# TODO
# - Issues finding the plugin folder on Windows
name: Build/release
on:
  push:
    branches:
      - main
      - alpha
      - beta

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Check out Git repository
        uses: actions/checkout@v6
      - uses: oven-sh/setup-bun@v2
      - name: Install Dependencies
        run: bun install
      - name: Release
        run: bunx semantic-release
      - name: Archive production artifacts
        uses: actions/upload-artifact@v7
        with:
          name: build
          path: build

  release:
    needs: build
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: "macos-latest" # for Arm based macs (M1 and above).
            args: "--target aarch64-apple-darwin"
            arch: "aarch64-apple-darwin"
          - platform: "macos-26-intel" # for Intel based macs.
            args: "--target x86_64-apple-darwin"
            arch: "x86_64-apple-darwin"
          - platform: "ubuntu-24.04"
            args: ""
            arch: "x86_64-unknown-linux-gnu"
          - platform: "windows-latest"
            args: ""
            arch: "x86_64-pc-windows-msvc"
    runs-on: ${{ matrix.platform }}
    steps:
      - name: Check out Git repository
        uses: actions/checkout@v6
        with:
          ref: alpha
          path: app
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.4.2
      - name: Install create-dm
        if: startsWith(matrix.platform, 'macos')
        run: brew install create-dmg
      - name: Install Dependencies
        working-directory: ./app
        run: bun install
      - name: Download production artifacts
        uses: actions/download-artifact@v8
        with:
          name: build
          path: app/build
      - name: Prepare for app Signing
        if: startsWith(matrix.platform, 'macos')
        working-directory: ./app
        run: |
          mkdir -p ~/private_keys/
          echo '${{ secrets.api_key }}' > ~/private_keys/AuthKey_${{ secrets.api_key_id }}.p8
          chmod +x ./scripts/set-up-keychain.sh
          ./scripts/set-up-keychain.sh
        env:
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.MAC_CERTS_PASSWORD }}
          APPLE_CERTIFICATE: ${{ secrets.MAC_CERTS }}
          APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }}
          APPLE_DEVELOPER_ID: ${{ secrets.APPLE_DEVELOPER_ID }}

      - name: Prepare for app notarization
        if: startsWith(matrix.platform, 'macos')
        # Import Apple API key for app notarization on macOS
        run: xcrun notarytool store-credentials "notarytool-password"
          --apple-id "$APPLE_ID"
          --team-id "$APPLE_TEAM_ID"
          --password "$APPLE_PASSWORD"
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

      - name: Build Bun Server
        working-directory: ./app
        run: bun run build:server
        env:
          BUILD_ARCH: ${{ matrix.arch }}

      - name: Sign Bun Server
        if: startsWith(matrix.platform, 'macos')
        working-directory: ./app
        run: bun run release-desktop
        env:
          BUILD_ARCH: ${{ matrix.arch }}
          # Signing
          APPLE_CERTIFICATE: ${{ secrets.MAC_CERTS }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.MAC_CERTS_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }}
          APPLE_DEVELOPER_ID: ${{ secrets.APPLE_DEVELOPER_ID }}

          # Notarization uses the static keychain name above
      - name: Get Version
        id: get-version
        working-directory: ./app
        run: |
          bun .github/actions/getVersion.ts
      - name: Release
        id: make-release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ steps.get-version.outputs.version }}
          make_latest: true
          body: "See CHANGELOG.md for release notes. Download the asset for your platform. `thorium-nova-server-` assets run the server without running a kiosk. Be sure to run `chmod +x thorium-nova-server-ARCH` to make them executable."
          files: |
            app/binaries/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup tmate session
        uses: mxschmitt/action-tmate@v3
        timeout-minutes: 10
        if: failure()