juce-build.yml

name: Build + Validate

on:
  push:
    branches: ['**']
    tags: ['v*']
  pull_request:
    branches: [main]

env:
  BUILD_TYPE: Release

jobs:
  build-macos:
    runs-on: macos-14
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Setup CMake
        uses: lukka/get-cmake@latest

      - name: Build universal OpenSSL
        run: |
          OPENSSL_VER=3.4.1
          curl -sL "https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_VER}/openssl-${OPENSSL_VER}.tar.gz" | tar xz
          cd "openssl-${OPENSSL_VER}"

          # arm64
          ./Configure darwin64-arm64-cc --prefix="$GITHUB_WORKSPACE/openssl-arm64" no-shared no-tests
          make -j$(sysctl -n hw.ncpu) && make install_sw && make clean

          # x86_64
          ./Configure darwin64-x86_64-cc --prefix="$GITHUB_WORKSPACE/openssl-x86_64" no-shared no-tests
          make -j$(sysctl -n hw.ncpu) && make install_sw

          # lipo into universal
          mkdir -p "$GITHUB_WORKSPACE/openssl-universal/lib"
          cp -r "$GITHUB_WORKSPACE/openssl-arm64/include" "$GITHUB_WORKSPACE/openssl-universal/"
          lipo -create "$GITHUB_WORKSPACE/openssl-arm64/lib/libcrypto.a" \
                       "$GITHUB_WORKSPACE/openssl-x86_64/lib/libcrypto.a" \
               -output "$GITHUB_WORKSPACE/openssl-universal/lib/libcrypto.a"
          lipo -create "$GITHUB_WORKSPACE/openssl-arm64/lib/libssl.a" \
                       "$GITHUB_WORKSPACE/openssl-x86_64/lib/libssl.a" \
               -output "$GITHUB_WORKSPACE/openssl-universal/lib/libssl.a"
          lipo -info "$GITHUB_WORKSPACE/openssl-universal/lib/libcrypto.a"

      - name: Configure CMake
        run: |
          cmake -B build \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_OSX_ARCHITECTURES="arm64;x86_64" \
            -DJAMWIDE_BUILD_JUCE=ON \
            -DJAMWIDE_BUILD_CLAP=OFF \
            -DJAMWIDE_DEV_BUILD=OFF \
            -DOPENSSL_ROOT_DIR="$GITHUB_WORKSPACE/openssl-universal"

      - name: Build
        run: cmake --build build --config Release -j $(sysctl -n hw.ncpu)

      - name: Verify artifacts
        run: |
          echo "=== Build artifacts ==="
          ls -la "build/JamWideJuce_artefacts/Release/VST3/JamWide.vst3/" || echo "VST3 not found"
          ls -la "build/JamWideJuce_artefacts/Release/AU/JamWide.component/" || echo "AU not found"
          ls -la "build/JamWideJuce_artefacts/Release/CLAP/JamWide.clap/" || echo "CLAP not found"
          ls -la "build/JamWideJuce_artefacts/Release/Standalone/JamWide.app/" || echo "Standalone not found"

      - name: Download pluginval
        run: |
          curl -L https://github.com/Tracktion/pluginval/releases/latest/download/pluginval_macOS.zip -o pluginval.zip
          unzip pluginval.zip

      - name: Force AU re-scan
        run: killall -9 AudioComponentRegistrar 2>/dev/null || true

      - name: Validate VST3
        run: |
          ./pluginval.app/Contents/MacOS/pluginval \
            --validate-in-process \
            --strictness-level 5 \
            --timeout-ms 120000 \
            --validate "build/JamWideJuce_artefacts/Release/VST3/JamWide.vst3"

      - name: Validate AU
        continue-on-error: true
        run: |
          ./pluginval.app/Contents/MacOS/pluginval \
            --validate-in-process \
            --strictness-level 5 \
            --timeout-ms 120000 \
            --validate "build/JamWideJuce_artefacts/Release/AU/JamWide.component"

