newm-admin-release.yml

# Release workflow for NEWM Admin - runs only on version tags (v*)
# For CI on PRs/pushes, see newm-admin.yml

on:
  push:
    tags:
      - 'v*'

name: NEWM Admin Release

jobs:
  build:
    name: Build
    strategy:
      fail-fast: false
      matrix:
        job:
          - { os: ubuntu-24.04, label: ubuntu24, target: x86_64-unknown-linux-gnu }
          - { os: macos-latest, label: macos, target: aarch64-apple-darwin }
          - { os: windows-latest, label: windows, target: x86_64-pc-windows-msvc }
        rust: [ stable ]

    runs-on: ${{ matrix.job.os }}

    defaults:
      run:
        working-directory: newm-admin

    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          components: rustfmt, clippy

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: "newm-admin -> target"

      - name: Install Linux dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libxkbcommon-x11-dev libxkbcommon-dev libwayland-dev libfuse2

      - name: Run cargo check
        if: ${{ matrix.job.target == 'x86_64-unknown-linux-gnu' }}
        run: cargo check

      - name: Run cargo fmt
        if: ${{ matrix.job.target == 'x86_64-unknown-linux-gnu' }}
        run: cargo fmt --all -- --check

      - name: Run cargo clippy
        run: cargo clippy --release --target ${{ matrix.job.target }} -- -D warnings

      - name: Run cargo test
        run: cargo test --release --target ${{ matrix.job.target }}

      - name: Build Release
        run: cargo build --release --target ${{ matrix.job.target }} --locked

      - name: Package (basic archive)
        id: package
        shell: bash
        run: |
          PROJECT_NAME=$(sed -n 's/^name = "\(.*\)"/\1/p' Cargo.toml)
          PROJECT_VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n1)
          if [[ "${{ matrix.job.target }}" == *-pc-windows-* ]]; then
            PKG_SUFFIX=".zip"
          else
            PKG_SUFFIX=".tar.gz"
          fi
          PKG_NAME=${PROJECT_NAME}-${PROJECT_VERSION}-${{ matrix.job.label }}-${{ matrix.job.target }}${PKG_SUFFIX}
          
          if [[ "${{ matrix.job.target }}" == *-pc-windows-* ]]; then
            7z -y a "${PKG_NAME}" ./target/${{matrix.job.target}}/release/newm-admin.exe | tail -2
          else
            tar -C target/${{matrix.job.target}}/release -czf "${PKG_NAME}" newm-admin
          fi

          echo "PKG_NAME=${PKG_NAME}" >> $GITHUB_OUTPUT
          echo "PKG_PATH=${PKG_NAME}" >> $GITHUB_OUTPUT
          echo "PROJECT_VERSION=${PROJECT_VERSION}" >> $GITHUB_OUTPUT

      - name: Upload Artifacts (basic archive)
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.package.outputs.PKG_NAME }}
          path: newm-admin/${{ steps.package.outputs.PKG_PATH }}

  package-macos:
    name: Package macOS DMG (Universal)
    needs: build
    runs-on: macos-latest

    defaults:
      run:
        working-directory: newm-admin

    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable
          targets: aarch64-apple-darwin,x86_64-apple-darwin

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: "newm-admin -> target"

      - name: Install create-dmg
        run: brew install create-dmg

      - name: Build ARM64 (Apple Silicon)
        run: cargo build --release --target aarch64-apple-darwin --locked

      - name: Build x86_64 (Intel)
        run: cargo build --release --target x86_64-apple-darwin --locked

      - name: Get version
        id: version
        run: |
          VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n1)
          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT

      - name: Import Code Signing Certificate
        env:
          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
          MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          # Ensure certificate file is cleaned up on exit (success or failure)
          trap 'rm -f certificate.p12' EXIT
          
          # Create a temporary keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security set-keychain-settings -t 3600 -u build.keychain
          
          # Decode certificate
          echo "$MACOS_CERTIFICATE" | base64 --decode > certificate.p12
          
          # Verify the p12 file is valid with openssl using a generic error message
          if ! openssl pkcs12 -in certificate.p12 -nokeys -passin env:MACOS_CERTIFICATE_PWD >/dev/null 2>&1; then
            echo "ERROR: Failed to validate macOS code signing certificate or password."
            exit 1
          fi
          
