build-and-package-application.yml

---
name: Build and package application

# yamllint disable-line rule:truthy
on:
  push:
    branches:
      - master
  pull_request:
    types:
      - opened
      - synchronize
  release:
    types:
      - published
  workflow_dispatch: {}

env:
  STATIC_EXPORT: "true"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref_type == 'tag' && format('tag-{0}', github.ref_name) || github.ref }}
  cancel-in-progress: ${{ github.ref_type != 'tag' }}

jobs:
  build-linux:
    name: Build linux
    container:
      image: ghcr.io/${{ github.repository }}/ci-build-arch:latest
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.get_version.outputs.version }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Mark workspace safe for git
        run: git config --global --add safe.directory .

      - name: Setup Go
        uses: ./.github/actions/setup-go

      - name: Build web client
        uses: ./.github/actions/build-client-web

      - name: Get version
        id: get_version
        shell: bash
        run: |
          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            VERSION="${{ github.ref_name }}"
          else
            VERSION="5.0.0-dev+${{ github.sha }}"
          fi
          echo "VERSION=$VERSION" >> $GITHUB_ENV
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Write version to file
        run: echo "${{ env.VERSION }}" > VERSION

      - name: Build application
        env:
          GOOS: linux
          GOARCH: amd64
          CGO_ENABLED: 1
        run: |
          go build -v -ldflags="-X 'github.com/timmo001/system-bridge/version.Version=${{ env.VERSION }}'" -o "system-bridge-linux"

      - name: Verify CSS in Linux binary
        run: |
          chmod +x ./.scripts/verify-css.sh
          ./.scripts/verify-css.sh ./system-bridge-linux

      - name: Upload application
        uses: actions/upload-artifact@v6
        with:
          name: system-bridge-linux-${{ env.VERSION }}
          path: system-bridge-linux

  package-linux:
    name: Package ${{ matrix.build.package }} (${{ matrix.build.distro }})
    needs:
      - build-linux
    container:
      image: ghcr.io/${{ github.repository }}/ci-build-${{ matrix.build.distro }}:latest
      options: "--privileged --cap-add=SYS_ADMIN --device=/dev/fuse"
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        build:
          - distro: arch
            package: arch
          - distro: ubuntu
            package: deb
          - distro: ubuntu
            package: rpm
          - distro: ubuntu
            package: flatpak
    env:
      VERSION: ${{ needs.build-linux.outputs.version }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Download application
        uses: actions/download-artifact@v7
        with:
          name: system-bridge-linux-${{ env.VERSION }}
          path: .

      - name: Package for linux
        run: |
          echo "::group::Setup"
          mkdir -p dist
          chmod +x ./system-bridge-linux
          chmod +x ./.scripts/linux/create-*.sh
          echo "::endgroup::"

          echo "::group::List files"
          ls -la
          echo "::endgroup::"

          echo "::group::List scripts"
          ls -la ./.scripts/linux/
          echo "::endgroup::"

          echo "::group::Create ${{ matrix.build.package }} package"
          ./.scripts/linux/create-${{ matrix.build.package }}.sh
          echo "::endgroup::"

          echo "::group::List dist"
          ls -la dist
          echo "::endgroup::"

      - name: Upload packages
        uses: actions/upload-artifact@v6
        with:
          name: system-bridge-linux-packages-${{ matrix.build.package }}-${{ env.VERSION }}
          path: dist/**
          retention-days: ${{ github.ref_type == 'tag' && 90 || 7 }}

  build-package-windows:
    name: Build and package windows
    runs-on: windows-latest
    env:
      GH_TOKEN: ${{ secrets.GH_TOKEN }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Download NowPlaying helper
        shell: pwsh
        env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
        if: ${{ env.GH_TOKEN != '' }}
        run: ./.scripts/windows/download-now-playing.ps1