      - name: Validate Standalone
        continue-on-error: true
        run: |
          ./pluginval.app/Contents/MacOS/pluginval \
            --validate-in-process \
            --strictness-level 5 \
            --timeout-ms 120000 \
            --validate "build/JamWideJuce_artefacts/Release/Standalone/JamWide.app"

      - name: Import signing certificate
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          CERTIFICATE_P12: ${{ secrets.DEVELOPER_ID_P12 }}
          CERTIFICATE_PASSWORD: ${{ secrets.DEVELOPER_ID_P12_PASSWORD }}
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/signing.keychain-db
          KEYCHAIN_PASSWORD=$(openssl rand -hex 16)
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          echo "$CERTIFICATE_P12" | base64 --decode > "$RUNNER_TEMP/cert.p12"
          security import "$RUNNER_TEMP/cert.p12" -k "$KEYCHAIN_PATH" -P "$CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security list-keychains -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | tr -d '"')
          rm "$RUNNER_TEMP/cert.p12"

      - name: Sign and notarize bundles
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          NOTARIZE_KEY_ID: ${{ secrets.NOTARIZE_KEY_ID }}
          NOTARIZE_ISSUER_ID: ${{ secrets.NOTARIZE_ISSUER_ID }}
          NOTARIZE_KEY_PATH: ${{ runner.temp }}/AuthKey.p8
          NOTARIZE_API_KEY_B64: ${{ secrets.NOTARIZE_API_KEY_P8 }}
        run: |
          echo "$NOTARIZE_API_KEY_B64" | base64 --decode > "$NOTARIZE_KEY_PATH"
          ./scripts/notarize.sh build/JamWideJuce_artefacts/Release
          rm -f "$NOTARIZE_KEY_PATH"

      - name: Package artifacts
        run: |
          mkdir -p staging
          cp -r "build/JamWideJuce_artefacts/Release/VST3/JamWide.vst3" staging/
          cp -r "build/JamWideJuce_artefacts/Release/AU/JamWide.component" staging/
          cp -r "build/JamWideJuce_artefacts/Release/CLAP/JamWide.clap" staging/
          cp -r "build/JamWideJuce_artefacts/Release/Standalone/JamWide.app" staging/
          cd staging && tar czf ../JamWide-macOS.tar.gz .

      - name: Upload macOS artifacts
        uses: actions/upload-artifact@v4
        with:
          name: JamWide-macOS
          path: JamWide-macOS.tar.gz
          retention-days: 30

  build-windows:
    runs-on: windows-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Setup CMake
        uses: lukka/get-cmake@latest

      - name: Configure CMake
        run: |
          cmake -B build `
            -G "Visual Studio 17 2022" `
            -A x64 `
            -DJAMWIDE_BUILD_JUCE=ON `
            -DJAMWIDE_BUILD_CLAP=OFF `
            -DJAMWIDE_DEV_BUILD=OFF

      - name: Build
        run: cmake --build build --config Release

      - name: Verify artifacts
        shell: pwsh
        run: |
          Write-Host "=== Build artifacts ==="
          Get-ChildItem -Path "build/JamWideJuce_artefacts" -Recurse -Include "*.vst3","*.clap" -Directory | Select-Object FullName

      - name: Download pluginval
        shell: pwsh
        run: |
          Invoke-WebRequest -Uri "https://github.com/Tracktion/pluginval/releases/latest/download/pluginval_Windows.zip" -OutFile pluginval.zip
          Expand-Archive -Path pluginval.zip -DestinationPath pluginval

      - name: Validate VST3
        run: |
          pluginval\pluginval.exe --validate-in-process --strictness-level 5 --timeout-ms 120000 --validate "build\JamWideJuce_artefacts\Release\VST3\JamWide.vst3"

      - name: Stage artifacts
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Path staging -Force
          # VST3: single-file bundle (extract DLL from package directory)
          Copy-Item "build/JamWideJuce_artefacts/Release/VST3/JamWide.vst3/Contents/x86_64-win/JamWide.vst3" "staging/JamWide.vst3"
          # CLAP: single-file bundle
          Copy-Item "build/JamWideJuce_artefacts/Release/CLAP/JamWide.clap" "staging/JamWide.clap"
          # Standalone
          Copy-Item "build/JamWideJuce_artefacts/Release/Standalone/JamWide.exe" "staging/JamWide.exe"

