build.yml

# =============================================================================
# Emotiv LSL Build Workflow
# =============================================================================
# This workflow builds and packages the Emotiv LSL server application for all
# supported platforms (Linux, macOS, Windows).
#
# Features:
#   - Multi-platform builds (Linux, macOS, Windows)
#   - Automatic dependency fetching (liblsl, hidapi, tiny-AES-c) via FetchContent
#   - CPack packaging
#   - macOS code signing and notarization (on release)
#   - Automatic upload of release binaries
# =============================================================================

name: Build

on:
  push:
    branches: [main, master, dev]
    tags: ['v*']
  pull_request:
    branches: [main, master]
  release:
    types: [published]
  workflow_dispatch:

env:
  BUILD_TYPE: Release

jobs:
  # ===========================================================================
  # Build Job - Multi-platform builds
  # ===========================================================================
  build:
    name: ${{ matrix.config.name }}
    runs-on: ${{ matrix.config.os }}
    strategy:
      fail-fast: false
      matrix:
        config:
          - { name: "Ubuntu 22.04", os: ubuntu-22.04 }
          - { name: "Ubuntu 24.04", os: ubuntu-24.04 }
          - { name: "macOS", os: macos-14, cmake_extra: '-DCMAKE_OSX_ARCHITECTURES="x86_64;arm64"' }
          - { name: "Windows", os: windows-latest }

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # -----------------------------------------------------------------------
      # Install CMake 3.28+ (Ubuntu 22.04 ships with 3.22)
      # -----------------------------------------------------------------------
      - name: Install CMake
        if: runner.os == 'Linux'
        uses: lukka/get-cmake@latest

      # -----------------------------------------------------------------------
      # Install platform dependencies (no Qt needed — server app only)
      # -----------------------------------------------------------------------
      - name: Install Linux dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libudev-dev libusb-1.0-0-dev

      # -----------------------------------------------------------------------
      # Configure (emotiv_lsl only — no GUI/CLI)
      # -----------------------------------------------------------------------
      - name: Configure CMake
        run: >
          cmake -S . -B build
          -DCMAKE_BUILD_TYPE=${{ env.BUILD_TYPE }}
          -DCMAKE_INSTALL_PREFIX=${{ github.workspace }}/install
          -DLSLTEMPLATE_BUILD_GUI=OFF
          -DLSLTEMPLATE_BUILD_CLI=OFF
          -DEMOTIVLSL_BUILD_EMOTIV=ON
          ${{ matrix.config.cmake_extra }}

      # -----------------------------------------------------------------------
      # Build
      # -----------------------------------------------------------------------
      - name: Build
        run: cmake --build build --config ${{ env.BUILD_TYPE }} --parallel

      # -----------------------------------------------------------------------
      # Install
      # -----------------------------------------------------------------------
      - name: Install
        run: cmake --install build --config ${{ env.BUILD_TYPE }}

      # -----------------------------------------------------------------------
      # Package
      # -----------------------------------------------------------------------
      - name: Package
        run: cpack -C ${{ env.BUILD_TYPE }}
        working-directory: build

      # -----------------------------------------------------------------------
      # Upload Artifacts
      # -----------------------------------------------------------------------
      - name: Upload Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: package-${{ matrix.config.os }}
          path: |
            build/*.zip
            build/*.tar.gz
            build/*.deb
          if-no-files-found: ignore

  # ===========================================================================
  # macOS Signing and Notarization (Release only)
  # ===========================================================================
  sign-macos:
    name: Sign & Notarize (macOS)
    needs: build
    if: github.event_name == 'release'
    runs-on: macos-14

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download macOS Artifact
        uses: actions/download-artifact@v4
        with:
          name: package-macos-14
          path: packages

      - name: Extract Package
        run: |
          cd packages
          tar -xzf *.tar.gz
          # Move contents out of versioned subdirectory to packages/
          SUBDIR=$(ls -d LSLTemplate-*/ 2>/dev/null | head -1)
          if [[ -n "$SUBDIR" ]]; then
            mv "$SUBDIR"/* .
            rmdir "$SUBDIR"
          fi
          ls -la

      # -----------------------------------------------------------------------
      # Install Apple Certificates
      # -----------------------------------------------------------------------
      - name: Install Apple Certificates
        env:
          MACOS_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE }}
          MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
          MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
        run: |
          # Create temporary keychain
          KEYCHAIN_PATH=$RUNNER_TEMP/build.keychain
          security create-keychain -p "$MACOS_CI_KEYCHAIN_PWD" $KEYCHAIN_PATH
          security default-keychain -s $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" $KEYCHAIN_PATH

