build.yml

name: Multi-Platform Build

on:
  push:
    branches: [main, "[0-9]+.[0-9]+"]
    tags:
      - "v*"
    paths-ignore:
      - "README.md"
      - "CHANGELOG.md"
      - ".gitignore"
      - "site/**"
      - "scripts/check-sitemap.mjs"
      - "scripts/check-site-structured-data.mjs"
      - "wrangler.jsonc"
      - ".github/workflows/site.yml"
  pull_request:
    branches: [main, "[0-9]+.[0-9]+"]
    paths-ignore:
      - "README.md"
      - "CHANGELOG.md"
      - ".gitignore"
      - "site/**"
      - "scripts/check-sitemap.mjs"
      - "scripts/check-site-structured-data.mjs"
      - "wrangler.jsonc"
      - ".github/workflows/site.yml"
  workflow_dispatch:

concurrency:
  # A branch push and its pull-request synchronization carry the same head SHA.
  # Group them together so only one verification run survives. Release tags and
  # explicit packaging runs stay isolated and must finish.
  group: ${{ github.workflow }}-${{ startsWith(github.ref, 'refs/tags/') && github.ref || github.event_name == 'workflow_dispatch' && github.run_id || github.event.pull_request.head.sha || github.sha }}
  cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch' }}

jobs:
  # Lint, type-check, audit and build the frontend once, reuse the dist/ output
  # across all matrix jobs. This avoids running Vite 5× (once per platform) and
  # surfaces TypeScript / lint errors before any Rust compilation starts.
  frontend:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          fetch-depth: 1

      - name: Set up Node
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
        with:
          node-version: 22.23.1
          cache: npm

      - name: Install npm dependencies
        run: npm ci --prefer-offline --no-audit --fund=false

      - name: Audit npm dependencies
        run: npm audit --audit-level=high

      - name: Check version alignment
        run: npm run version:check

      - name: Check asset organization
        run: npm run assets:check

      - name: Lint
        run: npm run lint

      - name: Typecheck
        run: npm run typecheck

      - name: Test
        run: npm test

      - name: Build frontend
        run: npm run build

      - name: Check frontend bundle budget
        run: npm run bundle:check

      - name: Upload dist
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: frontend-dist
          path: dist/
          if-no-files-found: error
          retention-days: 1

  # Run every Rust quality gate in one job to avoid another runner startup.
  # Clippy and tests use the same profile as non-release builds so the gated
  # Linux x86_64 build can reuse compatible dependency artifacts.
  rust-compile-checks:
    # Match the Linux x86_64 bundle runner so both apt and Rust caches are
    # distro-compatible and reusable by the gated build job.
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          fetch-depth: 1

      - name: Install system dependencies
        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9
        with:
          # Keep this identical to the Linux build package set so its gated
          # x86_64 job restores the cache populated by these compile checks.
          packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf xdg-utils
          version: 1.0

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
        with:
          toolchain: 1.97.1
          components: clippy,rustfmt

      - name: Rustfmt check
        run: cargo fmt --check --manifest-path src-tauri/Cargo.toml

      - name: Install cargo-audit
        uses: taiki-e/install-action@b20dedce73af6905cdc30d6611090c9b67557c8d
        with:
          tool: cargo-audit@0.22.2
          checksum: true
          fallback: none

      - name: Audit Rust dependencies
        run: cargo audit
        working-directory: src-tauri

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
        with:
          workspaces: src-tauri
          # rust-cache does not distinguish Ubuntu releases. Keep the shared
          # lint/build cache isolated from artifacts produced on ubuntu-latest.
          shared-key: rust-linux-ubuntu-22.04-v1

      - name: Clippy
        run: cargo clippy --target x86_64-unknown-linux-gnu --profile ci --manifest-path src-tauri/Cargo.toml --tests -- -D warnings

