart-sdk.stamp" -ErrorAction SilentlyContinue
          & "$flutterRoot\bin\internal\update_dart_sdk.ps1"
          # Confirm the Dart we ended up with is arm64 ("on windows_arm64"); fail loudly if not.
          $dartVer = & "$flutterRoot\bin\dart.bat" --version 2>&1 | Out-String
          Write-Host $dartVer
          if ($dartVer -notmatch "windows_arm64") {
            Write-Error "Expected an arm64 Dart SDK but got: $dartVer"
            exit 1
          }
          & "$flutterRoot\bin\flutter.bat" precache --windows
          # Fail fast if precache pulled the wrong-arch Windows engine: an arm64 Dart should
          # fetch windows-arm64 engine artifacts. Bailing here saves the ~25min Rust build.
          $engineDir = "$flutterRoot\bin\cache\artifacts\engine"
          Write-Host "Engine artifacts present:"
          Get-ChildItem $engineDir -Directory | Select-Object -ExpandProperty Name | Write-Host
          if (-not (Test-Path "$engineDir\windows-arm64-release")) {
            Write-Error "Expected windows-arm64-release engine artifacts but they are missing (wrong-arch SDK)."
            exit 1
          }

      # https://github.com/flutter/flutter/issues/155685
      # x64 only: arm64 uses the stock native arm64 Windows engine, and the rustdesk/engine
      # windows-x64-release.zip is built for the 3.24-era x64 engine (matches FLUTTER_VERSION).
      - name: Replace engine with rustdesk custom flutter engine
        if: ${{ matrix.job.arch == 'x86_64' }}
        run: |
          flutter doctor -v
          flutter precache --windows
          Invoke-WebRequest -Uri https://github.com/rustdesk/engine/releases/download/main/windows-x64-release.zip -OutFile windows-x64-release.zip
          Expand-Archive -Path windows-x64-release.zip -DestinationPath windows-x64-release
          mv -Force windows-x64-release/*  C:/hostedtoolcache/windows/flutter/stable-${{ env.FLUTTER_VERSION }}-x64/bin/cache/artifacts/engine/windows-x64-release/

      - name: Patch flutter
        # x64 stays on Flutter 3.24.5, which needs the dropdown filter patch.
        # arm64 is on Flutter 3.44 (patched separately below) and does not use this patch.
        if: ${{ matrix.job.arch == 'x86_64' }}
        shell: bash
        run: |
          cp .github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff $(dirname $(dirname $(which flutter)))
          cd $(dirname $(dirname $(which flutter)))
          [[ "3.24.5" == ${{env.FLUTTER_VERSION}} ]] && git apply flutter_3.24.4_dropdown_menu_enableFilter.diff

      - name: Patch RustDesk sources for Flutter 3.44 (arm64)
        # arm64 is the only target on Flutter 3.44; apply its source/pubspec deltas on the fly
        # (shared with the 3.44 bridge job) so the committed sources stay on Flutter 3.24.5.
        # `flutter build` then runs `pub get`, regenerating pubspec.lock for the bumped deps.
        if: ${{ matrix.job.arch == 'aarch64' }}
        shell: bash
        run: bash .github/patches/apply_flutter_3.44_source_patches.sh

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: ${{ env.SCITER_RUST_VERSION }}
          targets: ${{ matrix.job.target }}
          components: "rustfmt"

      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          prefix-key: ${{ matrix.job.os }}

      - name: Setup vcpkg with Github Actions binary cache
        uses: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2 # v11
        with:
          vcpkgDirectory: C:\vcpkg
          vcpkgGitCommitId: ${{ env.VCPKG_COMMIT_ID }}
          doNotCache: false

      - name: Install vcpkg dependencies
        env:
          VCPKG_DEFAULT_HOST_TRIPLET: ${{ matrix.job.vcpkg-triplet }}
        run: |
          if ! $VCPKG_ROOT/vcpkg \
            install \
            --triplet ${{ matrix.job.vcpkg-triplet }} \
            --x-install-root="$VCPKG_ROOT/installed"; then
            find "${VCPKG_ROOT}/" -name "*.log" | while read -r _1; do
              echo "$_1:"
              echo "======"
              cat "$_1"
              echo "======"
              echo ""
            done
            exit 1
          fi
          head -n 100 "${VCPKG_ROOT}/buildtrees/ffmpeg/build-${{ matrix.job.vcpkg-triplet }}-rel-out.log" || true
        shell: bash

