name: Release

on:
  push:
    tags: ['v*']

permissions:
  contents: write

jobs:
  build-linux:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Download external tools (pandoc)
        run: node scripts/download-tools.js

      - name: Run tests
        run: npm test

      - name: Build Linux packages
        run: npm run build:linux-ci -- --publish=never

      - name: Upload Linux artifacts
        uses: actions/upload-artifact@v4
        with:
          name: linux-artifacts
          path: |
            dist/*.deb
            dist/*.AppImage
            dist/*.snap
            dist/*.rpm
          retention-days: 5

  build-windows:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Download external tools (pandoc)
        run: node scripts/download-tools.js

      - name: Run tests
        run: npm test

      - name: Decode certificate (if available)
        if: ${{ env.CSC_LINK_BASE64 != '' }}
        shell: pwsh
        env:
          CSC_LINK_BASE64: ${{ secrets.CSC_LINK_BASE64 }}
        run: |
          $bytes = [Convert]::FromBase64String("$env:CSC_LINK_BASE64")
          [IO.File]::WriteAllBytes("${{ github.workspace }}\code-signing-cert.pfx", $bytes)
          echo "CERT_AVAILABLE=true" >> $env:GITHUB_ENV

      - name: Build Windows packages (signed)
        if: ${{ env.CERT_AVAILABLE == 'true' }}
        env:
          CSC_LINK: code-signing-cert.pfx
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
        run: npm run build:win-signed -- --publish=never

      - name: Build Windows packages (unsigned)
        if: ${{ env.CERT_AVAILABLE != 'true' }}
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
        run: npm run build:win-unsigned -- --publish=never

      - name: Upload Windows artifacts
        uses: actions/upload-artifact@v4
        with:
          name: windows-artifacts
          path: |
            dist/*.exe
            dist/*.zip
          retention-days: 5

  release:
    needs: [build-linux, build-windows]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Download Linux artifacts
        uses: actions/download-artifact@v4
        continue-on-error: true
        with:
          name: linux-artifacts
          path: dist

      - name: Download Windows artifacts
        uses: actions/download-artifact@v4
        continue-on-error: true
        with:
          name: windows-artifacts
          path: dist

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: dist/*