      - name: Setup Go
        uses: ./.github/actions/setup-go

      - name: Build web client
        uses: ./.github/actions/build-client-web

      - name: Setup MinGW
        uses: egor-tensin/setup-mingw@v3
        with:
          platform: x64
          # https://github.com/egor-tensin/setup-mingw/issues/17#issuecomment-1890253793
          version: 12.2.0

      - name: Install NSIS
        run: choco install nsis -y --no-progress --limit-output

      - name: Get version
        id: get_version
        shell: bash
        run: |
          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            VERSION="${{ github.ref_name }}"
          else
            VERSION="5.0.0-dev+${{ github.sha }}"
          fi
          echo "VERSION=$VERSION" >> $GITHUB_ENV
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Generate resource file
        run: |
          powershell -ExecutionPolicy Bypass -File ./.scripts/windows/generate-rc.ps1
          windres system-bridge.rc -O coff -o system-bridge.syso

      - name: Build application
        env:
          GOOS: windows
          GOARCH: amd64
          CGO_ENABLED: 1
          CC: gcc
        run: |
          go build -v -ldflags="-H windowsgui -X 'github.com/timmo001/system-bridge/version.Version=${{ env.VERSION }}'" -o "system-bridge.exe"

      - name: Verify CSS in Windows binary
        shell: pwsh
        run: |
          ./.scripts/windows/create-installer.ps1 -VerifyBinaryOnly

      - name: Package for Windows
        run: |
          echo "::group::Setup"
          New-Item -ItemType Directory -Force -Path dist | Out-Null
          Move-Item system-bridge.exe dist/system-bridge.exe -Force
          echo "::endgroup::"

          echo "::group::Create installer"
          ./.scripts/windows/create-installer.ps1
          echo "::endgroup::"

          echo "::group::List dist"
          Get-ChildItem dist -Recurse | Format-Table -AutoSize
          echo "::endgroup::"

      - name: Upload packages
        uses: actions/upload-artifact@v6
        with:
          name: system-bridge-windows-packages-${{ env.VERSION }}
          path: dist/**
          retention-days: ${{ github.ref_type == 'tag' && 90 || 7 }}
    outputs:
      version: ${{ steps.get_version.outputs.version }}

  update-aur:
    name: Update AUR Package
    if: (github.ref == 'refs/heads/master' && github.event_name == 'push') || github.ref_type == 'tag'
    container:
      image: ghcr.io/${{ github.repository }}/ci-build-arch:latest
    runs-on: ubuntu-latest
    needs:
      - build-linux
    env:
      VERSION: ${{ needs.build-linux.outputs.version }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Update AUR package
        env:
          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
          GITHUB_SHA: ${{ github.sha }}
          GITHUB_WORKSPACE: ${{ github.workspace }}
          VERSION: ${{ env.VERSION }}
        run: |
          echo "::group::Setup"
          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            GIT_BUILD="0"
          else
            GIT_BUILD="1"
          fi
          export GIT_BUILD
          chmod +x .scripts/linux/update-aur.sh

          if [ "$(id -u)" -eq 0 ] && id -u builduser >/dev/null 2>&1; then
            echo "Switching to builduser..."
            chown -R builduser:builduser "$(pwd)"
            exec sudo --preserve-env=VERSION,AUR_SSH_PRIVATE_KEY,GITHUB_SHA,GITHUB_WORKSPACE,GIT_BUILD -u builduser -H bash ./.scripts/linux/update-aur.sh
          fi
          echo "::endgroup::"

          echo "::group::Update AUR package"
          ./.scripts/linux/update-aur.sh
          echo "::endgroup::"

      - name: Report AUR update status
        if: always()
        run: |
          if [ "${{ job.status }}" == 'success' ]; then
            echo "✅ AUR package updated successfully!"
            if [[ "${{ github.ref_type }}" == "tag" ]]; then
              echo "Package: https://aur.archlinux.org/packages/system-bridge"
            else
              echo "Package: https://aur.archlinux.org/packages/system-bridge-git"
            fi
          else
            echo "❌ Failed to update AUR package"
            echo "Check the logs above for details"
          fi

  update-release:
    name: Update release
    if: github.event_name == 'release'
    needs:
      - build-linux
      - package-linux
      - build-package-windows
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download linux arch packages
        uses: actions/download-artifact@v7
        with:
          name: system-bridge-linux-packages-arch-${{ needs.build-linux.outputs.version }}
          path: dist/linux/arch

