pr-validation.yml

name: "PR Validation (Feature -> Dev)"

on:
  pull_request:
    branches: [ "development" ]

jobs:
  build:
    name: Build for ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [windows-latest, macos-latest]

    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Cache Electron Binaries
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/electron
            ~/.cache/electron-builder
            ~/AppData/Local/electron/Cache
            ~/AppData/Local/electron-builder/Cache
          key: ${{ runner.os }}-electron-${{ hashFiles('package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-electron-

      - name: Install Dependencies
        shell: bash
        run: |
          for attempt in 1 2 3; do
            if npm ci; then
              exit 0
            fi

            if [ "$attempt" -eq 3 ]; then
              echo "npm ci failed after $attempt attempts"
              exit 1
            fi

            echo "npm ci failed on attempt $attempt. Retrying in 20 seconds..."
            sleep 20
          done

      - name: Verify Secrets Against .env.example
        env:
          SECRETS_JSON: ${{ toJson(secrets) }}
        run: |
          node -e '
          const fs = require("fs");
          const secrets = JSON.parse(process.env.SECRETS_JSON || "{}");
          const envExample = fs.readFileSync(".env.example", "utf-8");
          const missing = [];
          envExample.split("\n").forEach(line => {
            const trimmed = line.trim();
            if (trimmed && !trimmed.startsWith("#")) {
              const key = trimmed.split("=")[0];
              if (!secrets[key]) {
                missing.push(key);
              }
            }
          });
          if (missing.length > 0) {
            console.error(`::error::Missing required secrets in GitHub Actions: ${missing.join(", ")}`);
            process.exit(1);
          }
          '

      - name: Create .env file
        shell: bash
        env:
          SECRETS_JSON: ${{ toJson(secrets) }}
        run: |
          node <<'NODE'
          const fs = require("fs");
          const secrets = JSON.parse(process.env.SECRETS_JSON || "{}");
          const envExample = fs.readFileSync(".env.example", "utf-8");
          const missing = [];
          const output = [];

          envExample.split(/\r?\n/).forEach((line) => {
            const trimmed = line.trim();
            if (!trimmed || trimmed.startsWith("#")) {
              return;
            }

            const key = trimmed.split("=")[0].trim();
            if (!secrets[key]) {
              missing.push(key);
              return;
            }

            output.push(`${key}=${secrets[key]}`);
          });

          if (missing.length > 0) {
            console.error(`Missing required secrets in GitHub Actions: ${missing.join(", ")}`);
            process.exit(1);
          }

          fs.writeFileSync(".env", `${output.join("\n")}\n`);
          console.log(`.env file created successfully with ${output.length} entries`);
          NODE

      - name: Verify .env file
        run: |
          if [ ! -f .env ]; then
            echo "Error: .env file was not created"
            exit 1
          fi
          echo ".env file exists and contains $(wc -l < .env) lines"

      - name: Build macOS App
        if: matrix.os == 'macos-latest'
        run: npm run package:mac
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_IDENTITY_AUTO_DISCOVERY: false

      - name: Build Windows App + Microsoft Store Package
        if: matrix.os == 'windows-latest'
        run: npm run package:win:all
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_SKIP_SIGNING: true
          CSC_IDENTITY_AUTO_DISCOVERY: false

      - name: Check Build Output (macOS)
        if: matrix.os == 'macos-latest'
        run: |
          echo "Checking for build artifacts..."
          ls -la release/ || echo "Release directory not found"
          if [ -d "release" ]; then
            find release -type f -name "*.dmg" -o -name "*.zip" || echo "No DMG or ZIP files found"
          fi

      - name: Check Build Output (Windows)
        if: matrix.os == 'windows-latest'
        shell: bash
        run: |
          echo "Checking for build artifacts..."
          ls -la release/ || echo "Release directory not found"
          if [ -d "release" ]; then
            find release -type f \( -name "*.exe" -o -name "*.appx" \) || echo "No Windows EXE or APPX files found"
          fi

      - name: Upload macOS Artifacts
        if: matrix.os == 'macos-latest' && hashFiles('release/*.dmg') != '' || hashFiles('release/*.zip') != ''
        uses: actions/upload-artifact@v4
        with:
          name: build-${{ matrix.os }}
          path: |
            release/*.dmg
            release/*.zip
          retention-days: 3
          if-no-files-found: warn

      - name: Upload Windows Installer Artifact
        if: matrix.os == 'windows-latest' && hashFiles('release/*.exe') != ''
        uses: actions/upload-artifact@v4
        with:
          name: windows-installer-exe
          path: release/*.exe
          retention-days: 3
          if-no-files-found: warn

      - name: Upload Windows Store Artifact
        if: matrix.os == 'windows-latest' && hashFiles('release/*.appx') != ''
        uses: actions/upload-artifact@v4
        with:
          name: windows-store-appx
          path: release/*.appx
          retention-days: 3
          if-no-files-found: warn