ci.yml

name: CI

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:
    inputs:
      release-tag:
        description: Release version tag (e.g. v0.1.0)
        required: true
        default: v0.1.0
        type: string
      prerelease:
        description: Mark the GitHub release as a prerelease
        required: true
        default: false
        type: boolean

env:
  R2_BUCKET: osagent-releases
  R2_RELEASE_PREFIX: releases
  CDN_BASE_URL: https://osa.fuckyourcdn.com

jobs:
  validate-release-tag:
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-22.04
    steps:
      - name: Validate release tag format
        shell: bash
        run: |
          RELEASE_TAG="${{ inputs['release-tag'] }}"
          if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
            echo "Invalid release tag: $RELEASE_TAG"
            echo "Expected format: v0.1.0 or v0.1.0-rc1"
            exit 1
          fi

  quick:
    if: github.event_name != 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libjavascriptcoregtk-4.1-dev \
            libwayland-dev \
            build-essential \
            curl \
            wget \
            file \
            libxdo-dev \
            libssl-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            libsoup-3.0-dev \
            libgtk-3-dev

      - name: Run clippy
        run: cargo clippy --all-targets --features discord -- -D warnings

  release-linux:
    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'
    needs: validate-release-tag
    runs-on: ubuntu-22.04
    env:
      RELEASE_TAG: ${{ inputs['release-tag'] }}
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
            updater/target
            launcher/target
          key: linux-cargo-release-${{ hashFiles('**/Cargo.lock') }}

      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libjavascriptcoregtk-4.1-dev \
            libwayland-dev \
            build-essential \
            curl \
            wget \
            file \
            libxdo-dev \
            libssl-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            libsoup-3.0-dev \
            libgtk-3-dev

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Bundle frontend
        run: |
          cd frontend
          npm install
          npm run build

      - name: Install cargo-tauri CLI
        run: cargo install tauri-cli --locked

      - name: Build Linux release artifacts
        run: |
          export OSAGENT_APP_VERSION="${RELEASE_TAG#v}"
          perl -0pi -e 's/"version":\s*"[^"]+"/"version": "'"$OSAGENT_APP_VERSION"'"/' launcher/tauri.conf.json
          cargo build --release --features discord,production-frontend
          CARGO_TARGET_DIR="$GITHUB_WORKSPACE/updater/target" cargo build --manifest-path updater/Cargo.toml --release
          export OSAGENT_CORE_SOURCE="$GITHUB_WORKSPACE/target/release/osagent"
          export OSAGENT_UPDATER_SOURCE="$GITHUB_WORKSPACE/updater/target/release/osagent-updater"
          (cd launcher && cargo tauri build --bundles deb --target x86_64-unknown-linux-gnu)
          DEB_FILE=$(find "$GITHUB_WORKSPACE/launcher/target/x86_64-unknown-linux-gnu/release/bundle/deb" -name "*.deb" | head -1)
          if [ -z "$DEB_FILE" ] || [ ! -f "$DEB_FILE" ]; then
            echo "Linux .deb bundle not found"
            exit 1
          fi
          cp "$DEB_FILE" "$GITHUB_WORKSPACE/osagent-linux-x86_64.deb"
          (cd "$GITHUB_WORKSPACE" && sha256sum osagent-linux-x86_64.deb > osagent-linux-x86_64.deb.sha256)

      - name: Upload Linux release artifacts
        uses: actions/upload-artifact@v4
        with:
          name: linux-x86_64
          path: |
            osagent-linux-x86_64.deb
            osagent-linux-x86_64.deb.sha256

  release-windows-installer:
    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'
    needs: validate-release-tag
    runs-on: windows-latest
    env:
      RELEASE_TAG: ${{ inputs['release-tag'] }}
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
            updater/target
            launcher/target
          key: win-installer-cargo-release-${{ hashFiles('**/Cargo.lock') }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Bundle frontend
        shell: pwsh
        run: |
          Set-Location frontend
          npm install
          npm run build

      - name: Install cargo-tauri CLI
        run: cargo install tauri-cli --locked

      - name: Build Windows installer artifacts
        shell: pwsh
        run: |
          $env:OSAGENT_APP_VERSION = $env:RELEASE_TAG.TrimStart("v")
          $configPath = Join-Path $env:GITHUB_WORKSPACE "launcher/tauri.conf.json"
          $config = Get-Content $configPath -Raw
          $config = [regex]::Replace($config, '"version"\s*:\s*"[^"]+"', '"version": "' + $env:OSAGENT_APP_VERSION + '"')
          Set-Content -Path $configPath -Value $config -NoNewline
          ./build-launcher.ps1 -Installer
          Copy-Item "launcher/target/release/bundle/nsis/*.exe" "osagent-windows-x86_64-setup.exe"
          Get-FileHash osagent-windows-x86_64-setup.exe -Algorithm SHA256 | ForEach-Object { "$($_.Hash.ToLower())  osagent-windows-x86_64-setup.exe" } | Set-Content osagent-windows-x86_64-setup.exe.sha256

