develop-branch.yml

name: develop branch, build + lint + package + upload test release
on:
  push:
    branches: [ develop ]
    tags-ignore:
      - '*'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
permissions:
    actions: none
    artifact-metadata: none
    attestations: none
    checks: none
    contents: none # <==========
    deployments: none
    discussions: none
    id-token: none
    issues: none
    models: none
    packages: none
    pages: none
    pull-requests: none
    repository-projects: none
    security-events: none
    statuses: none

# https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#defaults
# Explicit workflow-level cache directive, honored by job/step-level 'actions/cache'.
# This GitHub Actions workflow has a trusted trigger via account-level ruleset.
# Note that this workflow disables 'actions/setup-node' automatic caching,
# instead 'actions/cache' is configured and invoked (restore point explicit, save via post-jobs hook)
# in order to enable caching of NPM packages and Electron binaries.
# The cache key is specific to this "continuous" integration and deployment (develop branch push) workflow, different from "PR" (pull request) and "release" (version tag push).
cache-mode: write

jobs:
  build_job:
    # environment:
    #   name: "Thorium Desktop Release"
    #   deployment: false
    timeout-minutes: 30
    permissions:
      actions: none
      artifact-metadata: none
      attestations: none
      checks: none
      contents: read # <==========
      deployments: none
      discussions: none
      id-token: none
      issues: none
      models: none
      packages: none
      pages: none
      pull-requests: none
      repository-projects: none
      security-events: none
      statuses: none
#   if: "!contains(toJSON(github.event.commits.*.message), '[skip-ci]')"
#   if: ${{ github.ref == 'refs/heads/develop' }}
#   if: "github.event_name != 'pull_request'"
    #
    # https://docs.github.com/en/actions/how-tos/manage-workflow-runs/skip-workflow-runs
    # [skip ci] is supported by default, not really needed here.
    # [skip cd] is a custom one we use to avoid triggering when pushing to the active branch (e.g. `develop`), when all we need is the subsequent release tag trigger (see release.yml)
    if: "!contains(github.event.head_commit.message, 'skip cd') && !contains(github.event.head_commit.message, 'skip ci') && github.ref_name == 'develop' && github.repository_owner == 'edrlab' && github.repository == 'edrlab/thorium-reader'"
    runs-on: ${{ matrix.runson }}
    strategy:
      fail-fast: false
      matrix:
        osarch: [windows-intel, windows-arm, macos-intel, macos-arm, linux-intel, linux-arm]
        # osarch: [windows-intel, windows-arm]
# Thorium for MacOS x64 and arm64 is built on GitHub Actions arm64 runners
# Thorium for Linux x64 and arm64 is built on GitHub Actions x64 runners
# Thorium for Windows x64 and arm64 is built on GitHub Actions x64 runners
# To ensure arm64, the trick is:
#       npm ci --ignore-scripts --foreground-scripts --allow-git=root --cpu=arm64
#       Replace "x64" with "arm64" in `package.json` (and optionally the electron-builder `src/package.json`, if needed)
# To ensure x64, the trick is:
#       npm ci --ignore-scripts --foreground-scripts --allow-git=root --cpu=x64
#       `package.json` already specifies "x64"
# windows-latest is currently windows-2022, but becomes windows-2025 in September 2025 (windows-2022 remains supported for 3 years)
#       https://github.com/actions/runner-images/blob/main/images/windows/Windows2022-Readme.md
# windows-2025 is beta / public preview
#       https://github.com/actions/runner-images/issues/11228
# ah, windows-2025 / windows-2025-vs2026 now on Visual Studio 2026 (was 2022)
#       https://github.com/actions/runner-images/blob/main/images/windows/Windows2025-Readme.md
# windows-11-preview_aarch64 ?
#       https://github.com/actions/partner-runner-images/issues/19#issuecomment-2569992032
# macos-latest is currently macos-14-arm64
#       https://github.com/actions/runner-images/blob/main/images/macos/macos-14-arm64-Readme.md
# macos-15-arm64 is beta / public preview
#       https://github.com/actions/runner-images/blob/main/images/macos/macos-15-arm64-Readme.md
# ubuntu-latest is ubuntu-24.04
#       https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md
# ubuntu-20.04 is the oldest available (good for glibc compat) ... but GitHub says "The Ubuntu 20.04 runner image will be fully unsupported by April 1, 2025"
#       https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2004-Readme.md
        include:
          - osarch: windows-intel
            runson: windows-2025
            packname: win
            release_tag: latest-windows-intel
            os: windows
            arch: intel

