release.yml

name: "Release"

on:
  workflow_dispatch:

# Prevent duplicate releases
concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false  # Don't cancel releases, fail instead

jobs:
  # STEP 1: Create draft release first
  create-release:
    permissions:
      contents: write
    runs-on: ubuntu-latest
    outputs:
      release-id: ${{ steps.create-release.outputs.result }}
      version: ${{ steps.get-version.outputs.version }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Fetch all tags

      - name: Get and validate version
        id: get-version
        shell: bash
        run: |
          VERSION=$(grep -o '"version": "[^"]*"' frontend/src-tauri/tauri.conf.json | cut -d'"' -f4)
          echo "Version from tauri.conf.json: $VERSION"

          # Validate strict semver format (MAJOR.MINOR.PATCH)
          if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "::error::Version '$VERSION' is not valid semver (expected MAJOR.MINOR.PATCH)"
            exit 1
          fi

          # Fail if tag already exists — bump the version before releasing
          git fetch --tags
          if git tag -l "v${VERSION}" | grep -q .; then
            echo "::error::Tag v${VERSION} already exists. Bump the version in tauri.conf.json, Cargo.toml, and package.json before releasing."
            exit 1
          fi

          echo "Version validated: $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Create Draft Release
        id: create-release
        uses: actions/github-script@v7
        with:
          script: |
            const { data } = await github.rest.repos.createRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              tag_name: `v${{ steps.get-version.outputs.version }}`,
              name: `Meetily v${{ steps.get-version.outputs.version }}`,
              draft: true,
              prerelease: false,
              generate_release_notes: true
            })
            console.log(`Created draft release with ID: ${data.id}`)
            return data.id

  # STEP 1.5: Detect which signing secrets are available
  check-secrets:
    runs-on: ubuntu-latest
    outputs:
      has-apple-signing: ${{ steps.check.outputs.has-apple }}
      has-windows-signing: ${{ steps.check.outputs.has-windows }}
    steps:
      - name: Check available signing secrets
        id: check
        env:
          HAS_APPLE: ${{ secrets.APPLE_CERTIFICATE }}
          HAS_SM_HOST: ${{ secrets.SM_HOST }}
          HAS_SM_API_KEY: ${{ secrets.SM_API_KEY }}
          HAS_SM_CERT: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
          HAS_SM_PASS: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
          HAS_SM_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
        run: |
          if [ -n "$HAS_APPLE" ]; then
            echo "has-apple=true" >> "$GITHUB_OUTPUT"
            echo "Apple signing secrets detected"
          else
            echo "has-apple=false" >> "$GITHUB_OUTPUT"
            echo "No Apple signing secrets — macOS builds will use ad-hoc signing"
          fi

          if [ -n "$HAS_SM_HOST" ] && [ -n "$HAS_SM_API_KEY" ] && [ -n "$HAS_SM_CERT" ] && [ -n "$HAS_SM_PASS" ] && [ -n "$HAS_SM_HASH" ]; then
            echo "has-windows=true" >> "$GITHUB_OUTPUT"
            echo "DigiCert signing secrets detected"
          else
            echo "has-windows=false" >> "$GITHUB_OUTPUT"
            echo "No DigiCert signing secrets — Windows builds will be unsigned"
          fi

  # STEP 2: Build all platforms and upload directly to release
  build-all-platforms:
    needs: [create-release, check-secrets]
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: "macos-latest"
            args: "--target aarch64-apple-darwin"
            target: "aarch64-apple-darwin"
          - platform: "windows-latest"
            args: ""
            target: "x86_64-pc-windows-msvc"
          - platform: "ubuntu-22.04"
            args: ""
            target: "x86_64-unknown-linux-gnu"

    uses: ./.github/workflows/build.yml
    with:
      platform: ${{ matrix.platform }}
      target: ${{ matrix.target }}
      build-args: ${{ matrix.args }}
      sign-binaries: ${{ needs.check-secrets.outputs.has-apple-signing == 'true' }}
      sign-windows: ${{ needs.check-secrets.outputs.has-windows-signing == 'true' }}
      asset-prefix: "meetily"
      upload-artifacts: false  # tauri-action uploads directly to release
      release-id: ${{ needs.create-release.outputs.release-id }}
    secrets: inherit