          # Import certificate
          security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign -T /usr/bin/security
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
          
          # Verify certificate was imported and show what identities are available
          echo "Available signing identities in keychain:"
          security find-identity -v -p codesigning build.keychain
          
          # Also make sure we can find it in the login keychain search list
          security list-keychains -d user -s build.keychain login.keychain

      - name: Create Universal App Bundle and DMG
        env:
          MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
        run: |
          chmod +x packaging/macos/bundle.sh
          packaging/macos/bundle.sh ${{ steps.version.outputs.VERSION }} aarch64-apple-darwin

      - name: Notarize App
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          DMG_PATH="target/aarch64-apple-darwin/release/NEWM-Admin-${{ steps.version.outputs.VERSION }}-macos.dmg"
          
          echo "Submitting DMG for notarization..."
          xcrun notarytool submit "$DMG_PATH" \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_APP_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait
          
          echo "Stapling notarization ticket to DMG..."
          xcrun stapler staple "$DMG_PATH"
          
          echo "Verifying notarization..."
          xcrun stapler validate "$DMG_PATH"

      - name: Upload DMG
        uses: actions/upload-artifact@v4
        with:
          name: NEWM-Admin-${{ steps.version.outputs.VERSION }}-macos.dmg
          path: newm-admin/target/aarch64-apple-darwin/release/NEWM-Admin-${{ steps.version.outputs.VERSION }}-macos.dmg


  package-linux:
    name: Package Linux AppImage
    needs: build
    runs-on: ubuntu-22.04

    defaults:
      run:
        working-directory: newm-admin

    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: "newm-admin -> target"

      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libxkbcommon-x11-dev libxkbcommon-dev libwayland-dev libfuse2

      - name: Build Release
        run: cargo build --release --target x86_64-unknown-linux-gnu --locked

      - name: Get version
        id: version
        run: |
          VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n1)
          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT

      - name: Create AppImage
        run: |
          chmod +x packaging/linux/build-appimage.sh
          packaging/linux/build-appimage.sh ${{ steps.version.outputs.VERSION }} x86_64-unknown-linux-gnu

      - name: Upload AppImage
        uses: actions/upload-artifact@v4
        with:
          name: NEWM-Admin-${{ steps.version.outputs.VERSION }}-x86_64.AppImage
          path: newm-admin/target/x86_64-unknown-linux-gnu/release/NEWM-Admin-${{ steps.version.outputs.VERSION }}-x86_64.AppImage

  package-windows:
    name: Package Windows MSI
    needs: build
    runs-on: windows-latest

    defaults:
      run:
        working-directory: newm-admin

    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Install stable toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: stable

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: "newm-admin -> target"

      - name: Install WiX Toolset
        run: |
          dotnet tool install --global wix
          cargo install cargo-wix

      - name: Build Release
        run: cargo build --release --target x86_64-pc-windows-msvc --locked

      - name: Get version
        id: version
        shell: bash
        run: |
          VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n1)
          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT

      - name: Build MSI
        shell: pwsh
        run: |
          ./packaging/windows/build-msi.ps1 -Version "${{ steps.version.outputs.VERSION }}" -Target "x86_64-pc-windows-msvc"

      - name: Upload MSI
        uses: actions/upload-artifact@v4
        with:
          name: NEWM-Admin-${{ steps.version.outputs.VERSION }}-windows.msi
          path: newm-admin/target/x86_64-pc-windows-msvc/release/NEWM-Admin-${{ steps.version.outputs.VERSION }}-windows.msi

  release:
    name: Create Release
    needs: [package-macos, package-linux, package-windows]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Get version
        id: version
        run: |
          VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' newm-admin/Cargo.toml | head -n1)
          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: List artifacts
        run: find artifacts -type f

      - name: Create Release
        uses: softprops/action-gh-release@v2
        with:
          name: NEWM Admin v${{ steps.version.outputs.VERSION }}
          prerelease: ${{ contains(github.ref, 'alpha') || contains(github.ref, 'beta') || contains(github.ref, 'rc') }}
          files: |
            artifacts/**/*.dmg
            artifacts/**/*.AppImage
            artifacts/**/*.msi
            artifacts/**/*.tar.gz
            artifacts/**/*.zip
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}