ci.yml

---
name: CI
permissions: {}

on:
  pull_request:
  push:
    branches:
      - master
  workflow_dispatch:

concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: true

jobs:
  github-env:
    name: GitHub Env Debug
    permissions:
      contents: read
    uses: LizardByte/.github/.github/workflows/__call-github-env.yml@master

  release-setup:
    name: Release Setup
    outputs:
      publish_release: ${{ steps.release-setup.outputs.publish_release }}
      release_body: ${{ steps.release-setup.outputs.release_body }}
      release_commit: ${{ steps.release-setup.outputs.release_commit }}
      release_generate_release_notes: ${{ steps.release-setup.outputs.release_generate_release_notes }}
      release_tag: ${{ steps.release-setup.outputs.release_tag }}
      release_version: ${{ steps.release-setup.outputs.release_version }}
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Release Setup
        id: release-setup
        uses: LizardByte/actions/actions/release_setup@d0ae7f82215a479fe2b74f4088c53ee6460513dd  # v2026.728.214955
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}

  build-docker:
    name: Docker
    needs: release-setup
    permissions:
      contents: read
      packages: write
    uses: LizardByte/.github/.github/workflows/__call-docker.yml@master
    with:
      docker_hub_username: ${{ vars.DOCKER_HUB_USERNAME }}
      gh_bot_name: ${{ vars.GH_BOT_NAME }}
      maximize_build_space: true
      publish_release: ${{ needs.release-setup.outputs.publish_release }}
      release_commit: ${{ needs.release-setup.outputs.release_commit }}
      release_tag: ${{ needs.release-setup.outputs.release_tag }}
      release_version: ${{ needs.release-setup.outputs.release_version }}
    secrets:
      DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
      DOCKER_HUB_ACCESS_TOKEN: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
      GH_BOT_TOKEN: ${{ secrets.GH_BOT_TOKEN }}
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-freebsd:
    name: FreeBSD
    needs: release-setup
    permissions:
      contents: read
    uses: ./.github/workflows/ci-freebsd.yml
    with:
      release_commit: ${{ needs.release-setup.outputs.release_commit }}
      release_version: ${{ needs.release-setup.outputs.release_version }}

  build-homebrew:
    name: Homebrew
    needs: release-setup
    permissions:
      contents: read
    uses: ./.github/workflows/ci-homebrew.yml
    with:
      git_username: ${{ vars.GH_BOT_NAME }}
      publish_release: ${{ needs.release-setup.outputs.publish_release }}
      release_commit: ${{ needs.release-setup.outputs.release_commit }}
      release_tag: ${{ needs.release-setup.outputs.release_tag }}
      release_version: ${{ needs.release-setup.outputs.release_version }}
    secrets:
      GH_TOKEN: ${{ secrets.GH_BOT_TOKEN }}
      GIT_EMAIL: ${{ secrets.GH_BOT_EMAIL }}

  build-macos:
    name: macOS
    needs: release-setup
    permissions:
      contents: read
    uses: ./.github/workflows/ci-macos.yml
    with:
      publish_release: ${{ needs.release-setup.outputs.publish_release }}
      release_commit: ${{ needs.release-setup.outputs.release_commit }}
      release_version: ${{ needs.release-setup.outputs.release_version }}
    secrets:
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      APPLE_NOTARYTOOL_PASSWORD: ${{ secrets.APPLE_NOTARYTOOL_PASSWORD }}
      APPLE_CODESIGN_IDENTITY: ${{ secrets.APPLE_CODESIGN_IDENTITY }}
      APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_BASE64: >-
        ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_BASE64 }}
      APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_P12_PASSWORD: >-
        ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_P12_PASSWORD }}

  build-linux:
    name: Linux
    needs: release-setup
    permissions:
      contents: read
    uses: ./.github/workflows/ci-linux.yml
    with:
      release_commit: ${{ needs.release-setup.outputs.release_commit }}
      release_version: ${{ needs.release-setup.outputs.release_version }}

  build-archlinux:
    name: Archlinux
    needs: release-setup
    permissions:
      contents: read
    uses: ./.github/workflows/ci-archlinux.yml
    with:
      release_commit: ${{ needs.release-setup.outputs.release_commit }}
      release_version: ${{ needs.release-setup.outputs.release_version }}

  build-linux-copr:
    name: Linux Copr
    if: github.event_name != 'push'  # releases are handled directly in ci-copr.yml
    needs: release-setup
    permissions:
      contents: write  # needed to update releases
    uses: ./.github/workflows/ci-copr.yml
    secrets:
      COPR_BETA_WEBHOOK_TOKEN: ${{ secrets.COPR_BETA_WEBHOOK_TOKEN }}
      COPR_STABLE_WEBHOOK_TOKEN: ${{ secrets.COPR_STABLE_WEBHOOK_TOKEN }}
      COPR_CLI_CONFIG: ${{ secrets.COPR_CLI_CONFIG }}
      VIRUSTOTAL_API_KEY: ${{ secrets.VIRUSTOTAL_API_KEY }}