      - name: Rust tests
        run: cargo test --target x86_64-unknown-linux-gnu --profile ci --manifest-path src-tauri/Cargo.toml

  build:
    # Gate the expensive cross-platform build matrix on the frontend artifact
    # plus the Rust quality jobs so known-bad revisions fail before fan-out.
    # Linux x86_64 still reuses the `rust-linux` registry/source cache and
    # any compatible artifacts populated by rust-compile-checks.
    needs: [frontend, rust-compile-checks]
    permissions:
      contents: read
      id-token: write
      attestations: write
      artifact-metadata: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: windows-latest
            arch: x86_64
            rust-target: x86_64-pc-windows-msvc
            tauri-target: x86_64-pc-windows-msvc
            bundle: nsis
            artifact-name: vidcord-windows-x86_64

          - platform: windows-latest
            arch: aarch64
            rust-target: aarch64-pc-windows-msvc
            tauri-target: aarch64-pc-windows-msvc
            bundle: nsis
            artifact-name: vidcord-windows-aarch64

          - platform: ubuntu-22.04
            arch: x86_64
            rust-target: x86_64-unknown-linux-gnu
            tauri-target: x86_64-unknown-linux-gnu
            bundle: appimage
            artifact-name: vidcord-linux-x86_64

          - platform: ubuntu-24.04-arm
            arch: aarch64
            rust-target: aarch64-unknown-linux-gnu
            tauri-target: aarch64-unknown-linux-gnu
            bundle: appimage
            artifact-name: vidcord-linux-aarch64

          - platform: macos-latest
            arch: universal
            rust-target: aarch64-apple-darwin,x86_64-apple-darwin
            tauri-target: universal-apple-darwin
            bundle: dmg
            artifact-name: vidcord-macos

    runs-on: ${{ matrix.platform }}

    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          fetch-depth: 1

      - name: Download frontend dist
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
        with:
          name: frontend-dist
          path: dist/

      - name: Install system dependencies (Linux)
        if: startsWith(matrix.platform, 'ubuntu')
        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9
        with:
          packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf xdg-utils
          version: 1.0

      - name: Set up Node
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
        with:
          node-version: 22.23.1
          cache: npm

      - name: Install locked npm dependencies
        run: npm ci --prefer-offline --no-audit --fund=false

      - name: Verify locked Tauri build tool
        run: npm run build-tools:check

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
        with:
          toolchain: 1.97.1
          targets: ${{ matrix.rust-target }}

      - name: Cache Rust dependencies (Linux x86_64, shared with rust-compile-checks)
        if: matrix.rust-target == 'x86_64-unknown-linux-gnu'
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
        with:
          workspaces: src-tauri
          shared-key: rust-linux-ubuntu-22.04-v1

      # Windows target artifacts are not interchangeable. Keep target-specific
      # keys so each architecture reuses its own prior builds without cache
      # contamination or two jobs racing to publish the same entry.
      - name: Cache Rust dependencies (Windows)
        if: startsWith(matrix.platform, 'windows-latest')
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
        with:
          workspaces: src-tauri
          shared-key: rust-windows-${{ matrix.rust-target }}

      - name: Cache Rust dependencies
        if: matrix.rust-target != 'x86_64-unknown-linux-gnu' && !startsWith(matrix.platform, 'windows-latest')
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
        with:
          workspaces: src-tauri

      - name: Verify platform build
        if: ${{ !startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch' }}
        run: npm run tauri -- build --target ${{ matrix.tauri-target }} --no-bundle --config '{"build":{"beforeBuildCommand":""}}' -- --profile ci

      - name: Build installer
        if: ${{ startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch' }}
        run: npm run tauri -- build --target ${{ matrix.tauri-target }} --bundles ${{ matrix.bundle }} --config '{"build":{"beforeBuildCommand":""}}' -- --profile ${{ startsWith(github.ref, 'refs/tags/') && 'release' || 'ci' }}

      - name: Stage artifacts (Unix)
        if: ${{ matrix.platform != 'windows-latest' && (startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch') }}
        run: |
          mkdir -p artifacts
          find src-tauri/target \( -name "*.AppImage" -o -name "*.dmg" \) -exec cp {} artifacts/ \;