  # STEP 3: Show release summary
  release-summary:
    needs: [create-release, build-all-platforms]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Get release assets and latest.json
        id: release-info
        run: |
          VERSION="${{ needs.create-release.outputs.version }}"
          RELEASE_ID="${{ needs.create-release.outputs.release-id }}"

          echo "## Release Assets" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          # List all release assets
          echo "### Files in Release" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
          gh api repos/${{ github.repository }}/releases/${RELEASE_ID}/assets --jq '.[] | "\(.name) (\(.size / 1048576 | floor)MB)"' >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          # Download and show latest.json
          echo "### latest.json content" >> $GITHUB_STEP_SUMMARY
          gh release download "v${VERSION}" --pattern "latest.json" --dir . 2>/dev/null || echo "latest.json not yet available"
          if [ -f latest.json ]; then
            echo "\`\`\`json" >> $GITHUB_STEP_SUMMARY
            cat latest.json >> $GITHUB_STEP_SUMMARY
            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
          fi
          echo "" >> $GITHUB_STEP_SUMMARY

          # Download links
          echo "### Download Links" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Release page:** https://github.com/${{ github.repository }}/releases/tag/v${VERSION}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Download all as ZIP:** https://github.com/${{ github.repository }}/archive/refs/tags/v${VERSION}.zip" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Auto-update endpoint:** https://github.com/${{ github.repository }}/releases/latest/download/latest.json" >> $GITHUB_STEP_SUMMARY
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Release Summary
        run: |
          echo "============================================"
          echo "=== Release Created Successfully ==="
          echo "============================================"
          echo "Version: v${{ needs.create-release.outputs.version }}"
          echo "Release URL: https://github.com/${{ github.repository }}/releases/tag/v${{ needs.create-release.outputs.version }}"
          echo ""
          echo "Uploaded assets (via tauri-action):"
          echo "  - macOS: DMG installer + app.tar.gz (for updater) + .sig"
          echo "  - Windows: MSI + NSIS installers + .sig files"
          echo "  - Linux: AppImage + .deb + .sig files"
          echo "  - Updater manifest: latest.json (auto-generated by tauri-action)"
          echo ""
          echo "Next steps:"
          echo "  1. Review the draft release"
          echo "  2. Verify latest.json contains darwin-aarch64, windows-x86_64, and linux-x86_64"
          echo "  3. Publish the release when ready"
          echo "============================================"

          # Add to GitHub Step Summary
          echo "## Release Created Successfully" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Version:** v${{ needs.create-release.outputs.version }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Release URL:** [View Release](https://github.com/${{ github.repository }}/releases/tag/v${{ needs.create-release.outputs.version }})" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Uploaded Assets" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Platform | Assets |" >> $GITHUB_STEP_SUMMARY
          echo "|----------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| **macOS** | DMG installer, app.tar.gz (updater), .sig |" >> $GITHUB_STEP_SUMMARY
          echo "| **Windows** | MSI installer, NSIS installer, .sig files |" >> $GITHUB_STEP_SUMMARY
          echo "| **Linux** | AppImage (updater), .deb, .sig files |" >> $GITHUB_STEP_SUMMARY
          echo "| **Updater** | latest.json manifest (auto-generated by tauri-action) |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Next Steps" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "1. [Review the draft release](https://github.com/${{ github.repository }}/releases/tag/v${{ needs.create-release.outputs.version }})" >> $GITHUB_STEP_SUMMARY
          echo "2. Verify latest.json contains entries for darwin-aarch64, windows-x86_64, linux-x86_64" >> $GITHUB_STEP_SUMMARY
          echo "3. Publish the release when ready" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY