build-and-publish.yml

name: Build and Publish Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

env:
  RELEASE_VERSION: ${{ github.ref_name }}

jobs:
  publish-linux:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Debug environment
        run: |
          chmod +x ./bin/debug-env.sh
          ./bin/debug-env.sh

      - name: Publish Linux (AppImage and deb)
        run: |
          echo "🐧 开始Linux构建..."
          npm run publish:linux
        env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
          DEBUG: electron-builder

      - name: Verify Linux build output
        run: |
          echo "🔍 验证Linux构建输出..."
          ls -la dist/
          echo "✅ Linux构建完成"

  publish-windows:
    runs-on: windows-latest
    timeout-minutes: 30
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Debug environment
        run: |
          chmod +x ./bin/debug-env.sh
          ./bin/debug-env.sh

      - name: Publish Windows
        run: |
          echo "🪟 开始Windows构建（包含Defender白名单自动配置）..."
          npm run publish:win
        env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
          DEBUG: electron-builder

      - name: Verify Windows build output
        run: |
          echo "🔍 验证Windows构建输出..."
          ls -la dist/
          # 检查是否包含README文件和安装脚本
          if (Test-Path "dist/README_WINDOWS.txt") {
            Write-Host "✅ Windows用户说明文件已创建"
            Get-Content "dist/README_WINDOWS.txt"
          } else {
            Write-Host "⚠️  Windows用户说明文件未找到"
          }
          # 检查NSIS配置
          if (Test-Path "build/installer.nsh") {
            Write-Host "✅ NSIS安装脚本配置存在"
          } else {
            Write-Host "⚠️  NSIS安装脚本配置未找到"
          }
        shell: powershell

  publish-macos:
    runs-on: macos-26
    timeout-minutes: 60
    strategy:
      matrix:
        arch: [x64, arm64]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Debug environment
        run: |
          chmod +x ./bin/debug-env.sh
          ./bin/debug-env.sh

      - name: Debug macOS build environment
        run: |
          echo "=== macOS Build Environment (${{ matrix.arch }}) ==="
          uname -a
          sw_vers
          xcodebuild -version || echo "Xcode not available"
          echo "Available disk space:"
          df -h
          echo "Memory usage:"
          vm_stat
          echo "Building for architecture: ${{ matrix.arch }}"

      - name: Setup macOS signing tools
        run: |
          echo "🔧 准备macOS签名工具..."
          # 确保codesign工具可用
          which codesign || echo "Warning: codesign not found"
          # 设置脚本权限
          chmod +x ./bin/fix-macos.sh
          chmod +x ./bin/user-fix-macos.sh
          echo "✅ macOS工具准备完成"

      - name: Publish macOS ${{ matrix.arch }}
        run: |
          echo "Starting macOS ${{ matrix.arch }} build with verbose output..."
          echo "🍎 构建将自动处理签名和用户体验优化..."
          npm run publish:mac:${{ matrix.arch }}
        env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
          DEBUG: electron-builder
          CSC_IDENTITY_AUTO_DISCOVERY: false
          ELECTRON_BUILDER_ALLOW_UNRESOLVED_DEPENDENCIES: true
          # 确保afterPack钩子能正常执行
          ELECTRON_IS_DEV: 0

      - name: Verify macOS build output
        run: |
          echo "🔍 验证macOS构建输出..."
          ls -la dist/
          # 检查是否包含README文件
          if [ -f "dist/README_MACOS.txt" ]; then
            echo "✅ 用户说明文件已创建"
            cat dist/README_MACOS.txt
          else
            echo "⚠️  用户说明文件未找到"
          fi
          # 检查.app文件
          find dist/ -name "*.app" -type d | head -5 | while read app_path; do
            if [ -d "$app_path" ]; then
              echo "📱 找到应用: $app_path"
              # 检查签名状态
              codesign -dv "$app_path" 2>&1 || echo "签名检查完成"
            fi
          done

  cleanup-release:
    runs-on: ubuntu-latest
    needs: [publish-linux, publish-windows, publish-macos]
    if: always() && (needs.publish-linux.result == 'success' || needs.publish-windows.result == 'success' || needs.publish-macos.result == 'success')
    permissions:
      contents: write
      actions: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        
      - name: Debug GitHub token and permissions
        run: |
          chmod +x ./bin/debug-github.sh
          ./bin/debug-github.sh
        env:
          GITHUB_TOKEN: ${{ secrets.atriordsa }}
      
      - name: Clean unwanted files from release
        run: |
          chmod +x ./bin/cleanup-release.sh
          ./bin/cleanup-release.sh
        env:
          GITHUB_TOKEN: ${{ secrets.atriordsa }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_REF_NAME: ${{ github.ref_name }}

  upload-to-cos:
    runs-on: ubuntu-latest
    timeout-minutes: 180  # 3小时超时，适合大文件上传
    needs: [cleanup-release]
    if: always() && needs.cleanup-release.result == 'success'
    steps:
      - name: Checkout repository first
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Get release info
        run: |
          chmod +x ./bin/get-release-info.sh
          ./bin/get-release-info.sh
        env:
          GITHUB_TOKEN: ${{ secrets.atriordsa }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_REF_NAME: ${{ github.ref_name }}

      - name: Download release assets
        run: |
          chmod +x ./bin/download-assets.sh
          ./bin/download-assets.sh
        env:
          GITHUB_TOKEN: ${{ secrets.atriordsa }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_REF_NAME: ${{ github.ref_name }}

      - name: Create release index
        run: node scripts/create-release-index.js
        env:
          TAG_NAME: ${{ github.ref_name }}
          CDN_URL: ${{ secrets.CDN_URL }}
          GITHUB_TOKEN: ${{ secrets.atriordsa }}

      - name: Upload all files to COS using npm script
        run: npm run upload:cos
        env:
          COS_SECRET_ID: ${{ secrets.COS_SECRET_ID }}
          COS_SECRET_KEY: ${{ secrets.COS_SECRET_KEY }}
          COS_REGION: ${{ secrets.COS_REGION }}
          COS_BUCKET: ${{ secrets.COS_BUCKET }}
          COS_DOMAIN: ${{ secrets.COS_DOMAIN }}
          TAG_NAME: ${{ github.ref_name }}

      - name: Display upload summary
        run: |
          chmod +x ./bin/display-upload-summary.sh
          ./bin/display-upload-summary.sh
        env:
          TAG_NAME: ${{ github.ref_name }}
          COS_DOMAIN: ${{ secrets.COS_DOMAIN }}
          CDN_URL: ${{ secrets.CDN_URL }}