      - name: Upload Windows artifacts
        uses: actions/upload-artifact@v4
        with:
          name: JamWide-Windows
          path: staging/
          retention-days: 30

  build-linux:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            build-essential cmake pkg-config \
            libasound2-dev \
            libjack-jackd2-dev \
            libfreetype-dev \
            libx11-dev \
            libxrandr-dev \
            libxinerama-dev \
            libxcursor-dev \
            libxcomposite-dev \
            libgl1-mesa-dev \
            libcurl4-openssl-dev \
            libwebkit2gtk-4.1-dev \
            libssl-dev

      - name: Configure CMake
        run: |
          cmake -B build \
            -DCMAKE_BUILD_TYPE=Release \
            -DJAMWIDE_BUILD_JUCE=ON \
            -DJAMWIDE_BUILD_CLAP=OFF \
            -DJAMWIDE_DEV_BUILD=OFF

      - name: Build
        run: cmake --build build --config Release -j $(nproc)

      - name: Verify artifacts
        run: |
          echo "=== Build artifacts ==="
          find build/JamWideJuce_artefacts -name "*.vst3" -o -name "*.clap" -o -name "*.so" | head -20

      - name: Download pluginval
        run: |
          curl -L https://github.com/Tracktion/pluginval/releases/latest/download/pluginval_Linux.zip -o pluginval.zip
          unzip pluginval.zip
          chmod +x pluginval

      - name: Validate VST3
        continue-on-error: true
        run: |
          ./pluginval \
            --validate-in-process \
            --strictness-level 5 \
            --timeout-ms 120000 \
            --validate "build/JamWideJuce_artefacts/Release/VST3/JamWide.vst3"

      - name: Package artifacts
        run: |
          mkdir -p staging
          cp -r "build/JamWideJuce_artefacts/Release/VST3/JamWide.vst3" staging/
          cp "build/JamWideJuce_artefacts/Release/CLAP/JamWide.clap" staging/
          cp "build/JamWideJuce_artefacts/Release/Standalone/JamWide" staging/
          cd staging && tar czf ../JamWide-Linux.tar.gz .

      - name: Upload Linux artifacts
        uses: actions/upload-artifact@v4
        with:
          name: JamWide-Linux
          path: JamWide-Linux.tar.gz
          retention-days: 30

  release:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [build-macos, build-windows, build-linux]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Package Windows artifacts
        run: |
          cd artifacts/JamWide-Windows
          zip -r ../../JamWide-Windows.zip .

      - name: Prepare macOS and Linux artifacts
        run: |
          # macOS and Linux are already tar.gz (preserves Unix permissions)
          cp artifacts/JamWide-macOS/JamWide-macOS.tar.gz .
          cp artifacts/JamWide-Linux/JamWide-Linux.tar.gz .

      - name: Create or update release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG_NAME: ${{ github.ref_name }}
        run: |
          PRERELEASE_FLAG=""
          if echo "$TAG_NAME" | grep -qE "beta|alpha|rc"; then
            PRERELEASE_FLAG="--prerelease"
          fi
          if gh release view "$TAG_NAME" --repo "$GITHUB_REPOSITORY" > /dev/null 2>&1; then
            echo "Release $TAG_NAME already exists — uploading assets"
            gh release upload "$TAG_NAME" \
              --repo "$GITHUB_REPOSITORY" \
              --clobber \
              JamWide-macOS.tar.gz \
              JamWide-Windows.zip \
              JamWide-Linux.tar.gz
          else
            gh release create "$TAG_NAME" \
              --repo "$GITHUB_REPOSITORY" \
              --title "$TAG_NAME" \
              --generate-notes \
              $PRERELEASE_FLAG \
              JamWide-macOS.tar.gz \
              JamWide-Windows.zip \
              JamWide-Linux.tar.gz
          fi