          - osarch: windows-arm
            runson: windows-11-vs2026-arm # win11-vs2026-arm64 # https://github.com/actions/runner-images/blob/main/images/windows/Windows11-VS2026-Arm64-Readme.md
            packname: win
            release_tag: latest-windows-arm
            os: windows
            arch: arm

          - osarch: macos-intel
            runson: macos-latest #macos-14-arm64
            packname: 'mac:skip-notarize'
            release_tag: latest-macos-intel
            os: macos
            arch: intel

          - osarch: macos-arm
            runson: macos-latest #macos-14-arm64
            packname: 'mac:skip-notarize'
            release_tag: latest-macos-arm
            os: macos
            arch: arm

          - osarch: linux-intel
            runson: ubuntu-22.04 #ubuntu-latest is ubuntu-24.04
            packname: linux
            release_tag: latest-linux-intel
            os: linux
            arch: intel

          - osarch: linux-arm
            runson: ubuntu-22.04-arm #ubuntu-latest is ubuntu-24.04
            packname: linux
            release_tag: latest-linux-arm
            os: linux
            arch: arm
    env:
      RELEASE_TAG: ${{ matrix.release_tag }} # MUST keep for WebPack config, detection of CI build
    steps:
###########################
    - name: Checking graceful shell command failure
      run: |-
        pwdx || echo OK || true
      shell: cmd
      continue-on-error: true
###########################
    - name: Microsoft Windows Visual Studio lookup
      if: startsWith(matrix.osarch, 'windows-')
      run: >
        dir /A "C:\Program Files\Microsoft Visual Studio" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.51.36231" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.51.36231\bin" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.51.36231\bin\Hostx64" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.51.36231\bin\Hostx64\x64" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.51.36231\bin\HostArm64" &&
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.51.36231\bin\HostArm64\arm64"
      shell: cmd
###########################
    - name: Microsoft Windows dumpbin to PATH (ARM)
      #if: startsWith(matrix.osarch, 'windows-')
      if: ${{ matrix.osarch == 'windows-arm' }}
      run: >
        $VS_ROOT = "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC";
        Get-ChildItem -Path $VS_ROOT -Force;
        $VS_VERSION = (Get-ChildItem -Path $VS_ROOT | Sort-Object Name -Descending | Select-Object -First 1).Name;
        $VS_BIN = "$VS_ROOT\$VS_VERSION\bin\HostArm64\arm64";
        echo $VS_BIN >> $env:GITHUB_PATH;
        echo $VS_BIN
      shell: powershell
###########################
    - name: Microsoft Windows dumpbin to PATH (INTEL)
      #if: startsWith(matrix.osarch, 'windows-')
      if: ${{ matrix.osarch == 'windows-intel' }}
      run: >
        $VS_ROOT = "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC";
        Get-ChildItem -Path $VS_ROOT -Force;
        $VS_VERSION = (Get-ChildItem -Path $VS_ROOT | Sort-Object Name -Descending | Select-Object -First 1).Name;
        $VS_BIN = "$VS_ROOT\$VS_VERSION\bin\Hostx64\x64";
        echo $VS_BIN >> $env:GITHUB_PATH;
        echo $VS_BIN
      shell: powershell
###########################
    - name: Microsoft Windows dumpbin check (ARM)
      #if: startsWith(matrix.osarch, 'windows-')
      if: ${{ matrix.osarch == 'windows-arm' }}
      run: >
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC" &&
        dumpbin /headers "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.51.36231\bin\HostArm64\arm64\dumpbin.exe" | findstr /i machine
      shell: cmd
###########################
    - name: Microsoft Windows dumpbin check (INTEL)
      #if: startsWith(matrix.osarch, 'windows-')
      if: ${{ matrix.osarch == 'windows-intel' }}
      run: >
        dir /A "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC" &&
        dumpbin /headers "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.51.36231\bin\Hostx64\x64\dumpbin.exe" | findstr /i machine
      shell: cmd
###########################