      - name: Set SODIUM_LIB_DIR (arm64)
        # libsodium-sys ships no arm64 Windows prebuilt lib; point it at the vcpkg-built one
        # (only for arm64 — leaving it unset lets x64 use the crate's bundled lib).
        if: ${{ matrix.job.arch == 'aarch64' }}
        shell: bash
        run: echo "SODIUM_LIB_DIR=$VCPKG_ROOT/installed/${{ matrix.job.vcpkg-triplet }}/lib" >> "$GITHUB_ENV"

      - name: Build rustdesk
        run: |
          # Windows: build RustDesk
          # --hwcodec is shared by all Windows targets; per-target extras (e.g. --vram) come from the matrix
          python3 .\build.py --portable --flutter --skip-portable-pack --hwcodec ${{ matrix.job.build-args }}
          mv ./flutter/build/windows/${{ matrix.job.flutter-arch }}/runner/Release ./rustdesk

          # Download usbmmidd_v2.zip and extract it to ./rustdesk
          Invoke-WebRequest -Uri https://github.com/rustdesk-org/rdev/releases/download/usbmmidd_v2/usbmmidd_v2.zip -OutFile usbmmidd_v2.zip
          Expand-Archive usbmmidd_v2.zip -DestinationPath .
          Remove-Item -Path usbmmidd_v2\Win32 -Recurse
          Remove-Item -Path "usbmmidd_v2\deviceinstaller64.exe", "usbmmidd_v2\deviceinstaller.exe", "usbmmidd_v2\usbmmidd.bat"
          mv -Force .\usbmmidd_v2 ./rustdesk

          # Download printer driver files and extract them to ./rustdesk
          try {
            Invoke-WebRequest -Uri https://github.com/rustdesk/hbb_common/releases/download/driver/rustdesk_printer_driver_v4-1.4.zip -OutFile rustdesk_printer_driver_v4-1.4.zip
            Invoke-WebRequest -Uri https://github.com/rustdesk/hbb_common/releases/download/driver/printer_driver_adapter.zip -OutFile printer_driver_adapter.zip
            Invoke-WebRequest -Uri https://github.com/rustdesk/hbb_common/releases/download/driver/sha256sums -OutFile sha256sums

            # Check and move the files
            $checksum_driver = (Select-String -Path .\sha256sums -Pattern '^([a-fA-F0-9]{64}) \*rustdesk_printer_driver_v4-1.4\.zip$').Matches.Groups[1].Value
            $downloadsum_driver = Get-FileHash -Path rustdesk_printer_driver_v4-1.4.zip -Algorithm SHA256
            $checksum_adapter = (Select-String -Path .\sha256sums -Pattern '^([a-fA-F0-9]{64}) \*printer_driver_adapter\.zip$').Matches.Groups[1].Value
            $downloadsum_adapter = Get-FileHash -Path printer_driver_adapter.zip -Algorithm SHA256
            if ($checksum_driver -eq $downloadsum_driver.Hash -and $checksum_adapter -eq $downloadsum_adapter.Hash) {
                Write-Output "rustdesk_printer_driver_v4-1.4, checksums match, extract the file."
                Expand-Archive rustdesk_printer_driver_v4-1.4.zip -DestinationPath .
                mkdir ./rustdesk/drivers
                mv -Force .\rustdesk_printer_driver_v4-1.4 ./rustdesk/drivers/RustDeskPrinterDriver
                Expand-Archive printer_driver_adapter.zip -DestinationPath .
                mv -Force .\printer_driver_adapter.dll ./rustdesk
            } elseif ($checksum_driver -ne $downloadsum_driver.Hash) {
                Write-Output "rustdesk_printer_driver_v4-1.4, checksums do not match, ignore the file."
            } else {
                Write-Output "printer_driver_adapter.dll, checksums do not match, ignore the file."
            }
          } catch {
              Write-Host "Ingore the printer driver error."
          }

      - name: find Runner.res
        # Windows: find Runner.res (compiled from ./flutter/windows/runner/Runner.rc), copy to ./Runner.res
        # Runner.rc does not contain actual version, but Runner.res does
        continue-on-error: true
        shell: bash
        run: |
          runner_res=$(find . -name "Runner.res");
          if [ "$runner_res" == "" ]; then
            echo "Runner.res: not found";
          else
            echo "Runner.res: $runner_res";
            cp $runner_res ./libs/portable/Runner.res;
            echo "list ./libs/portable/Runner.res";
            ls -l ./libs/portable/Runner.res;
          fi

