release.yml

name: Release
on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  build-tauri:
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: "macos-latest"
            args: "--target aarch64-apple-darwin"
          - platform: "macos-latest"
            args: "--target x86_64-apple-darwin"
          - platform: "macos-latest"
            args: "--target universal-apple-darwin --bundles app"
          - platform: "ubuntu-22.04"
            args: ""
          - platform: "ubuntu-24.04-arm"
            args: ""
          - platform: "windows-2025"
            args: ""

    runs-on: ${{ matrix.platform }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install dependencies (Linux)
        if: startsWith(matrix.platform, 'ubuntu')
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev build-essential curl wget file libssl-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev patchelf pkg-config libsoup-3.0-dev javascriptcoregtk-4.1 libjavascriptcoregtk-4.1-dev
          sudo apt-get install -y libnm-dev xdg-utils

      - name: Rust setup
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || (contains(matrix.args, 'aarch64') && 'aarch64-unknown-linux-gnu' || '') }}

      - name: Node.js setup
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: "npm"

      - name: Install frontend dependencies
        run: npm install --legacy-peer-deps

      - name: Disable updater artifacts without signing key
        shell: pwsh
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
        run: |
          if (-not [string]::IsNullOrWhiteSpace($env:TAURI_SIGNING_PRIVATE_KEY)) {
            Write-Host "Updater signing key is configured; keeping updater artifacts enabled."
            exit 0
          }

          $configPath = "src-tauri/tauri.conf.json"
          $config = Get-Content -Raw $configPath | ConvertFrom-Json
          $config.bundle.createUpdaterArtifacts = $false
          $config | ConvertTo-Json -Depth 32 | Set-Content -Path $configPath -Encoding UTF8
          Write-Host "No updater signing key configured; disabled updater artifacts for this build."

      - name: Build the app
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: npm run tauri build -- ${{ matrix.args }}

      # 3. 处理 macOS 架构重命名冲突 (解决 422 Already Exists)
      - name: Rename macOS assets for architecture
        if: matrix.platform == 'macos-latest'
        run: |
          # 识别架构
          if [[ "${{ matrix.args }}" == *"--target aarch64-apple-darwin"* ]]; then
            ARCH="aarch64"
          elif [[ "${{ matrix.args }}" == *"--target x86_64-apple-darwin"* ]]; then
            ARCH="x64"
          elif [[ "${{ matrix.args }}" == *"--target universal-apple-darwin"* ]]; then
            ARCH="universal"
          else
            ARCH="unknown"
          fi
          
          echo "Detected architecture: $ARCH"
          
          # 进入产物目录
          cd src-tauri/target/*/release/bundle/macos/
          
          # 重命名 .app.tar.gz 和 .sig
          if [ -f "Antigravity Tools.app.tar.gz" ]; then
            mv "Antigravity Tools.app.tar.gz" "Antigravity Tools_${ARCH}.app.tar.gz"
            mv "Antigravity Tools.app.tar.gz.sig" "Antigravity Tools_${ARCH}.app.tar.gz.sig"
            echo "Renamed assets to append Arch: $ARCH"
          fi
          
          # 更新对应的 updater.json (指向重命名后的文件)
          UPDATER_JSON="../../../updater/install.json"
          if [ ! -f "$UPDATER_JSON" ]; then
             UPDATER_JSON=$(find ../../../updater -name "*.json" | head -n 1)
          fi
          
          if [ -f "$UPDATER_JSON" ]; then
            echo "Updating $UPDATER_JSON to use renamed assets..."
            sed -i '' "s/Antigravity%20Tools.app.tar.gz/Antigravity%20Tools_${ARCH}.app.tar.gz/g" "$UPDATER_JSON"
          fi

      # 1. 上传 updater.json 到 Artifacts (供后续合并使用)
      - name: Upload updater json
        uses: actions/upload-artifact@v4
        with:
          name: updater-json-${{ matrix.platform }}-${{ strategy.job-index }}
          path: src-tauri/target/**/release/bundle/updater/*.json
          if-no-files-found: ignore

