release.yml

name: Publish signed release

on:
  push:
    tags:
      - v*

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  verify-version:
    name: Verify release version
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7
      - name: Match tag to package version
        shell: bash
        run: |
          set -euo pipefail
          package_version="$(node -p "require('./package.json').version")"
          test "${GITHUB_REF_NAME}" = "v${package_version}" || {
            echo "Tag ${GITHUB_REF_NAME} does not match package version v${package_version}."
            exit 1
          }

      - name: Test updater manifest safeguards
        run: node --test scripts/lib/updater-manifest.test.mjs

  quality:
    name: Format, lint, test, and build
    needs: verify-version
    runs-on: ubuntu-22.04
    timeout-minutes: 30
    steps:
      - name: Checkout full history
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Install Linux system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libappindicator3-dev \
            librsvg2-dev \
            patchelf

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Restore Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: src-tauri -> target

      - name: Install frontend dependencies
        run: npm ci

      - name: Run complete checks
        run: npm run check

  create-release:
    name: Create draft release
    needs:
      - verify-version
      - quality
    runs-on: ubuntu-latest
    outputs:
      release_id: ${{ steps.release.outputs.release_id }}
    steps:
      - name: Checkout full history
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Generate changelog from commits
        env:
          NOTES_PATH: ${{ runner.temp }}/release-notes.md
        shell: bash
        run: |
          set -euo pipefail
          node scripts/generate-changelog.mjs \
            --auto-from \
            --auto-from-ref "${GITHUB_SHA}^" \
            --to "${GITHUB_SHA}" \
            --version "${GITHUB_REF_NAME}" \
            --repository "${GITHUB_REPOSITORY}" \
            --output "${NOTES_PATH}" \
            --strict

      - name: Create or reuse one draft
        id: release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NOTES_PATH: ${{ runner.temp }}/release-notes.md
        shell: bash
        run: |
          set -euo pipefail
          release_id="$(
            gh api "repos/${GITHUB_REPOSITORY}/releases?per_page=100" \
              --jq ".[] | select(.tag_name == \"${GITHUB_REF_NAME}\" and .draft == true) | .id" \
              | head -n 1
          )"

          if [[ -z "${release_id}" ]]; then
            release_id="$(
              gh api --method POST "repos/${GITHUB_REPOSITORY}/releases" \
                -f tag_name="${GITHUB_REF_NAME}" \
                -f target_commitish="${GITHUB_SHA}" \
                -f name="BiliRec Control ${GITHUB_REF_NAME}" \
                -f body="$(cat "${NOTES_PATH}")" \
                -F draft=true \
                -F prerelease=false \
                --jq '.id'
            )"
          else
            gh api --method PATCH \
              "repos/${GITHUB_REPOSITORY}/releases/${release_id}" \
              -f name="BiliRec Control ${GITHUB_REF_NAME}" \
              -f body="$(cat "${NOTES_PATH}")" \
              -F draft=true \
              -F prerelease=false \
              >/dev/null
          fi

          echo "release_id=${release_id}" >> "${GITHUB_OUTPUT}"

  build-release:
    name: ${{ matrix.name }}
    needs:
      - verify-version
      - quality
      - create-release
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: Windows x64
            os: windows-latest
            target: x86_64-pc-windows-msvc
            rust_targets: x86_64-pc-windows-msvc
            bundles: nsis,msi
            platform: windows
            archive: windows-x64
          - name: Windows ARM64
            os: windows-11-arm
            target: aarch64-pc-windows-msvc
            rust_targets: aarch64-pc-windows-msvc
            bundles: nsis
            platform: windows
            archive: windows-arm64
          - name: Linux x64
            os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            rust_targets: x86_64-unknown-linux-gnu
            bundles: appimage,deb,rpm
            platform: linux
            archive: linux-x64
          - name: Linux ARM64
            os: ubuntu-22.04-arm
            target: aarch64-unknown-linux-gnu
            rust_targets: aarch64-unknown-linux-gnu
            bundles: appimage,deb,rpm
            platform: linux
            archive: linux-arm64
          - name: macOS Intel
            os: macos-15-intel
            target: x86_64-apple-darwin
            rust_targets: x86_64-apple-darwin
            bundles: app,dmg
            platform: macos
            archive: macos-x64
          - name: macOS Apple Silicon
            os: macos-15
            target: aarch64-apple-darwin
            rust_targets: aarch64-apple-darwin
            bundles: app,dmg
            platform: macos
            archive: macos-arm64
          - name: macOS Universal
            os: macos-15
            target: universal-apple-darwin
            rust_targets: aarch64-apple-darwin,x86_64-apple-darwin
            bundles: app,dmg
            platform: macos
            archive: macos-universal

    runs-on: ${{ matrix.os }}
    timeout-minutes: 75

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Linux system dependencies
        if: matrix.platform == 'linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libappindicator3-dev \
            librsvg2-dev \
            patchelf \
            libfuse2 \
            xdg-utils \
            rpm \
            zip