      - name: Download RustDeskTempTopMostWindow artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        if: ${{ inputs.upload-artifact }}
        with:
          name: ${{ matrix.job.arch == 'aarch64' && 'topmostwindow-artifacts-ARM64' || 'topmostwindow-artifacts-x64' }}
          path: "./rustdesk"

      - name: Upload unsigned
        if: env.UPLOAD_ARTIFACT == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: rustdesk-unsigned-windows-${{ matrix.job.arch }}
          path: rustdesk

      - name: Sign rustdesk files
        # if: env.UPLOAD_ARTIFACT == 'true' && env.SIGN_BASE_URL != ''
        if: false
        shell: bash
        run: |
          pip3 install requests argparse
          BASE_URL=${{ env.SIGN_BASE_URL }} SECRET_KEY=${{ secrets.SIGN_SECRET_KEY }} python3 res/job.py sign_files ./rustdesk/

      - name: Build self-extracted executable
        shell: bash
        if: env.UPLOAD_ARTIFACT == 'true'
        run: |
          sed -i '/dpiAware/d' res/manifest.xml
          pushd ./libs/portable
          pip3 install -r requirements.txt
          python3 ./generate.py -f ../../rustdesk/ -o . -e ../../rustdesk/rustdesk.exe
          popd
          mkdir -p ./SignOutput
          mv ./target/release/rustdesk-portable-packer.exe ./SignOutput/rustdesk-${{ env.VERSION }}-${{ matrix.job.arch }}.exe
          cp ./SignOutput/rustdesk-${{ env.VERSION }}-${{ matrix.job.arch }}.exe ./SignOutput/rustdesk.exe


      - name: Add MSBuild to PATH
        uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2

      - name: Build msi
        # Builds the MSI for the matrix arch. res/msi (WiX v4 + native CustomActions) carries
        # both x64 and ARM64 platform configs; WcaUtil/DUtil ship arm64 libs. msbuild platform
        # is x64 / ARM64; the produced Package.msi is globbed since its bin/<platform>/ dir varies.
        if: env.UPLOAD_ARTIFACT == 'true'
        run: |
          pushd ./res/msi
          python preprocess.py --arp -d ../../rustdesk
          nuget restore msi.sln
          $msiPlatform = if ('${{ matrix.job.arch }}' -eq 'aarch64') { 'ARM64' } else { 'x64' }
          msbuild msi.sln -p:Configuration=Release -p:Platform=$msiPlatform /p:TargetVersion=Windows10
          $msi = Get-ChildItem ./Package/bin/*/Release/en-us/Package.msi | Select-Object -First 1
          mv $msi.FullName ../../SignOutput/rustdesk-${{ env.VERSION }}-${{ matrix.job.arch }}.msi
          sha256sum ../../SignOutput/rustdesk-*.msi

      - name: Sign rustdesk self-extracted file
        # if: env.UPLOAD_ARTIFACT == 'true' && env.SIGN_BASE_URL != ''
        if: false
        shell: bash
        run: |
          BASE_URL=${{ env.SIGN_BASE_URL }} SECRET_KEY=${{ secrets.SIGN_SECRET_KEY }} python3 res/job.py sign_files ./SignOutput

      - name: Publish Release
        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
        if: env.UPLOAD_ARTIFACT == 'true'
        with:
          prerelease: true
          tag_name: ${{ env.TAG_NAME }}
          draft: true
          files: |
            ./SignOutput/rustdesk-*.msi
            ./SignOutput/rustdesk-*.exe
            ./SignOutput/rustdesk.exe

  build-for-macOS-arm64-selfhost:
    # use build-for-macOS instead
    if: false
    runs-on: [self-hosted, macOS, ARM64]
    needs: [generate-bridge]
    steps:
      - name: Export GitHub Actions cache environment variables
        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
        with:
          script: |
            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');

      - name: Checkout source code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          submodules: recursive

      - name: Restore bridge files
        uses: actions/download-artifact@master
        with:
          name: bridge-artifact
          path: ./

      - name: Build rustdesk
        run: |
          ./build.py --flutter --hwcodec --unix-file-copy-paste

      - name: create unsigned dmg
        if: env.UPLOAD_ARTIFACT == 'true'
        run: |
          CREATE_DMG="$(command -v create-dmg)"
          CREATE_DMG="$(readlink -f "$CREATE_DMG")"
          sed -i -e 's/MAXIMUM_UNMOUNTING_ATTEMPTS=3/MAXIMUM_UNMOUNTING_ATTEMPTS=7/' "$CREATE_DMG"
          create-dmg --icon "RustDesk.app" 200 190 --hide-extension "RustDesk.app" --window-size 800 400 --app-drop-link 600 185 rustdesk-${{ env.VERSION }}-arm64.dmg ./flutter/build/macos/Build/Products/Release/RustDesk.app