      # 2. 上传安装包到 Artifacts (供后续统一发布任务下载)
      - name: Upload Release Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-assets-${{ matrix.platform }}-${{ strategy.job-index }}
          path: |
            src-tauri/target/**/release/bundle/dmg/*.dmg
            src-tauri/target/**/release/bundle/deb/*.deb
            src-tauri/target/**/release/bundle/appimage/*.AppImage
            src-tauri/target/**/release/bundle/msi/*.msi
            src-tauri/target/**/release/bundle/nsis/*.exe
            src-tauri/target/**/release/bundle/rpm/*.rpm
            src-tauri/target/**/release/bundle/macos/*.app.tar.gz
            src-tauri/target/**/release/bundle/macos/*.app.tar.gz.sig
            src-tauri/target/**/release/bundle/dmg/*.sig
            src-tauri/target/**/release/bundle/deb/*.sig
            src-tauri/target/**/release/bundle/appimage/*.sig
            src-tauri/target/**/release/bundle/msi/*.sig
            src-tauri/target/**/release/bundle/nsis/*.sig
            src-tauri/target/**/release/bundle/rpm/*.sig
          if-no-files-found: warn

  publish-release:
    needs: build-tauri
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # 下载所有构建产物 (仅限 release 相关的 assets 和 updater)
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: all-artifacts
          pattern: "{release-assets-*,updater-json-*}"
          merge-multiple: true

      - name: Extract Release Notes
        run: |
          VERSION="${{ github.ref_name }}"
          echo "Extracting release notes for version $VERSION"
          awk -v ver="$VERSION" '
            BEGIN { capture=0 }
            $0 ~ "^[[:space:]]*[*+-][[:space:]]+\\*\\*" ver { capture=1; next }
            capture && $0 ~ "^[[:space:]]*[*+-][[:space:]]+\\*\\*v" { capture=0; exit }
            capture { print }
          ' README.md | sed 's/^[[:space:]]\{8\}//' > release_notes.md
          if [ ! -s release_notes.md ]; then
            echo "See the assets to download this version and install." > release_notes.md
          fi

      - name: Build updater.json from signatures
        env:
          VERSION: ${{ github.ref_name }}
          REPO: ${{ github.repository }}
        run: |
          DOWNLOAD_BASE="https://github.com/${REPO}/releases/download/${VERSION}"
          VER="${VERSION#v}"

          # Helper: read signature content from .sig file in artifacts
          read_sig() {
            local pattern="$1"
            local sig_file
            sig_file=$(find all-artifacts -name "$pattern" -type f 2>/dev/null | head -1)
            if [ -n "$sig_file" ] && [ -f "$sig_file" ]; then
              cat "$sig_file"
            else
              echo ""
            fi
          }

          # Read signatures for each platform
          MACOS_AARCH64_SIG=$(read_sig "*_aarch64.app.tar.gz.sig")
          MACOS_X64_SIG=$(read_sig "*_x64.app.tar.gz.sig")
          WINDOWS_NSIS_SIG=$(read_sig "*_x64-setup.exe.sig")
          LINUX_AMD64_SIG=$(read_sig "*_amd64.AppImage.sig")
          LINUX_AARCH64_SIG=$(read_sig "*_aarch64.AppImage.sig")

          echo "Signatures found:"
          [ -n "$MACOS_AARCH64_SIG" ] && echo "  macOS aarch64: YES" || echo "  macOS aarch64: NO"
          [ -n "$MACOS_X64_SIG" ] && echo "  macOS x64: YES" || echo "  macOS x64: NO"
          [ -n "$WINDOWS_NSIS_SIG" ] && echo "  Windows x64: YES" || echo "  Windows x64: NO"
          [ -n "$LINUX_AMD64_SIG" ] && echo "  Linux amd64: YES" || echo "  Linux amd64: NO"
          [ -n "$LINUX_AARCH64_SIG" ] && echo "  Linux aarch64: YES" || echo "  Linux aarch64: NO"

