name: Release

on:
  push:
    tags: ['v*']

permissions:
  contents: write

jobs:
  build-linux:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Download external tools (pandoc)
        run: node scripts/download-tools.js

      - name: Run tests
        run: npm test

      - name: Build Linux packages
        run: npm run build:linux-ci -- --publish=always

      - name: Upload Linux artifacts
        uses: actions/upload-artifact@v4
        with:
          name: linux-artifacts
          path: |
            dist/*.deb
            dist/*.AppImage
            dist/*.snap
            dist/*.rpm
          retention-days: 5

  build-windows:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Download external tools (pandoc)
        run: node scripts/download-tools.js

      - name: Run tests
        run: npm test

      - name: Decode certificate (if available)
        if: ${{ env.CSC_LINK_BASE64 != '' }}
        shell: pwsh
        env:
          CSC_LINK_BASE64: ${{ secrets.CSC_LINK_BASE64 }}
        run: |
          $bytes = [Convert]::FromBase64String("$env:CSC_LINK_BASE64")
          [IO.File]::WriteAllBytes("${{ github.workspace }}\code-signing-cert.pfx", $bytes)
          echo "CERT_AVAILABLE=true" >> $env:GITHUB_ENV

      - name: Build Windows packages (signed)
        if: ${{ env.CERT_AVAILABLE == 'true' }}
        env:
          CSC_LINK: code-signing-cert.pfx
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
        run: npm run build:win-signed -- --publish=always

      - name: Build Windows packages (unsigned)
        if: ${{ env.CERT_AVAILABLE != 'true' }}
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
        run: npm run build:win-unsigned -- --publish=always

      - name: Upload Windows artifacts
        uses: actions/upload-artifact@v4
        with:
          name: windows-artifacts
          path: |
            dist/*.exe
            dist/*.zip
          retention-days: 5

  build-macos:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Download external tools (pandoc)
        run: node scripts/download-tools.js

      - name: Run tests
        run: npm test

      - name: Build macOS packages (unsigned)
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
        run: npm run build:mac -- --publish=always

      - name: Upload macOS artifacts
        uses: actions/upload-artifact@v4
        with:
          name: macos-artifacts
          path: |
            dist/*.dmg
            dist/*.zip
          retention-days: 5

  release:
    needs: [build-linux, build-windows, build-macos]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Download Linux artifacts
        uses: actions/download-artifact@v4
        continue-on-error: true
        with:
          name: linux-artifacts
          path: dist

      - name: Download Windows artifacts
        uses: actions/download-artifact@v4
        continue-on-error: true
        with:
          name: windows-artifacts
          path: dist

      - name: Download macOS artifacts
        uses: actions/download-artifact@v4
        continue-on-error: true
        with:
          name: macos-artifacts
          path: dist

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: dist/*

      - name: Mirror artifacts to ConcreteInfo update feed
        if: env.CONCRETEINFO_DEPLOY_HOOK != ''
        env:
          CONCRETEINFO_DEPLOY_HOOK: ${{ secrets.CONCRETEINFO_DEPLOY_HOOK }}
        run: |
          curl -fsSL -X POST \
            -H "Authorization: Bearer ${{ secrets.CONCRETEINFO_DEPLOY_HOOK }}" \
            -F "version=${GITHUB_REF_NAME#v}" \
            -F "artifacts=@dist/latest-mac.yml" \
            -F "artifacts=@dist/latest-linux.yml" \
            -F "artifacts=@dist/latest-windows.yml" \
            https://updates.concreteinfo.co.in/api/v1/ingest