release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to build and publish (e.g. v1.0.0)"
        required: true

permissions:
  contents: read

jobs:
  publish:
    name: Publish ${{ matrix.rid }}
    runs-on: windows-latest

    strategy:
      fail-fast: false
      matrix:
        rid: [win-x64, win-arm64]

    env:
      DOTNET_NOLOGO: true
      DOTNET_CLI_TELEMETRY_OPTOUT: true

    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          ref: ${{ inputs.tag || github.ref }}

      - name: Setup .NET 10
        uses: actions/setup-dotnet@v6
        with:
          dotnet-version: 10.0.x

      - name: Install .NET MAUI workload
        run: dotnet workload install maui

      - name: Publish (${{ matrix.rid }})
        run: >
          dotnet publish src/Helix.App/Helix.App.csproj
          -f net10.0-windows10.0.19041.0
          -c Release
          -p:RuntimeIdentifierOverride=${{ matrix.rid }}
          -p:AppxPackageSigningEnabled=false
          -o publish/${{ matrix.rid }}

      - name: Create archive
        shell: pwsh
        run: |
          $tag = "${{ inputs.tag }}"
          if (-not $tag) { $tag = "${{ github.ref_name }}" }
          New-Item -ItemType Directory -Force artifacts | Out-Null
          Compress-Archive -Path publish/${{ matrix.rid }}/* -DestinationPath "artifacts/Helix-$tag-${{ matrix.rid }}.zip"

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: Helix-${{ matrix.rid }}
          path: artifacts/*.zip
          if-no-files-found: error

  publish-macos:
    name: Publish maccatalyst
    # Catalyst compilation needs Xcode, so this half cannot run on the Windows runner.
    runs-on: macos-latest

    env:
      DOTNET_NOLOGO: true
      DOTNET_CLI_TELEMETRY_OPTOUT: true

    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          ref: ${{ inputs.tag || github.ref }}

      - name: Setup .NET 10
        uses: actions/setup-dotnet@v6
        with:
          dotnet-version: 10.0.x

      - name: Install .NET MAUI workload
        run: dotnet workload install maui

      # One universal .app covering both Intel and Apple Silicon, rather than a build per
      # architecture: the RuntimeIdentifiers the project already declares are lipo'd
      # together into a single bundle. They are deliberately not repeated as a -p: switch
      # here - MSBuild splits a -p: argument on ';' into several properties, so
      # -p:RuntimeIdentifiers="a;b" reaches it as a property 'a' and a stray switch 'b'
      # (MSB1006), quotes or no quotes.
      #
      # Unsigned on purpose. Signing needs a Developer ID certificate and an Apple
      # Developer account, which cannot live in a public repository without secrets — see
      # the release notes for what that means for anyone downloading it.
      - name: Publish (maccatalyst)
        run: >
          dotnet publish src/Helix.App/Helix.App.csproj
          -f net10.0-maccatalyst
          -c Release
          -p:CreatePackage=false
          -p:EnableCodeSigning=false

      # ditto, not zip: a .app is a bundle of symlinks, permissions and extended
      # attributes, and a plain zip flattens the ones that make it launchable.
      - name: Create archive
        run: |
          TAG="${{ inputs.tag }}"
          if [ -z "$TAG" ]; then TAG="${{ github.ref_name }}"; fi

          # The publish above deliberately has no -o. On Apple targets -o sets PublishDir,
          # and the bundle's *contents* are written into it rather than a .app wrapper, so
          # the wrapper stays at its default path and the archive step finds nothing.
          BIN="src/Helix.App/bin/Release/net10.0-maccatalyst"

          # The universal bundle sits at the top; the per-RID folder below it is where a
          # single-architecture build would land, and is worth archiving over failing.
          APP="$(find "$BIN" -maxdepth 1 -type d -name '*.app' -print -quit)"
          if [ -z "$APP" ]; then
            APP="$(find "$BIN" -maxdepth 2 -type d -name '*.app' -print -quit)"
          fi

          if [ -z "$APP" ]; then
            echo "No .app bundle was produced. $BIN holds:"
            find "$BIN" -maxdepth 2 -print | head -50
            exit 1
          fi

          # Both architectures or one is worth knowing in the log: an unnoticed
          # single-architecture build is a bundle half the Macs out there cannot run.
          echo "Archiving $APP"
          file "$APP/Contents/MacOS/"* | head -5

          mkdir -p artifacts
          ditto -c -k --sequesterRsrc --keepParent "$APP" "artifacts/Helix-$TAG-macos.zip"

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: Helix-macos
          path: artifacts/*.zip
          if-no-files-found: error

  release:
    name: Create GitHub release
    needs: [publish, publish-macos]
    runs-on: ubuntu-latest

    permissions:
      contents: write

    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts
          merge-multiple: true

      - name: Create or update release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ inputs.tag || github.ref_name }}
        run: |
          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            echo "Release $TAG already exists, uploading assets."
            gh release upload "$TAG" artifacts/*.zip \
              --repo "$GITHUB_REPOSITORY" \
              --clobber
          else
            gh release create "$TAG" artifacts/*.zip \
              --repo "$GITHUB_REPOSITORY" \
              --title "$TAG" \
              --generate-notes \
              --verify-tag
          fi