          # Build updater.json with platform-specific download URLs and signatures
          # macOS: arch-suffixed filenames (no version in name)
          # Windows/Linux: version included in filename
          jq -n \
            --arg version "$VER" \
            --arg notes "See release page for details" \
            --arg pub_date "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
            --arg dl "$DOWNLOAD_BASE" \
            --arg mac_a64_sig "$MACOS_AARCH64_SIG" \
            --arg mac_x64_sig "$MACOS_X64_SIG" \
            --arg win_nsis_sig "$WINDOWS_NSIS_SIG" \
            --arg linux_amd64_sig "$LINUX_AMD64_SIG" \
            --arg linux_a64_sig "$LINUX_AARCH64_SIG" \
            --arg ver "$VER" \
            '{
              version: $version,
              notes: $notes,
              pub_date: $pub_date,
              platforms: {
                "darwin-aarch64": {
                  url: "\($dl)/Antigravity.Tools_aarch64.app.tar.gz",
                  signature: $mac_a64_sig
                },
                "darwin-x86_64": {
                  url: "\($dl)/Antigravity.Tools_x64.app.tar.gz",
                  signature: $mac_x64_sig
                },
                "windows-x86_64": {
                  url: "\($dl)/Antigravity.Tools_\($ver)_x64-setup.exe",
                  signature: $win_nsis_sig
                },
                "linux-x86_64": {
                  url: "\($dl)/Antigravity.Tools_\($ver)_amd64.AppImage",
                  signature: $linux_amd64_sig
                },
                "linux-aarch64": {
                  url: "\($dl)/Antigravity.Tools_\($ver)_aarch64.AppImage",
                  signature: $linux_a64_sig
                }
              }
            }' > updater.json

          echo "Generated updater.json:"
          cat updater.json

      - name: Collect release files
        run: |
          mkdir -p release-files
          find all-artifacts -type f \( \
            -name "*.dmg" -o \
            -name "*.deb" -o \
            -name "*.AppImage" -o \
            -name "*.msi" -o \
            -name "*.exe" -o \
            -name "*.rpm" -o \
            -name "*.app.tar.gz" -o \
            -name "*.sig" \
          \) -print0 | while IFS= read -r -d '' file; do
            cp "$file" release-files/
          done
          find release-files -maxdepth 1 -type f -print

      # 使用 ncipollo/release-action 进行统一发布，支持稳健覆盖
      - name: Create or Update GitHub Release
        uses: ncipollo/release-action@v1
        if: startsWith(github.ref, 'refs/tags/')
        with:
          allowUpdates: true
          name: "Antigravity Tools ${{ github.ref_name }}"
          bodyFile: "release_notes.md"
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: "release-files/*,updater.json"
          artifactErrorsFailBuild: false
          replacesArtifacts: true
          makeLatest: legacy

  docker-build-amd64:
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request' && (github.repository == 'lbjlaq/Antigravity-Manager' || vars.ENABLE_DOCKER_PUSH == 'true')
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push (AMD64)
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/Dockerfile
          platforms: linux/amd64
          push: true
          tags: |
            ${{ github.repository_owner }}/antigravity-manager:latest-amd64
            ${{ github.repository_owner }}/antigravity-manager:${{ github.ref_name }}-amd64
          build-args: |
            USE_MIRROR=false

  docker-build-arm64:
    runs-on: ubuntu-24.04-arm
    if: github.event_name != 'pull_request' && (github.repository == 'lbjlaq/Antigravity-Manager' || vars.ENABLE_DOCKER_PUSH == 'true')
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push (ARM64)
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/Dockerfile
          platforms: linux/arm64
          push: true
          tags: |
            ${{ github.repository_owner }}/antigravity-manager:latest-arm64
            ${{ github.repository_owner }}/antigravity-manager:${{ github.ref_name }}-arm64
          build-args: |
            USE_MIRROR=false

  docker-manifest:
    needs: [docker-build-amd64, docker-build-arm64]
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request' && (github.repository == 'lbjlaq/Antigravity-Manager' || vars.ENABLE_DOCKER_PUSH == 'true')
    steps:
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Create and push manifest
        run: |
          docker buildx imagetools create -t ${{ github.repository_owner }}/antigravity-manager:latest \
            ${{ github.repository_owner }}/antigravity-manager:latest-amd64 \
            ${{ github.repository_owner }}/antigravity-manager:latest-arm64

          docker buildx imagetools create -t ${{ github.repository_owner }}/antigravity-manager:${{ github.ref_name }} \
            ${{ github.repository_owner }}/antigravity-manager:${{ github.ref_name }}-amd64 \
            ${{ github.repository_owner }}/antigravity-manager:${{ github.ref_name }}-arm64