      - name: Upload Windows installer artifacts
        uses: actions/upload-artifact@v4
        with:
          name: windows-installer
          path: |
            osagent-windows-x86_64-setup.exe
            osagent-windows-x86_64-setup.exe.sha256

  release-macos-arm64:
    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'
    needs: validate-release-tag
    runs-on: macos-14
    env:
      RELEASE_TAG: ${{ inputs['release-tag'] }}
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
            updater/target
            launcher/target
          key: macos-arm64-cargo-release-${{ hashFiles('**/Cargo.lock') }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Bundle frontend
        run: |
          cd frontend
          npm install
          npm run build

      - name: Install cargo-tauri CLI
        run: cargo install tauri-cli --locked

      - name: Build macOS release artifacts
        run: |
          export OSAGENT_APP_VERSION="${RELEASE_TAG#v}"
          sed -i '' 's/"version":\s*"[^"]*"/"version": "'"$OSAGENT_APP_VERSION"'"/' launcher/tauri.conf.json
          cargo build --release --features discord,production-frontend
          CARGO_TARGET_DIR="$GITHUB_WORKSPACE/updater/target" cargo build --manifest-path updater/Cargo.toml --release
          export OSAGENT_CORE_SOURCE="$GITHUB_WORKSPACE/target/release/osagent"
          export OSAGENT_UPDATER_SOURCE="$GITHUB_WORKSPACE/updater/target/release/osagent-updater"
          (cd launcher && cargo tauri build --bundles app --target aarch64-apple-darwin)
          APP_BUNDLE=$(find "$GITHUB_WORKSPACE/launcher/target/aarch64-apple-darwin/release/bundle/macos" -name "*.app" -maxdepth 1 -type d | head -1)
          if [ -z "$APP_BUNDLE" ] || [ ! -d "$APP_BUNDLE" ]; then
            echo "macOS .app bundle not found"
            exit 1
          fi
          echo "==> Ad-hoc signing app bundle..."
          codesign --force --deep --sign - "$APP_BUNDLE"
          codesign -dv "$APP_BUNDLE"
          echo "==> Creating DMG from signed .app..."
          DMG_STAGING="$GITHUB_WORKSPACE/dmg-staging"
          rm -rf "$DMG_STAGING"
          mkdir -p "$DMG_STAGING"
          cp -R "$APP_BUNDLE" "$DMG_STAGING/"
          ln -s /Applications "$DMG_STAGING/Applications"
          DMG_FILE="$GITHUB_WORKSPACE/osagent-macos-arm64.dmg"
          hdiutil create -volname "OSAgent Launcher" -srcfolder "$DMG_STAGING" -format UDZO -ov "$DMG_FILE"
          echo "==> DMG created: $DMG_FILE"
          if [ ! -f "$DMG_FILE" ]; then
            echo "DMG creation failed"
            exit 1
          fi
          (cd "$GITHUB_WORKSPACE" && shasum -a 256 osagent-macos-arm64.dmg > osagent-macos-arm64.dmg.sha256)

      - name: Verify DMG
        run: |
          DMG_PATH="$GITHUB_WORKSPACE/osagent-macos-arm64.dmg"
          echo "==> Verifying DMG integrity..."
          hdiutil verify "$DMG_PATH"
          echo "==> Checking DMG contents..."
          hdiutil imageinfo "$DMG_PATH"
          echo "==> Attempting attach (read-only, no browse)..."
          hdiutil attach "$DMG_PATH" -readonly -nobrowse -mountpoint /tmp/osagent-dmg-mount
          ls -laR /tmp/osagent-dmg-mount/
          APP_BUNDLE=$(find /tmp/osagent-dmg-mount -name "*.app" -type d -maxdepth 3 | head -1)
          if [ -z "$APP_BUNDLE" ]; then
            echo "ERROR: No .app bundle found in DMG"
            hdiutil detach /tmp/osagent-dmg-mount 2>/dev/null || true
            exit 1
          fi
          echo "==> .app bundle found: $APP_BUNDLE"
          echo "==> Checking .app structure..."
          ls -la "$APP_BUNDLE/Contents/"
          echo "==> Checking code signature..."
          if ! codesign -dv "$APP_BUNDLE"; then
            echo "ERROR: App bundle is not code-signed"
            hdiutil detach /tmp/osagent-dmg-mount 2>/dev/null || true
            exit 1
          fi
          echo "==> .app is ad-hoc signed (CI build - notarization not required)"
          echo "==> Validating binary runtime integrity..."
          BIN="$APP_BUNDLE/Contents/MacOS/osagent-launcher"
          echo "--- Mach-O type/arch ---"
          file "$BIN"
          echo "--- Linked libraries ---"
          otool -L "$BIN"
          echo "--- Info.plist keys ---"
          /usr/libexec/PlistBuddy -c "Print CFBundleExecutable" "$APP_BUNDLE/Contents/Info.plist"
          /usr/libexec/PlistBuddy -c "Print CFBundleIdentifier" "$APP_BUNDLE/Contents/Info.plist"
          /usr/libexec/PlistBuddy -c "Print CFBundleVersion" "$APP_BUNDLE/Contents/Info.plist"
          echo "--- Gatekeeper assessment ---"
          spctl -a -t exec -vv "$APP_BUNDLE" 2>&1 || echo "(expected: notarization not available in CI)"
          hdiutil detach /tmp/osagent-dmg-mount
          echo "==> DMG verification passed"