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.rust_targets }}

      - name: Restore Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: src-tauri -> target

      - name: Install frontend dependencies
        run: npm ci

      - name: Build and upload signed release packages
        uses: tauri-apps/tauri-action@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          releaseId: ${{ needs.create-release.outputs.release_id }}
          tagName: ${{ github.ref_name }}
          releaseDraft: true
          prerelease: false
          updaterJsonPreferNsis: true
          uploadUpdaterJson: false
          args: --target ${{ matrix.target }} --bundles ${{ matrix.bundles }}

      - name: Create Windows portable ZIP
        if: matrix.platform == 'windows'
        shell: pwsh
        run: |
          $version = node -p "require('./package.json').version"
          $binary = "src-tauri/target/${{ matrix.target }}/release/bilirec-control.exe"
          if (-not (Test-Path -LiteralPath $binary)) {
            throw "Portable executable not found: $binary"
          }
          New-Item -ItemType Directory -Path dist -Force | Out-Null
          Compress-Archive `
            -LiteralPath $binary, "PORTABLE.md" `
            -DestinationPath "dist/BiliRec-Control-$version-${{ matrix.archive }}-portable.zip" `
            -CompressionLevel Optimal `
            -Force

      - name: Create Linux portable ZIP
        if: matrix.platform == 'linux'
        shell: bash
        run: |
          set -euo pipefail
          version="$(node -p "require('./package.json').version")"
          appimage="$(find "src-tauri/target/${{ matrix.target }}/release/bundle/appimage" -maxdepth 1 -type f -name '*.AppImage' -print -quit)"
          test -n "$appimage"
          mkdir -p dist
          zip -j "dist/BiliRec-Control-${version}-${{ matrix.archive }}-portable.zip" "$appimage" PORTABLE.md

      - name: Create macOS portable ZIP
        if: matrix.platform == 'macos'
        shell: bash
        run: |
          set -euo pipefail
          version="$(node -p "require('./package.json').version")"
          app="$(find "src-tauri/target/${{ matrix.target }}/release/bundle/macos" -maxdepth 1 -type d -name '*.app' -print -quit)"
          test -n "$app"
          mkdir -p dist
          ditto -c -k --keepParent "$app" "dist/BiliRec-Control-${version}-${{ matrix.archive }}-portable.zip"

      - name: Upload portable archive to draft release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: gh release upload "${GITHUB_REF_NAME}" dist/*.zip --clobber

  publish-release:
    name: Publish release
    needs:
      - create-release
      - build-release
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Rebuild updater manifest and synchronize release notes
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_ID: ${{ needs.create-release.outputs.release_id }}
        shell: bash
        run: |
          set -euo pipefail
          work_dir="${RUNNER_TEMP}/updater-release-notes"
          mkdir -p "${work_dir}"

          node scripts/build-updater-manifest.mjs \
            --repository "${GITHUB_REPOSITORY}" \
            --release-id "${RELEASE_ID}" \
            --tag "${GITHUB_REF_NAME}" \
            --output "${work_dir}/latest.json"
          node scripts/validate-updater-manifest.mjs \
            --input "${work_dir}/latest.json" \
            --repository "${GITHUB_REPOSITORY}" \
            --tag "${GITHUB_REF_NAME}"

          gh release upload "${GITHUB_REF_NAME}" "${work_dir}/latest.json" \
            --repo "${GITHUB_REPOSITORY}" \
            --clobber

      - name: Publish the completed release for verification
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_ID: ${{ needs.create-release.outputs.release_id }}
        run: |
          gh api --method PATCH \
            "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" \
            -F draft=false \
            -f make_latest=false

      - name: Verify anonymous updater downloads for tag
        shell: bash
        run: |
          set -euo pipefail
          node scripts/verify-public-updater.mjs \
            --url "https://github.com/${GITHUB_REPOSITORY}/releases/download/${GITHUB_REF_NAME}/latest.json" \
            --repository "${GITHUB_REPOSITORY}" \
            --tag "${GITHUB_REF_NAME}" \
            --probe

      - name: Promote the verified release to latest
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_ID: ${{ needs.create-release.outputs.release_id }}
        run: |
          gh api --method PATCH \
            "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" \
            -f make_latest=true

      - name: Verify latest updater metadata
        shell: bash
        run: |
          set -euo pipefail
          node scripts/verify-public-updater.mjs \
            --url "https://github.com/${GITHUB_REPOSITORY}/releases/latest/download/latest.json" \
            --repository "${GITHUB_REPOSITORY}" \
            --tag "${GITHUB_REF_NAME}"