  build-linux-flatpak:
    name: Linux Flatpak
    needs: release-setup
    permissions:
      contents: read
    uses: ./.github/workflows/ci-flatpak.yml
    with:
      release_commit: ${{ needs.release-setup.outputs.release_commit }}
      release_version: ${{ needs.release-setup.outputs.release_version }}

  build-windows:
    name: Windows
    needs: release-setup
    permissions:
      contents: read
    uses: ./.github/workflows/ci-windows.yml
    with:
      azure_signing_account: ${{ vars.AZURE_SIGNING_ACCOUNT }}
      azure_signing_cert_profile: ${{ vars.AZURE_SIGNING_CERT_PROFILE }}
      azure_signing_endpoint: ${{ vars.AZURE_SIGNING_ENDPOINT }}
      publish_release: ${{ needs.release-setup.outputs.publish_release }}
      release_commit: ${{ needs.release-setup.outputs.release_commit }}
      release_version: ${{ needs.release-setup.outputs.release_version }}
    secrets:
      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
      AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}

  bundle-analysis:
    name: Bundle Analysis
    needs: release-setup
    permissions:
      contents: read
    uses: ./.github/workflows/ci-bundle.yml
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  coverage:
    name: Coverage-${{ matrix.name }}
    if: >-
      always() &&
      !cancelled() &&
      startsWith(github.repository, 'LizardByte/')
    needs:
      - build-freebsd
      - build-linux
      - build-archlinux
      - build-linux-flatpak
      - build-macos
      - build-homebrew
      - build-windows
    permissions:
      contents: read
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: FreeBSD-amd64
            coverage: true
          - name: Linux-AppImage
            coverage: true
          - name: Archlinux
            coverage: true
          - name: macOS-arm64
            coverage: true
          - name: macOS-x86_64
            coverage: true
          - name: Homebrew-macos-14
            coverage: true
            coverage_file: coverage.lcov
          - name: Homebrew-macos-15
            coverage: true
            coverage_file: coverage.lcov
          - name: Homebrew-macos-26
            coverage: true
            coverage_file: coverage.lcov
          - name: Homebrew-ubuntu-24.04
            coverage: true
          - name: Windows-AMD64
            coverage: true
          - name: Windows-ARM64
            coverage: true
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Download coverage artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: coverage-${{ matrix.name }}
          path: _coverage

      - name: Upload test coverage
        if: matrix.coverage != false
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
        with:
          disable_search: true
          fail_ci_if_error: true
          files: ./_coverage/${{ matrix.coverage_file || 'coverage.xml' }}
          report_type: coverage
          flags: ${{ matrix.name }}
          token: ${{ secrets.CODECOV_TOKEN }}
          verbose: true

      - name: Upload test results
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
        with:
          disable_search: true
          fail_ci_if_error: true
          files: ./_coverage/tests/test_results.xml
          report_type: test_results
          flags: ${{ matrix.name }}
          token: ${{ secrets.CODECOV_TOKEN }}
          verbose: true

  release:
    name: Release
    if:
      needs.release-setup.outputs.publish_release == 'true' &&
      startsWith(github.repository, 'LizardByte/')
    needs:
      - release-setup
      - build-archlinux
      - build-docker
      - build-freebsd
      - build-homebrew
      - build-linux
      - build-linux-flatpak
      - build-macos
      - build-windows
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: artifacts
          pattern: build-*
          merge-multiple: true

      - name: Debug artifacts
        run: ls -l artifacts

      - name: Create/Update GitHub Release
        uses: LizardByte/actions/actions/release_create@d0ae7f82215a479fe2b74f4088c53ee6460513dd  # v2026.728.214955
        with:
          allowUpdates: false
          body: ${{ needs.release-setup.outputs.release_body }}
          generateReleaseNotes: ${{ needs.release-setup.outputs.release_generate_release_notes }}
          name: ${{ needs.release-setup.outputs.release_tag }}
          prerelease: true
          tag: ${{ needs.release-setup.outputs.release_tag }}
          token: ${{ secrets.GH_BOT_TOKEN }}
          virustotal_api_key: ${{ secrets.VIRUSTOTAL_API_KEY }}

  release-homebrew-beta:
    name: Release Homebrew Beta
    if:
      needs.release-setup.outputs.publish_release == 'true' &&
      startsWith(github.repository, 'LizardByte/')
    needs:
      - release-setup
      - build-homebrew
      - release
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: Download homebrew artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: beta-Homebrew
          path: homebrew

      - name: Upload Homebrew Beta Formula
        uses: LizardByte/actions/actions/release_homebrew@master  # action requires too many updates to pin
        with:
          actionlint_config: "---\n# empty config"
          formula_file: ${{ github.workspace }}/homebrew/sunshine-beta.rb
          git_email: ${{ secrets.GH_BOT_EMAIL }}
          git_username: ${{ vars.GH_BOT_NAME }}
          publish: true
          token: ${{ secrets.GH_BOT_TOKEN }}
          validate: false