          # Import certificate
          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
          echo -n "$MACOS_CERTIFICATE" | base64 --decode -o $CERTIFICATE_PATH
          security import $CERTIFICATE_PATH -P "$MACOS_CERTIFICATE_PWD" -k $KEYCHAIN_PATH -A -t cert -f pkcs12
          rm $CERTIFICATE_PATH

          # Allow codesign to access keychain
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH

          # Extract identity name and export to environment
          IDENTITY=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application" | head -1 | awk -F'"' '{print $2}')
          echo "APPLE_CODE_SIGN_IDENTITY_APP=$IDENTITY" >> $GITHUB_ENV

      # -----------------------------------------------------------------------
      # Setup Notarization Credentials
      # -----------------------------------------------------------------------
      - name: Setup Notarization
        env:
          NOTARIZATION_APPLE_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }}
          NOTARIZATION_PWD: ${{ secrets.PROD_MACOS_NOTARIZATION_PWD }}
          NOTARIZATION_TEAM_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}
        run: |
          xcrun notarytool store-credentials "notarize-profile" \
            --apple-id "$NOTARIZATION_APPLE_ID" \
            --password "$NOTARIZATION_PWD" \
            --team-id "$NOTARIZATION_TEAM_ID"
          echo "APPLE_NOTARIZE_KEYCHAIN_PROFILE=notarize-profile" >> $GITHUB_ENV

      # -----------------------------------------------------------------------
      # Sign and Notarize
      # -----------------------------------------------------------------------
      - name: Sign and Notarize
        env:
          ENTITLEMENTS_FILE: ${{ github.workspace }}/app.entitlements
        run: |
          # Sign emotiv_lsl and its bundled lsl.framework
          EMOTIV_PATH=$(find packages -name "emotiv_lsl" -type f | head -1)
          if [[ -n "$EMOTIV_PATH" ]]; then
            EMOTIV_DIR=$(dirname "$EMOTIV_PATH")
            # Sign framework first (dependency must be signed before dependent)
            if [[ -d "$EMOTIV_DIR/Frameworks/lsl.framework" ]]; then
              codesign --force --sign "$APPLE_CODE_SIGN_IDENTITY_APP" --options runtime \
                "$EMOTIV_DIR/Frameworks/lsl.framework"
            fi
            # Also look for Frameworks in parent directory
            if [[ -d "packages/Frameworks/lsl.framework" ]]; then
              codesign --force --sign "$APPLE_CODE_SIGN_IDENTITY_APP" --options runtime \
                "packages/Frameworks/lsl.framework"
            fi
            ./scripts/sign_and_notarize.sh "$EMOTIV_PATH" --notarize
          fi

      # -----------------------------------------------------------------------
      # Repackage
      # -----------------------------------------------------------------------
      - name: Repackage
        run: |
          cd packages

          # Debug: show what we have
          echo "Contents of packages directory:"
          ls -la

          # Remove original unsigned package
          rm -f *.tar.gz

          # Get project version from CMakeLists.txt
          VERSION=$(grep -A1 'project(LSLTemplate' ../CMakeLists.txt | grep VERSION | sed 's/.*VERSION \([0-9.]*\).*/\1/')
          echo "Detected version: $VERSION"

          # Collect all installed files for the signed package
          FILES=""
          for f in emotiv_lsl LSLTemplate.cfg; do
            [[ -e "$f" ]] && FILES="$FILES $f"
          done
          [[ -d Frameworks ]] && FILES="$FILES Frameworks"
          # Include any hidapi dylibs
          for f in libhidapi*; do
            [[ -e "$f" ]] && FILES="$FILES $f"
          done

          tar -cvzf "LSLTemplate-${VERSION}-macOS_universal-signed.tar.gz" $FILES

          echo "Created package:"
          ls -la *.tar.gz

      - name: Upload Signed Package
        uses: actions/upload-artifact@v4
        with:
          name: package-macos-signed
          path: packages/*-signed.tar.gz

      - name: Upload to Release
        if: github.event_name == 'release'
        uses: softprops/action-gh-release@v2
        with:
          files: packages/*-signed.tar.gz

  # ===========================================================================
  # Upload unsigned packages to release
  # ===========================================================================
  release:
    name: Upload to Release
    needs: build
    if: github.event_name == 'release'
    runs-on: ubuntu-latest

    steps:
      - name: Download All Artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Upload to Release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            artifacts/**/*.zip
            artifacts/package-ubuntu-*/*.tar.gz
            artifacts/**/*.deb