release.yml

name: Release

# On a version tag (v*), build the digstore CLI in release mode and produce ONE
# run-once installer artifact per OS. The digstore binary is embedded directly
# into the installer (build.rs), so each download is a single self-contained
# file that, when run, installs digstore — no installer-installs-the-installer:
#
#   * Windows → DigStore-Setup-<ver>-windows-x64.exe   (raw Tauri exe, no NSIS/MSI)
#   * macOS   → DigStore-Setup-<ver>-macos.dmg          (one mountable run-once .app)
#   * Linux   → DigStore-Setup-<ver>-linux-x86_64.AppImage (single executable)
on:
  push:
    tags:
      - "v*"

# Only the write scope needed to publish the release + upload the asset.
permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: "0"

jobs:
  installer:
    name: Installer (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            bin: digstore.exe
            # Windows ships the raw, self-contained exe (no NSIS/MSI wrapper).
            build_args: "--no-bundle"
            artifact_glob: "src-tauri/target/release/*.exe"
            out_name: "windows-x64.exe"
          - os: macos-latest
            bin: digstore
            build_args: "--bundles dmg"
            artifact_glob: "src-tauri/target/release/bundle/dmg/*.dmg"
            out_name: "macos.dmg"
          - os: ubuntu-22.04
            bin: digstore
            build_args: "--bundles appimage"
            artifact_glob: "src-tauri/target/release/bundle/appimage/*.AppImage"
            out_name: "linux-x86_64.AppImage"
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Install pinned Rust toolchain
        run: |
          rustup show   # installs the toolchain pinned in rust-toolchain.toml (incl. wasm32 target)
          rustc --version

      # Linux needs the webkit2gtk stack for Tauri.
      - name: Install Linux Tauri deps
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Cache cargo + targets
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry/index
            ~/.cargo/registry/cache
            ~/.cargo/git/db
            target
            installer/app/src-tauri/target
          key: ${{ runner.os }}-tauri-release-${{ hashFiles('**/Cargo.lock', 'installer/app/src-tauri/Cargo.toml', 'installer/app/package-lock.json') }}
          restore-keys: ${{ runner.os }}-tauri-release-

      # digstore-cli's build.rs embeds the real guest wasm (BINDING contract D6).
      - name: Build guest wasm
        run: cargo build -p digstore-guest --target wasm32-unknown-unknown --release --locked

      - name: Build digstore CLI (release)
        run: cargo build -p digstore-cli --release --locked

      - name: Derive version from tag
        shell: bash
        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"

      - name: Install frontend deps
        working-directory: installer/app
        run: npm ci || npm install

      # Stage the just-built digstore binary so the installer's build.rs embeds
      # it (single-file install) + records its SHA-256 for the verify gate.
      - name: Stage bundled digstore binary
        working-directory: installer/app
        run: node scripts/stage-binary.mjs --src ../../target/release/${{ matrix.bin }}

      - name: Build the installer
        working-directory: installer/app
        run: npx tauri build ${{ matrix.build_args }}

      - name: Collect single installer artifact
        id: collect
        shell: bash
        working-directory: installer/app
        run: |
          mkdir -p ../../dist-installers
          artifact="$(ls -1 ${{ matrix.artifact_glob }} | head -n1)"
          if [ -z "$artifact" ]; then
            echo "no artifact matched ${{ matrix.artifact_glob }}"; exit 1
          fi
          dest="../../dist-installers/DigStore-Setup-${VERSION}-${{ matrix.out_name }}"
          cp "$artifact" "$dest"
          echo "staged $dest"
          ls -la ../../dist-installers

      - name: Upload installer as workflow artifact
        uses: actions/upload-artifact@v4
        with:
          name: digstore-installer-${{ matrix.os }}
          path: dist-installers/*
          if-no-files-found: error

  # ---------------------------------------------------------------------------
  # Single publish job — runs after ALL matrix builds so there is no race to
  # create the GitHub Release (the previous per-matrix publish raced: the first
  # job created the release, the others 401'd / "release not found").
  # ---------------------------------------------------------------------------
  publish:
    name: Publish release
    needs: installer
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download all installer artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist

      - name: Publish to GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mkdir -p dist-all
          find dist -type f -exec cp {} dist-all/ \;
          ls -la dist-all
          gh release create "${GITHUB_REF_NAME}" --title "digstore ${GITHUB_REF_NAME}" --generate-notes || echo "release already exists"
          gh release upload "${GITHUB_REF_NAME}" dist-all/* --clobber