      - name: Upload unsigned macOS app
        if: env.UPLOAD_ARTIFACT == 'true'
        uses: actions/upload-artifact@master
        with:
          name: rustdesk-unsigned-macos-arm64
          path: rustdesk-${{ env.VERSION }}-arm64.dmg # can not upload the directory directly or tar.gz file, which destroy the link structure, causing the codesign failed

      - name: Codesign app and create signed dmg
        if: env.MACOS_P12_BASE64 != null && env.UPLOAD_ARTIFACT == 'true'
        run: |
          # Patch create-dmg to give more attempts to unmount image
          CREATE_DMG="$(command -v create-dmg)"
          CREATE_DMG="$(readlink -f "$CREATE_DMG")"
          sed -i -e 's/MAXIMUM_UNMOUNTING_ATTEMPTS=3/MAXIMUM_UNMOUNTING_ATTEMPTS=7/' "$CREATE_DMG"
          # start sign the rustdesk.app and dmg
          rm -rf *.dmg || true
          codesign --force --options runtime -s ${{ secrets.MACOS_CODESIGN_IDENTITY }} --deep --strict ./flutter/build/macos/Build/Products/Release/RustDesk.app -vvv
          create-dmg --icon "RustDesk.app" 200 190 --hide-extension "RustDesk.app" --window-size 800 400 --app-drop-link 600 185 rustdesk-${{ env.VERSION }}.dmg ./flutter/build/macos/Build/Products/Release/RustDesk.app
          codesign --force --options runtime -s ${{ secrets.MACOS_CODESIGN_IDENTITY }} --deep --strict rustdesk-${{ env.VERSION }}.dmg -vvv
          # notarize the rustdesk-${{ env.VERSION }}.dmg
          rcodesign notary-submit --api-key-path ~/.p12/api-key.json  --staple rustdesk-${{ env.VERSION }}.dmg

      - name: Rename rustdesk
        if: env.UPLOAD_ARTIFACT == 'true'
        run: |
          for name in rustdesk*??.dmg; do
              mv "$name" "${name%%.dmg}-aarch64.dmg"
          done

      - name: Publish DMG package
        if: env.UPLOAD_ARTIFACT == 'true'
        uses: softprops/action-gh-release@v1
        with:
          prerelease: true
          draft: true
          tag_name: ${{ env.TAG_NAME }}
          files: |
            rustdesk*-aarch64.dmg

  build-for-macOS:
    if: false
    name: ${{ matrix.job.target }}
    runs-on: ${{ matrix.job.os }}
    needs: [generate-bridge]
    strategy:
      fail-fast: false
      matrix:
        job:
          - {
              target: x86_64-apple-darwin,
              os: macos-15-intel, #macos-latest or macos-14 use M1 now, https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners/about-github-hosted-runners#:~:text=14%20GB-,macos%2Dlatest%20or%20macos%2D14,-The%20macos%2Dlatestlabel
              extra-build-args: "",
              arch: x86_64,
              vcpkg-triplet: x64-osx,
            }
          - {
              target: aarch64-apple-darwin,
              os: macos-14,
              # extra-build-args: "--disable-flutter-texture-render", # disable this for mac, because we see a lot of users reporting flickering both on arm and x64, and we can not confirm if texture rendering has better performance if htere is no vram, https://github.com/rustdesk/rustdesk/issues/6296
              extra-build-args: "--screencapturekit",
              arch: aarch64,
              vcpkg-triplet: arm64-osx,
            }
    steps:
      - name: Export GitHub Actions cache environment variables
        uses: actions/github-script@v6
        with:
          script: |
            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');

      - name: Checkout source code
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Import the codesign cert
        if: env.MACOS_P12_BASE64 != null
        uses: apple-actions/import-codesign-certs@v1
        with:
          p12-file-base64: ${{ secrets.MACOS_P12_BASE64 }}
          p12-password: ${{ secrets.MACOS_P12_PASSWORD }}
          keychain: rustdesk

      - name: Check sign and import sign key
        if: env.MACOS_P12_BASE64 != null
        run: |
          security default-keychain -s rustdesk.keychain
          security find-identity -v

      - name: Import notarize key
        if: env.MACOS_P12_BASE64 != null
        uses: timheuer/base64-to-file@v1.2
        with:
          # https://gregoryszorc.com/docs/apple-codesign/stable/apple_codesign_rcodesign.html#notarizing-and-stapling
          fileName: rustdesk.json
          fileDir: ${{ github.workspace }}
          encodedString: ${{ secrets.MACOS_NOTARIZE_JSON }}

      - name: Install rcodesign tool
        if: env.MACOS_P12_BASE64 != null
        shell: bash
        run: |
          pushd /tmp
          wget https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F0.22.0/apple-codesign-0.22.0-macos-universal.tar.gz
          tar -zxvf apple-codesign-0.22.0-macos-universal.tar.gz
          mv apple-codesign-0.22.0-macos-universal/rcodesign /usr/local/bin
          popd

      - name: Install build runtime
        run: |
          brew install llvm create-dmg
          # pkg-config is handled in a separate step, because it may be already installed by `macos-latest`(14.7.1) runner
          if command -v pkg-config &>/dev/null; then
              echo "pkg-config is already installed"
          else
              brew install pkg-config
          fi
      - name: Install NASM
        run: |
          # Install NASM 2.16.x from official release.
          # Do NOT use `brew install nasm` which installs NASM 3.x.
          # NASM 3.x is a complete rewrite with incompatible CLI options and removed features.
          # aom and other multimedia libraries require NASM 2.x for x86/x86_64 assembly.
          wget https://www.nasm.us/pub/nasm/releasebuilds/2.16.03/macosx/nasm-2.16.03-macosx.zip
          unzip nasm-2.16.03-macosx.zip
          sudo cp nasm-2.16.03/nasm /usr/local/bin/nasm
          nasm --version

      - name: Install flutter
        uses: subosito/flutter-action@v2
        with:
          channel: "stable"
          flutter-version: ${{ env.FLUTTER_VERSION }}

      - name: Patch flutter
        run: |
          cd $(dirname $(dirname $(which flutter)))
          [[ "3.24.5" == ${{env.FLUTTER_VERSION}} ]] && git apply ${{ github.workspace }}/.github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff

      - name: Workaround for flutter issue
        shell: bash
        run: |
          cd "$(dirname "$(which flutter)")"
          # https://github.com/flutter/flutter/issues/133533
          sed -i -e 's/_setFramesEnabledState(false);/\/\/_setFramesEnabledState(false);/g' ../packages/flutter/lib/src/scheduler/binding.dart
          grep -n '_setFramesEnabledState(false);' ../packages/flutter/lib/src/scheduler/binding.dart

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@v1
        with:
          toolchain: ${{ env.MAC_RUST_VERSION }}
          targets: ${{ matrix.job.target }}
          components: "rustfmt"

      - uses: Swatinem/rust-cache@v2
        with:
          prefix-key: ${{ matrix.job.os }}

      - name: Restore bridge files
        uses: actions/download-artifact@master
        with:
          name: bridge-artifact
          path: ./

      - name: Setup vcpkg with Github Actions binary cache
        uses: lukka/run-vcpkg@v11
        with:
          vcpkgGitCommitId: ${{ env.VCPKG_COMMIT_ID }}
          doNotCache: false

      - name: Install vcpkg dependencies
        run: |
          if ! $VCPKG_ROOT/vcpkg \
            install \
            --x-install-root="$VCPKG_ROOT/installed"; then
            find "${VCPKG_ROOT}/" -name "*.log" | while read -r _1; do
              echo "$_1:"
              echo "======"
              cat "$_1"
              echo "======"
              echo ""
            done
            exit 1
          fi
          head -n 100 "${VCPKG_ROOT}/buildtrees/ffmpeg/build-${{ matrix.job.vcpkg-triplet }}-rel-out.log" || true

      - name: Show version information (Rust, cargo, Clang)
        shell: bash
        run: |
          clang --version || true
          rustup -V
          rustup toolchain list
          rustup default
          cargo -V
          rustc -V

      - name: Build rustdesk
        run: |
          if [ "${{ matrix.job.target }}" = "aarch64-apple-darwin" ]; then
            MIN_MACOS_VERSION="12.3"
            sed -i -e "s/MACOSX_DEPLOYMENT_TARGET\=[0-9]*.[0-9]*/MACOSX_DEPLOYMENT_TARGET=${MIN_MACOS_VERSION}/" build.py
            sed -i -e "s/platform :osx, '.*'/platform :osx, '${MIN_MACOS_VERSION}'/" flutter/macos/Podfile
            sed -i -e "s/osx_minimum_system_version = \"[0-9]*.[0-9]*\"/osx_minimum_system_version = \"${MIN_MACOS_VERSION}\"/" Cargo.toml
            sed -i -e "s/MACOSX_DEPLOYMENT_TARGET = [0-9]*.[0-9]*;/MACOSX_DEPLOYMENT_TARGET = ${MIN_MACOS_VERSION};/" flutter/macos/Runner.xcodeproj/project.pbxproj
          fi
          ./build.py --flutter --hwcodec --unix-file-copy-paste ${{ matrix.job.extra-build-args }}

      - name: create unsigned dmg
        if: env.UPLOAD_ARTIFACT == 'true'
        run: |
          CREATE_DMG="$(command -v create-dmg)"
          CREATE_DMG="$(readlink -f "$CREATE_DMG")"
          sed -i -e 's/MAXIMUM_UNMOUNTING_ATTEMPTS=3/MAXIMUM_UNMOUNTING_ATTEMPTS=7/' "$CREATE_DMG"
          create-dmg --icon "RustDesk.app" 200 190 --hide-extension "RustDesk.app" --window-size 800 400 --app-drop-link 600 185 rustdesk-${{ env.VERSION }}-${{ matrix.job.arch }}.dmg ./flutter/build/macos/Build/Products/Release/RustDesk.app

      - name: Upload unsigned macOS app
        if: env.UPLOAD_ARTIFACT == 'true'
        uses: actions/upload-artifact@master
        with:
          name: rustdesk-unsigned-macos-${{ matrix.job.arch }}
          path: rustdesk-${{ env.VERSION }}-${{ matrix.job.arch }}.dmg # can not upload the directory directly or tar.gz, which destroy the link structure, causing the codesign failed

      - name: Codesign app and create signed dmg
        if: env.MACOS_P12_BASE64 != null && env.UPLOAD_ARTIFACT == 'true'
        run: |
          # Patch create-dmg to give more attempts to unmount image
          CREATE_DMG="$(command -v create-dmg)"
          CREATE_DMG="$(readlink -f "$CREATE_DMG")"
          sed -i -e 's/MAXIMUM_UNMOUNTING_ATTEMPTS=3/MAXIMUM_UNMOUNTING_ATTEMPTS=7/' "$CREATE_DMG"
          # Unlock keychain
          security default-keychain -s rustdesk.keychain
          security unlock-keychain -p ${{ secrets.MACOS_P12_PASSWORD }} rustdesk.keychain
          # start sign the rustdesk.app and dmg
          rm -rf *.dmg || true
          codesign --force --options runtime -s ${{ secrets.MACOS_CODESIGN_IDENTITY }} --deep --strict ./flutter/build/macos/Build/Products/Release/RustDesk.app -vvv
          create-dmg --icon "RustDesk.app" 200 190 --hide-extension "RustDesk.app" --window-size 800 400 --app-drop-link 600 185 rustdesk-${{ env.VERSION }}.dmg ./flutter/build/macos/Build/Products/Release/RustDesk.app
          codesign --force --options runtime -s ${{ secrets.MACOS_CODESIGN_IDENTITY }} --deep --strict rustdesk-${{ env.VERSION }}.dmg -vvv
          # notarize the rustdesk-${{ env.VERSION }}.dmg
          rcodesign notary-submit --api-key-path ${{ github.workspace }}/rustdesk.json  --staple rustdesk-${{ env.VERSION }}.dmg

      - name: Rename rustdesk
        if: env.UPLOAD_ARTIFACT == 'true'
        run: |
          for name in rustdesk*??.dmg; do
              mv "$name" "${name%%.dmg}-${{ matrix.job.arch }}.dmg"
          done

      - name: Publish DMG package
        if: env.UPLOAD_ARTIFACT == 'true'
        uses: softprops/action-gh-release@v1
        with:
          prerelease: true
          tag_name: ${{ env.TAG_NAME }}
          files: |
            rustdesk*-${{ matrix.job.arch }}.dmg

  publish_unsigned:
    needs:
      - build-for-macOS
      - build-for-windows-flutter
    runs-on: ubuntu-latest
    if: ${{ inputs.upload-artifact }}
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: rustdesk-unsigned-macos-x86_64
          path: ./

      - name: Download Artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: rustdesk-unsigned-macos-aarch64
          path: ./

      - name: Download Artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: rustdesk-unsigned-windows-x86_64
          path: ./windows-x86_64/

      - name: Download Artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: rustdesk-unsigned-windows-x86
          path: ./windows-x86/
      - name: Combine unsigned app
        run: |
          tar czf rustdesk-${{ env.VERSION }}-unsigned.tar.gz *.dmg windows-x86_64

      - name: Publish unsigned app
        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
        with:
          prerelease: true
          tag_name: ${{ env.TAG_NAME }}
          files: rustdesk-${{ env.VERSION }}-unsigned.tar.gz

  build-rustdesk-android:
    needs: [generate-bridge]
    name: build rustdesk android apk ${{ matrix.job.target }}
    runs-on: ${{ matrix.job.os }}
    strategy:
      fail-fast: false
      matrix:
        job:
          - {
              arch: aarch64,
              target: aarch64-linux-android,
              os: ubuntu-24.04,
              reltype: release,
              suffix: "",
            }
    steps:
      - name: Free Disk Space (Ubuntu)
        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
        with:
          tool-cache: false
          android: false
          dotnet: true
          haskell: true
          large-packages: false
          docker-images: true
          swap-storage: false

      - name: Export GitHub Actions cache environment variables
        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
        with:
          script: |
            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
               clang \
               cmake \
               curl \
               gcc-multilib \
               git \
               g++ \
               g++-multilib \
               libayatana-appindicator3-dev \
               libasound2-dev \
               libc6-dev \
               libclang-dev \
               libunwind-dev \
               libgstreamer1.0-dev \
               libgstreamer-plugins-base1.0-dev \
               libgtk-3-dev \
               libpam0g-dev \
               libpulse-dev \
               libva-dev \
               libxcb-randr0-dev \
               libxcb-shape0-dev \
               libxcb-xfixes0-dev \
               libxdo-dev \
               libxfixes-dev \
               llvm-dev \
               nasm \
               ninja-build \
               openjdk-17-jdk-headless \
               pkg-config \
               tree \
               wget

      - name: Checkout source code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          submodules: recursive

      - name: Install flutter
        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
        with:
          channel: "stable"
          flutter-version: ${{ env.ANDROID_FLUTTER_VERSION }}

      - name: Patch flutter
        run: |
          cd $(dirname $(dirname $(which flutter)))
          [[ "3.24.5" == ${{env.ANDROID_FLUTTER_VERSION}} ]] && git apply ${{ github.workspace }}/.github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff

      - uses: nttld/setup-ndk@ed92fe6cadad69be94a966a7ee3271275e62f779 # v1
        id: setup-ndk
        with:
          ndk-version: ${{ env.NDK_VERSION }}
          add-to-path: true

      - name: Setup vcpkg with Github Actions binary cache
        uses: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2 # v11
        with:
          vcpkgDirectory: /opt/artifacts/vcpkg
          vcpkgGitCommitId: ${{ env.VCPKG_COMMIT_ID }}
          doNotCache: false

      - name: Install vcpkg dependencies
        run: |
          case ${{ matrix.job.target }} in
            aarch64-linux-android)
              ANDROID_TARGET=arm64-v8a
            ;;
          esac
          if ! ./flutter/build_android_deps.sh "${ANDROID_TARGET}"; then
            find "${VCPKG_ROOT}/" -name "*.log" | while read -r _1; do
              echo "$_1:"
              echo "======"
              cat "$_1"
              echo "======"
              echo ""
            done
            exit 1
          fi
        shell: bash

      - name: Restore bridge files
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: bridge-artifact
          path: ./

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: ${{ env.RUST_VERSION }}
          components: "rustfmt"

      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          prefix-key: rustdesk-lib-cache-android # TODO: drop '-android' part after caches are invalidated
          key: ${{ matrix.job.target }}

      - name: Build rustdesk lib
        env:
          ANDROID_NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
          ANDROID_NDK_ROOT: ${{ steps.setup-ndk.outputs.ndk-path }}
        run: |
          rustup target add ${{ matrix.job.target }}
          cargo install cargo-ndk --version ${{ env.CARGO_NDK_VERSION }} --locked
          case ${{ matrix.job.target }} in
            aarch64-linux-android)
              ./flutter/ndk_arm64.sh
              mkdir -p ./flutter/android/app/src/main/jniLibs/arm64-v8a
              cp ./target/${{ matrix.job.target }}/release/liblibrustdesk.so ./flutter/android/app/src/main/jniLibs/arm64-v8a/librustdesk.so
            ;;
          esac

      - name: Upload Rustdesk library to Artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: librustdesk.so.${{ matrix.job.target }}
          path: ./target/${{ matrix.job.target }}/release/liblibrustdesk.so

      - name: Build rustdesk
        shell: bash
        env:
          JAVA_HOME: /usr/lib/jvm/java-17-openjdk-amd64
        run: |
          export PATH=/usr/lib/jvm/java-17-openjdk-amd64/bin:$PATH
          # Increase Gradle JVM memory for CI builds
          sed -i "s/org.gradle.jvmargs=-Xmx1024M/org.gradle.jvmargs=-Xmx2g/g" ./flutter/android/gradle.properties
          # temporary use debug sign config
          sed -i "s/signingConfigs.release/signingConfigs.debug/g" ./flutter/android/app/build.gradle
          case ${{ matrix.job.target }} in
            aarch64-linux-android)
              mkdir -p ./flutter/android/app/src/main/jniLibs/arm64-v8a
              cp ${ANDROID_NDK_HOME}/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/aarch64-linux-android/libc++_shared.so ./flutter/android/app/src/main/jniLibs/arm64-v8a/
              cp ./target/${{ matrix.job.target }}/release/liblibrustdesk.so ./flutter/android/app/src/main/jniLibs/arm64-v8a/librustdesk.so
              # build flutter
              pushd flutter
              flutter build apk "--${{ matrix.job.reltype }}" --target-platform android-arm64 --split-per-abi
              mv build/app/outputs/flutter-apk/app-arm64-v8a-${{ matrix.job.reltype }}.apk ../rustdesk-${{ env.VERSION }}-${{ matrix.job.arch }}${{ matrix.job.suffix }}.apk
            ;;
          esac
          popd
          mkdir -p signed-apk; pushd signed-apk
          mv ../rustdesk-${{ env.VERSION }}-${{ matrix.job.arch }}${{ matrix.job.suffix }}.apk .
          # cp rustdesk-${{ env.VERSION }}-${{ matrix.job.arch }}${{ matrix.job.suffix }}.apk rustdesk-${{ matrix.job.arch }}.apk

      # https://github.com/r0adkll/sign-android-release/issues/84#issuecomment-1889636075
      - name: Setup sign tool version variable
        shell: bash
        run: |
          BUILD_TOOL_VERSION=$(ls /usr/local/lib/android/sdk/build-tools/ | tail -n 1)
          echo "ANDROID_SIGN_TOOL_VERSION=$BUILD_TOOL_VERSION" >> $GITHUB_ENV
          echo Last build tool version is: $BUILD_TOOL_VERSION

      - uses: r0adkll/sign-android-release@349ebdef58775b1e0d8099458af0816dc79b6407 # v1
        name: Sign app APK
        if: env.ANDROID_SIGNING_KEY != null
        id: sign-rustdesk
        with:
          releaseDirectory: ./signed-apk
          signingKeyBase64: ${{ secrets.ANDROID_SIGNING_KEY }}
          alias: ${{ secrets.ANDROID_ALIAS }}
          keyStorePassword: ${{ secrets.ANDROID_KEY_STORE_PASSWORD }}
          keyPassword: ${{ secrets.ANDROID_KEY_PASSWORD }}
        env:
          # env.ANDROID_SIGN_TOOL_VERSION is set by Step "Setup sign tool version variable"
          BUILD_TOOLS_VERSION: ${{ env.ANDROID_SIGN_TOOL_VERSION }}

      - name: Upload Artifacts
        if: env.ANDROID_SIGNING_KEY != null && env.UPLOAD_ARTIFACT == 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: rustdesk-${{ env.VERSION }}-${{ matrix.job.arch }}.apk
          path: ${{steps.sign-rustdesk.outputs.signedReleaseFile}}

      - name: Copy sign APK
        shell: bash
        run: |
          cp ./signed-apk/rustdesk-${{ env.VERSION }}-${{ matrix.job.arch }}${{ matrix.job.suffix }}-signed.apk ./signed-apk/rustdesk-${{ matrix.job.arch }}-signed.apk

      - name: Publish signed apk package
        if: env.ANDROID_SIGNING_KEY != null && env.UPLOAD_ARTIFACT == 'true'
        uses: softprops/action-gh-release@v2
        with:
          prerelease: false
          draft: true
          tag_name: ${{ env.TAG_NAME }}
          files: |
            ${{steps.sign-rustdesk.outputs.signedReleaseFile}}
            ./signed-apk/rustdesk-${{ matrix.job.arch }}-signed.apk

      - name: Publish unsigned apk package
        if: env.ANDROID_SIGNING_KEY == null && env.UPLOAD_ARTIFACT == 'true'
        uses: softprops/action-gh-release@v2
        with:
          prerelease: true
          draft: true
          tag_name: ${{ env.TAG_NAME }}
          files: |
            signed-apk/rustdesk-${{ env.VERSION }}-${{ matrix.job.arch }}.apk