      - name: Stage artifacts (Windows)
        if: ${{ matrix.platform == 'windows-latest' && (startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch') }}
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path artifacts
          Get-ChildItem -Path src-tauri\target -Recurse -Filter *.exe |
            Where-Object { $_.DirectoryName -like "*bundle\nsis*" } |
            ForEach-Object { Copy-Item $_.FullName -Destination artifacts\ }

      - name: Attest built installers
        if: ${{ startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch' }}
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6
        with:
          subject-path: artifacts/*

      - name: Upload artifacts
        if: ${{ startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: ${{ matrix.artifact-name }}
          path: artifacts/
          if-no-files-found: error
          # AppImage, DMG and NSIS outputs are already compressed. Avoid a
          # second CPU-heavy compression pass and bound transient CI storage.
          compression-level: 0
          retention-days: 7

  sign-release-artifacts:
    needs: build
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      contents: read
      attestations: read
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          fetch-depth: 1

      - name: Download release artifacts
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
        with:
          path: release-artifacts
          merge-multiple: true
          pattern: vidcord-*

      - name: Verify build artifact provenance
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          while IFS= read -r -d '' artifact; do
            gh attestation verify "$artifact" \
              --repo "$GITHUB_REPOSITORY" \
              --signer-workflow "$GITHUB_REPOSITORY/.github/workflows/build.yml" \
              --source-ref "$GITHUB_REF"
          done < <(
            find release-artifacts -type f \( \
              -name '*.AppImage' -o -name '*.dmg' -o -name '*.exe' \
            \) -print0
          )

      - name: Sign verified installers
        env:
          RELEASE_SIGNING_KEY: ${{ secrets.VIDCORD_RELEASE_SIGNING_KEY }}
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          test -n "$RELEASE_SIGNING_KEY"
          umask 077
          printf '%s\n' "$RELEASE_SIGNING_KEY" > release-signing-key.pem
          trap 'rm -f release-signing-key.pem' EXIT

          expected_public_key="$(tr -d '[:space:]' < src-tauri/update-signing-public-key.hex)"
          actual_public_key="$(openssl pkey -in release-signing-key.pem -pubout -outform DER | tail -c 32 | od -An -tx1 -v | tr -d ' \n')"
          test "$actual_public_key" = "$expected_public_key"

          test -n "$(find release-artifacts -type f \( \
            -name '*.AppImage' -o -name '*.dmg' -o -name '*.exe' \
          \) -print -quit)"
          while IFS= read -r -d '' artifact; do
            asset_name="$(basename "$artifact")"
            digest="$(sha256sum "$artifact" | cut -d ' ' -f1)"
            printf 'vidcord-update-signature-v1\n%s\n%s\n%s\n' \
              "$RELEASE_TAG" "$asset_name" "$digest" > "$artifact.message"
            openssl pkeyutl -sign -rawin -inkey release-signing-key.pem \
              -in "$artifact.message" -out "$artifact.sig"
            test "$(wc -c < "$artifact.sig")" -eq 64
            rm -f "$artifact.message"
          done < <(
            find release-artifacts -type f \( \
              -name '*.AppImage' -o -name '*.dmg' -o -name '*.exe' \
            \) -print0
          )

      - name: Upload signed release artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: signed-release-artifacts
          path: release-artifacts/
          if-no-files-found: error
          retention-days: 1

  publish-release:
    needs: sign-release-artifacts
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803
        with:
          fetch-depth: 1

      - name: Download signed release artifacts
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
        with:
          name: signed-release-artifacts
          path: release-artifacts

      - name: Extract release notes
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          awk -v tag="## $TAG" 'found && /^## /{exit} $0==tag{found=1;next} found' CHANGELOG.md > release_notes.md
          if [ ! -s release_notes.md ]; then
            echo "CHANGELOG.md has no non-empty ## $TAG release section" >&2
            exit 1
          fi

      - name: Create release
        # v3.0.0, pinned because this job has contents:write.
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda
        with:
          files: release-artifacts/**/*
          draft: true
          body_path: release_notes.md
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}