      - name: Download linux deb packages
        uses: actions/download-artifact@v7
        with:
          name: system-bridge-linux-packages-deb-${{ needs.build-linux.outputs.version }}
          path: dist/linux/deb

      - name: Download linux rpm packages
        uses: actions/download-artifact@v7
        with:
          name: system-bridge-linux-packages-rpm-${{ needs.build-linux.outputs.version }}
          path: dist/linux/rpm

      - name: Download linux flatpak packages
        uses: actions/download-artifact@v7
        with:
          name: system-bridge-linux-packages-flatpak-${{ needs.build-linux.outputs.version }}
          path: dist/linux/flatpak

      - name: Download windows packages
        uses: actions/download-artifact@v7
        with:
          name: system-bridge-windows-packages-${{ needs.build-package-windows.outputs.version }}
          path: dist/windows

      - name: Update release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            dist/linux/arch/*.pkg.tar.zst
            dist/linux/deb/*.deb
            dist/linux/rpm/*.rpm
            dist/linux/flatpak/*.flatpak
            dist/windows/*-setup.exe

  compute-next-patch:
    name: Compute next patch tag
    runs-on: ubuntu-latest
    needs:
      - update-release
    if: github.event_name == 'release'
    outputs:
      next_tag: ${{ steps.compute.outputs.next_tag }}
    steps:
      - name: Compute next patch tag
        id: compute
        shell: bash
        run: |
          set -euo pipefail
          PREV_TAG="${{ github.event.release.tag_name }}"
          if [[ -z "${PREV_TAG}" ]]; then
            echo "Release tag not available in context." >&2
            exit 1
          fi
          echo "Previous tag: ${PREV_TAG}"
          NEXT_TAG=""
          if [[ "${PREV_TAG}" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)-beta\.([0-9]+)$ ]]; then
            MAJOR="${BASH_REMATCH[1]}"
            MINOR="${BASH_REMATCH[2]}"
            PATCH="${BASH_REMATCH[3]}"
            NEXT_TAG="${MAJOR}.${MINOR}.${PATCH}"
          elif [[ "${PREV_TAG}" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
            MAJOR="${BASH_REMATCH[1]}"
            MINOR="${BASH_REMATCH[2]}"
            PATCH="${BASH_REMATCH[3]}"
            NEXT_PATCH=$((PATCH+1))
            NEXT_TAG="${MAJOR}.${MINOR}.${NEXT_PATCH}"
          else
            # Fallback: strip common prerelease suffix and try to bump patch
            CLEAN_TAG="${PREV_TAG%%-*}"
            if [[ "${CLEAN_TAG}" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
              MAJOR="${BASH_REMATCH[1]}"
              MINOR="${BASH_REMATCH[2]}"
              PATCH="${BASH_REMATCH[3]}"
              NEXT_TAG="${MAJOR}.${MINOR}.$((PATCH+1))"
            else
              NEXT_TAG="${PREV_TAG}"
            fi
          fi
          echo "Next patch tag: ${NEXT_TAG}"
          echo "next_tag=${NEXT_TAG}" >> "$GITHUB_OUTPUT"

  create-prerelease:
    name: Create draft release
    runs-on: ubuntu-latest
    needs:
      - compute-next-patch
    if: github.event_name == 'release'
    permissions:
      contents: write
    steps:
      - name: Create draft prerelease
        uses: softprops/action-gh-release@v2
        with:
          draft: true
          prerelease: false
          make_latest: true
          name: ${{ needs.compute-next-patch.outputs.next_tag }}
          tag_name: ${{ needs.compute-next-patch.outputs.next_tag }}
          generate_release_notes: false