release.yml

# Build OpenView desktop release binaries.
#
# Triggers:
#   - Git tags matching v* (e.g. v3.0.0) → create a GitHub Release
#   - workflow_dispatch → manual build; upload workflow artifacts only
#
# Artifacts:
#   OpenView-linux-x64.zip
#   OpenView-linux-arm64.zip
#   OpenView-windows-x64.zip
#   OpenView-macos-universal.zip   (Intel + Apple Silicon; ad-hoc signed — see the macOS job)
#   SHA256SUMS.txt
#
# Desktop only. Mobile ships through the App Store and Google Play, and the
# Android APK / iOS pipeline is tracked separately — do not add a mobile job
# here without also sorting out release signing (see docs/mobile-deployment.md).
name: Release builds

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  # Releases pin an exact Flutter version so a rebuild of a tag is reproducible
  # and a bad upstream stable can never silently break a release.
  FLUTTER_VERSION: 3.44.6

jobs:
  # ── Guard: tag must match the pubspec version ──────────────────────────
  # Cheap job that fails in ~10s rather than after four platform builds.
  version:
    name: Check version
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Tag matches pubspec version
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          tag="${GITHUB_REF_NAME#v}"                       # v3.0.0 → 3.0.0
          pubspec=$(grep -m1 '^version:' pubspec.yaml | awk '{print $2}')
          echo "tag=$tag pubspec=$pubspec"
          if [ "$tag" != "${pubspec%%+*}" ]; then
            echo "::error::Tag $GITHUB_REF_NAME does not match pubspec version $pubspec." \
                 "Bump pubspec.yaml or retag."
            exit 1
          fi

  # ── Linux desktop ──────────────────────────────────────────────────────
  linux:
    name: Linux x64
    needs: version
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: ${{ env.FLUTTER_VERSION }}
          channel: stable
          cache: true

      - name: Install system packages
        run: |
          sudo apt-get update -y
          sudo apt-get install -y \
            clang cmake ninja-build pkg-config \
            libgtk-3-dev liblzma-dev libstdc++-12-dev \
            libudev-dev

      - name: Flutter config & deps
        run: |
          flutter config --enable-linux-desktop
          flutter pub get

      - name: Build Linux release
        # OV_CHANNEL=github enables the in-app update check (UpdateChannel).
        # Only builds published here may point users at a GitHub Release zip;
        # store builds must stay on the default `store` channel.
        run: flutter build linux --release --dart-define=OV_CHANNEL=github

      - name: Package
        run: |
          cd build/linux/x64/release/bundle
          zip -r "$GITHUB_WORKSPACE/OpenView-linux-x64.zip" .

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: OpenView-linux-x64
          path: OpenView-linux-x64.zip
          if-no-files-found: error

  # ── Linux desktop (ARM64) ──────────────────────────────────────────────
  # Native aarch64 build on GitHub's free arm64 runner, for Raspberry Pi and
  # other ARM SBCs — a common host for ProtoCentral boards.
  #
  # Flutter does not publish prebuilt Linux *arm64* SDK archives, so
  # subosito/flutter-action can't resolve a pinned version here ("Unable to
  # determine Flutter version ... architecture: arm64"). Install the SDK with a
  # shallow git clone at the version tag instead; `flutter` bootstraps the
  # matching arm64 Dart SDK and engine artifacts on first run.
  linux-arm64:
    name: Linux arm64
    needs: version
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 60
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Flutter (arm64 via git)
        run: |
          git clone --depth 1 --branch "$FLUTTER_VERSION" \
            https://github.com/flutter/flutter.git "$HOME/flutter"
          echo "$HOME/flutter/bin" >> "$GITHUB_PATH"

      - name: Flutter version
        run: flutter --version

      - name: Install system packages
        run: |
          sudo apt-get update -y
          sudo apt-get install -y \
            clang cmake ninja-build pkg-config \
            libgtk-3-dev liblzma-dev libstdc++-12-dev \
            libudev-dev

      - name: Flutter config & deps
        run: |
          flutter config --enable-linux-desktop
          flutter pub get

      - name: Build Linux release
        # OV_CHANNEL=github enables the in-app update check (UpdateChannel).
        # Only builds published here may point users at a GitHub Release zip;
        # store builds must stay on the default `store` channel.
        run: flutter build linux --release --dart-define=OV_CHANNEL=github

      - name: Package
        run: |
          cd build/linux/arm64/release/bundle
          zip -r "$GITHUB_WORKSPACE/OpenView-linux-arm64.zip" .