      - name: Upload macOS release artifacts
        uses: actions/upload-artifact@v4
        with:
          name: macos-arm64
          path: |
            osagent-macos-arm64.dmg
            osagent-macos-arm64.dmg.sha256

  publish-r2:
    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'
    needs:
      - release-linux
      - release-windows-installer
      - release-macos-arm64
    runs-on: ubuntu-22.04
    environment: release
    env:
      RELEASE_TAG: ${{ inputs['release-tag'] }}
      R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
      R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
      R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
    steps:
      - uses: actions/checkout@v4

      - name: Download release artifacts
        uses: actions/download-artifact@v4
        with:
          path: release

      - name: Flatten downloaded artifacts
        shell: bash
        run: |
          mkdir -p release-flat
          find release -type f -exec cp {} release-flat/ \;

      - name: Install AWS CLI
        run: |
          sudo apt-get update
          sudo apt-get install -y awscli

      - name: Upload release to Cloudflare R2
        run: |
          chmod +x upload-to-r2.sh
          ./upload-to-r2.sh "$RELEASE_TAG" release-flat

      - name: Upload release manifest artifact
        uses: actions/upload-artifact@v4
        with:
          name: release-manifest
          path: release-flat/release-manifest.json

  github-release:
    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'
    needs: publish-r2
    runs-on: ubuntu-22.04
    permissions:
      contents: write
    env:
      GH_TOKEN: ${{ github.token }}
      RELEASE_TAG: ${{ inputs['release-tag'] }}
      PRERELEASE: ${{ inputs.prerelease }}
    steps:
      - name: Create or update GitHub release
        shell: bash
        run: |
          RELEASE_DIR_URL="${CDN_BASE_URL}/${R2_RELEASE_PREFIX}/${RELEASE_TAG}"
          BODY=$(cat <<EOF
          Installer release for Windows, Linux, and macOS with bundled core and updater. Auto-updates are served from Cloudflare R2 via ${CDN_BASE_URL}/${R2_RELEASE_PREFIX}/latest.json.

          Assets:
          - [osagent-linux-x86_64.deb](${RELEASE_DIR_URL}/osagent-linux-x86_64.deb)
          - [osagent-linux-x86_64.deb.sha256](${RELEASE_DIR_URL}/osagent-linux-x86_64.deb.sha256)
          - [osagent-macos-arm64.dmg](${RELEASE_DIR_URL}/osagent-macos-arm64.dmg)
          - [osagent-macos-arm64.dmg.sha256](${RELEASE_DIR_URL}/osagent-macos-arm64.dmg.sha256)
          - [osagent-windows-x86_64-setup.exe](${RELEASE_DIR_URL}/osagent-windows-x86_64-setup.exe)
          - [osagent-windows-x86_64-setup.exe.sha256](${RELEASE_DIR_URL}/osagent-windows-x86_64-setup.exe.sha256)
          - [release-manifest.json](${RELEASE_DIR_URL}/release-manifest.json)
          - [latest.json](${CDN_BASE_URL}/${R2_RELEASE_PREFIX}/latest.json)
          EOF
          )

          if [ "$PRERELEASE" = "true" ]; then
            PRERELEASE_JSON=true
          else
            PRERELEASE_JSON=false
          fi

          if RELEASE_ID=$(gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${RELEASE_TAG}" --jq .id 2>/dev/null); then
            gh api \
              --method PATCH \
              -H "Accept: application/vnd.github+json" \
              "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" \
              -f name="OSAgent ${RELEASE_TAG}" \
              -f body="$BODY" \
              -F prerelease="$PRERELEASE_JSON"
          else
            gh api \
              --method POST \
              -H "Accept: application/vnd.github+json" \
              "repos/${GITHUB_REPOSITORY}/releases" \
              -f tag_name="$RELEASE_TAG" \
              -f target_commitish="${GITHUB_SHA}" \
              -f name="OSAgent ${RELEASE_TAG}" \
              -f body="$BODY" \
              -F prerelease="$PRERELEASE_JSON"
          fi