release.yml

name: Release

# Triggered by pushing a version tag (e.g. v0.2.0).
# The release.sh script creates these tags.
#
# This workflow builds signed installers for all platforms, creates a
# GitHub Release with the artifacts attached, and generates build
# attestations via OIDC for supply-chain verification.
#
# Code signing:
#   - macOS: ad-hoc signing (replace with Apple Developer ID when available)
#   - Windows: unsigned (add Authenticode signing when certificate available)

on:
  push:
    tags:
      - 'v*'

env:
  NODE_VERSION: 20

jobs:
  # ── 1. Build the extension host (platform-agnostic TypeScript) ──
  build-extension-host:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
          cache-dependency-path: extension-host/package-lock.json

      - name: Build extension host
        run: |
          cd extension-host
          npm ci
          npm run build

      - name: Upload extension-host dist
        uses: actions/upload-artifact@v4
        with:
          name: extension-host-dist
          path: extension-host/dist/**
          if-no-files-found: error

  # ── 2. Build Tauri app for each platform ──
  release:
    needs: [build-extension-host]
    permissions:
      contents: write
      id-token: write
      attestations: write
    environment: release
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: 'macos-latest'
            target: 'aarch64-apple-darwin'
            args: '--target aarch64-apple-darwin'
          - platform: 'ubuntu-22.04'
            target: 'x86_64-unknown-linux-gnu'
            args: ''
          - platform: 'ubuntu-24.04-arm'
            target: 'aarch64-unknown-linux-gnu'
            args: ''
          - platform: 'windows-latest'
            target: 'x86_64-pc-windows-msvc'
            # jemalloc (tikv-jemalloc-sys) does not build on Windows
            args: '-- --no-default-features'

    runs-on: ${{ matrix.platform }}

    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      # Work around dtolnay/rust-toolchain@stable bug on Windows where
      # an internal grep step exits with code 1 due to bash -e.
      # Rust is pre-installed on GitHub Actions runners, so this is safe.
      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        continue-on-error: ${{ matrix.platform == 'windows-latest' }}
        with:
          targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin' || '' }}

      - name: Verify Rust installation
        if: matrix.platform == 'windows-latest'
        run: |
          rustc --version
          cargo --version
        shell: bash

      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}

      - name: Install Tauri dependencies (Ubuntu)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev build-essential curl wget file libssl-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev

      - name: Install frontend dependencies
        run: npm ci

      - name: Download extension-host dist
        uses: actions/download-artifact@v4
        with:
          name: extension-host-dist
          path: extension-host/dist

      - name: Download Node.js for external binary
        run: bash ./scripts/download-node.sh --all

      # Ad-hoc codesigning on macOS prevents "damaged" Gatekeeper errors
      # on Apple Silicon. Will be replaced with proper Developer ID signing
      # once an Apple Developer account is available.
      #
      # To enable proper macOS signing, set these secrets:
      #   APPLE_CERTIFICATE: Base64-encoded .p12 certificate
      #   APPLE_CERTIFICATE_PASSWORD: Certificate password
      #   APPLE_SIGNING_IDENTITY: Developer ID Application identity
      #   APPLE_ID: Apple ID for notarization
      #   APPLE_PASSWORD: App-specific password for notarization
      #   APPLE_TEAM_ID: Apple Developer Team ID
      - name: Build Tauri app
        id: build-tauri
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CODESIGN_IDENTITY: ${{ matrix.platform == 'macos-latest' && '-' || '' }}
        with:
          tagName: ${{ github.ref_name }}
          releaseName: 'DSCode ${{ github.ref_name }}'
          releaseBody: 'See the [CHANGELOG](https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md) for full details.'
          releaseDraft: false
          prerelease: ${{ contains(github.ref_name, '-rc') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha') }}
          args: ${{ matrix.args }}

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: ${{ join(fromJSON(steps.build-tauri.outputs.artifactPaths), ',') }}

      # ── Create portable archives for npm/PyPI wrapper packages ──
      - name: Create portable archive (macOS)
        if: startsWith(matrix.platform, 'macos')
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          ARCH="arm64"
          # Tauri v2 places target-specific bundles under target/<target>/release/bundle/
          BUNDLE_DIR="target/aarch64-apple-darwin/release/bundle"
          APP_PATH="${BUNDLE_DIR}/macos/DSCode.app"
          if [ -d "$APP_PATH" ]; then
            tar czf "DSCode-darwin-${ARCH}-${VERSION}.tar.gz" -C "${BUNDLE_DIR}/macos" DSCode.app
            echo "Created DSCode-darwin-${ARCH}-${VERSION}.tar.gz"
          else
            echo "WARNING: DSCode.app not found at $APP_PATH"
          fi

      - name: Create portable archive (Windows)
        if: matrix.platform == 'windows-latest'
        shell: powershell
        run: |
          $version = $env:GITHUB_REF_NAME -replace '^v',''
          $releaseDir = "src-tauri/target/release"
          $dest = "DSCode-win32-x64-${version}.zip"
          if (Test-Path $releaseDir) {
            # Exclude debug symbols and build artifacts
            $files = Get-ChildItem -Path $releaseDir -Exclude "*.pdb","*.lib","*.exp","*.ilk","*.d","build","deps",".fingerprint","incremental",".cargo-lock","examples"
            $files = $files | Where-Object { $_.Name -notmatch '^\.' }
            Compress-Archive -Path $files.FullName -DestinationPath $dest -Force
            Write-Host "Created $dest"
          } else {
            Write-Host "WARNING: Release directory not found at $releaseDir"
          }

      - name: Create portable archive (Linux)
        if: runner.os == 'Linux'
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          ARCH="${{ matrix.target == 'aarch64-unknown-linux-gnu' && 'arm64' || 'x64' }}"
          SRC_DIR="src-tauri/target/release/bundle/appimage"
          if [ -d "$SRC_DIR" ]; then
            # Find the AppImage (Tauri names it e.g. DSCode_0.2.0_amd64.AppImage)
            APPIMAGE=$(find "$SRC_DIR" -maxdepth 1 -name "*.AppImage" | head -n1)
            if [ -n "$APPIMAGE" ]; then
              cp "$APPIMAGE" "DSCode-linux-${ARCH}-${VERSION}.AppImage"
              echo "Created DSCode-linux-${ARCH}-${VERSION}.AppImage"
            else
              echo "WARNING: No AppImage found in $SRC_DIR"
            fi
          else
            echo "WARNING: AppImage directory not found at $SRC_DIR"
          fi

      - name: Upload portable archives to release
        if: startsWith(matrix.platform, 'macos') || matrix.platform == 'windows-latest' || runner.os == 'Linux'
        uses: softprops/action-gh-release@v2
        with:
          files: |
            DSCode-darwin-*.tar.gz
            DSCode-win32-*.zip
            DSCode-linux-*.AppImage
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}