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: OpenView-linux-arm64
          path: OpenView-linux-arm64.zip
          if-no-files-found: error

  # ── Windows desktop ────────────────────────────────────────────────────
  windows:
    name: Windows x64
    needs: version
    runs-on: windows-latest
    timeout-minutes: 60
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: ${{ env.FLUTTER_VERSION }}
          channel: stable
          cache: true

      - name: Flutter config & deps
        run: |
          flutter config --enable-windows-desktop
          flutter pub get

      - name: Build Windows release
        env:
          # MSVC 14.51 (VS 18, on windows-latest) makes <experimental/coroutine>
          # a hard error — STL1011 — and permission_handler_windows still
          # includes it. cl.exe picks up extra flags from the CL env var, so we
          # can silence it here instead of patching the plugin. Remove once
          # permission_handler_windows moves to <coroutine>.
          CL: /D_SILENCE_EXPERIMENTAL_COROUTINE_DEPRECATION_WARNINGS
        run: flutter build windows --release --dart-define=OV_CHANNEL=github

      - name: Package
        shell: pwsh
        run: |
          Compress-Archive -Path build/windows/x64/runner/Release/* `
            -DestinationPath OpenView-windows-x64.zip -Force

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: OpenView-windows-x64
          path: OpenView-windows-x64.zip
          if-no-files-found: error

  # ── macOS desktop ──────────────────────────────────────────────────────
  # The Xcode project uses Automatic signing with a DEVELOPMENT_TEAM, so a plain
  # `flutter build macos` on a runner fails ("No signing certificate 'Mac
  # Development' found"). We therefore configure with Flutter and build with
  # xcodebuild, overriding the signing settings on the command line (command-line
  # settings outrank the ones baked into project.pbxproj).
  #
  # The app is ad-hoc signed: it runs, but it is not notarized, so Gatekeeper
  # shows "Apple cannot check it for malicious software" on first launch and the
  # user must right-click → Open (or clear the quarantine bit). Developer ID
  # signing + notarization is a follow-up — the AC_CERTIFICATE / APPLE_* secrets
  # for it already exist in this repo.
  #
  # Built as a universal binary (x86_64 + arm64) so a single download runs on
  # both Intel and Apple Silicon Macs. The deployment target is 10.15, so Intel
  # support reaches back to Catalina.
  macos:
    name: macOS universal
    needs: version
    runs-on: macos-latest
    timeout-minutes: 90
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: ${{ env.FLUTTER_VERSION }}
          channel: stable
          cache: true

      - name: Install build tools (libserialport)
        run: brew install automake libtool

      - name: Flutter config & deps
        run: |
          flutter config --enable-macos-desktop
          flutter pub get

      - name: Build macOS release
        run: |
          # Generate the ephemeral xcconfig / plugin registrant without building.
          # The --dart-define is baked into Flutter-Generated.xcconfig here, so
          # the xcodebuild step below inherits it.
          flutter build macos --release --config-only \
            --dart-define=OV_CHANNEL=github

          # ARCHS + ONLY_ACTIVE_ARCH=NO force a universal (Intel + Apple Silicon)
          # binary; the pods (libserialport) build both slices from source.
          xcodebuild \
            -workspace macos/Runner.xcworkspace \
            -scheme Runner \
            -configuration Release \
            -derivedDataPath "$RUNNER_TEMP/dd" \
            ARCHS="x86_64 arm64" \
            ONLY_ACTIVE_ARCH=NO \
            CODE_SIGN_STYLE=Manual \
            CODE_SIGN_IDENTITY=- \
            PROVISIONING_PROFILE_SPECIFIER= \
            build

      - name: Package
        run: |
          app="$RUNNER_TEMP/dd/Build/Products/Release/OpenView.app"
          if [ ! -d "$app" ]; then
            echo "::error::OpenView.app not found at $app"
            find "$RUNNER_TEMP/dd/Build/Products" -maxdepth 3 -name '*.app' || true
            exit 1
          fi
          # Fail if the main binary is not actually universal.
          archs=$(lipo -archs "$app/Contents/MacOS/OpenView")
          echo "OpenView binary archs: $archs"
          for want in x86_64 arm64; do
            case " $archs " in
              *" $want "*) ;;
              *) echo "::error::macOS binary is missing the $want slice ($archs)"; exit 1 ;;
            esac
          done
          codesign --verify --strict --verbose=2 "$app"
          # ditto (not zip) preserves app-bundle metadata and symlinks.
          ditto -c -k --sequesterRsrc --keepParent "$app" OpenView-macos-universal.zip

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: OpenView-macos-universal
          path: OpenView-macos-universal.zip
          if-no-files-found: error

  # ── Publish GitHub Release (tags only) ─────────────────────────────────
  publish:
    name: Publish GitHub Release
    needs: [linux, linux-arm64, windows, macos]
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: release
          merge-multiple: true

      - name: Checksums
        working-directory: release
        run: |
          sha256sum ./*.zip | sed 's|\./||' | tee SHA256SUMS.txt

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          fail_on_unmatched_files: true
          files: |
            release/OpenView-linux-x64.zip
            release/OpenView-linux-arm64.zip
            release/OpenView-windows-x64.zip
            release/OpenView-macos-universal.zip
            release/SHA256SUMS.txt
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}