# - name: Microsoft Windows msbuild to PATH
#   if: startsWith(matrix.osarch, 'windows-')
#   uses: microsoft/setup-msbuild@v2
# "C:\Program Files\Microsoft Visual Studio\18\Enterprise\MSBuild\Current\Bin"
# "C:\Program Files\Microsoft Visual Studio\18\Enterprise\Common7\Tools"
# "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\bin\amd64"
# "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.29.30133\bin\Hostx64\x64"
# "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.44.35207\bin\Hostx64\x64"
# "C:\Program Files\Microsoft Visual Studio\18\Enterprise\VC\Tools\MSVC\14.51.36231\bin\Hostx64\x64"
    #- run: exit 1
#    - run: echo 'RELEASE_TAG:' ${{ env.RELEASE_TAG }}
#    - run: 'echo "GITHUB_RUN_NUMBER: ${{ github.run_number }}"'
#    - run: 'echo "GITHUB_RUN_ID: ${{ github.run_id }}"'
#    - run: 'echo "GITHUB_SHA: ${{ github.sha }}"'
###########################
    - run: echo "${{ matrix.osarch }} // ${{ runner.arch }}"
###########################
    - name: System arch (non Windows)
      #if: ${{ matrix.osarch != 'windows-intel' && matrix.osarch != 'windows-arm' }}
      if: ${{ !startsWith(matrix.osarch, 'windows-') }}
      run: uname -m && arch
###########################
    - name: Checkout
# https://github.com/actions/checkout/commits/v7.0.1
# https://github.com/actions/checkout/commits/3d3c42e5aac5ba805825da76410c181273ba90b1
# https://github.com/actions/checkout/compare/v7.0.1...3d3c42e5aac5ba805825da76410c181273ba90b1
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      with:
        persist-credentials: false
    # - name: Git config global dump (pre)
    #   run: 'git config --global --list || echo NO_GIT_GLOBAL_CONFIG || true'
    #   shell: bash
    # - name: Git config local dump (pre)
    #   run: 'git config --list || echo NO_GIT_GLOBAL_CONFIG || true'
    #   shell: bash
    # - name: git HTTP authentication instead SSH (NPM >=7) 1
    #   run: >
    #     git config --global url."https://github.com/".insteadOf ssh://git@github.com/
    #   shell: bash
    # - name: git HTTP authentication instead SSH (NPM >=7) 2
    #   run: >
    #     git config --global url."https://github.com".insteadOf ssh://git@github.com
    #   shell: bash
    # - name: git HTTP authentication instead SSH (NPM >=7) 3
    #   run: >
    #     git config --global url."http://github.com/".insteadOf git@github.com:
    #   shell: bash
    # - name: git HTTP authentication instead SSH (NPM >=7) 4
    #   run: >
    #     git config --global url."http://".insteadOf git://
    #   shell: bash
#    - name: Git config global dump (post)
#      run: 'git config --global --list || echo NO_GIT_GLOBAL_CONFIG || true'
#      shell: bash
#    - name: Git config local dump (post)
#      run: 'git config --list || echo NO_GIT_GLOBAL_CONFIG || true'
#      shell: bash
###########################
# https://github.com/actions/setup-node/commits/v7.0.0
# https://github.com/actions/setup-node/commits/820762786026740c76f36085b0efc47a31fe5020
# https://github.com/actions/setup-node/compare/v7.0.0...820762786026740c76f36085b0efc47a31fe5020
    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
# https://github.com/actions/setup-node#caching-global-packages-data
# https://github.com/actions/setup-node/blob/main/docs/advanced-usage.md#caching-packages-data
# https://github.com/actions/cache/blob/main/examples.md#node---npm
# https://github.com/actions/setup-node/issues/1553#issuecomment-4750595425
      with:
        node-version: '24'
        package-manager-cache: false
        cache: ''
#        cache: 'npm'
#        node-version-file: package.json
#        package-manager-cache: true
#        cache-dependency-path: 'package-lock.json'
        #check-latest: true
###########################
    - run: node --version && npm --version
###########################
    - run: npm --global install npm
###########################
    - run: npm --version && npm config get cache
###########################
# ###########################
#     - name: Checks LIBs
#       run: >
#         openssl enc -d -aes-256-cbc -salt -pbkdf2 -A -pass pass:"${{ env.LIB_PASS }}" -in .github_release/LIB/${{ matrix.os }}/${{ matrix.arch }}/lib -out .github_release/LIB/${{ matrix.os }}/${{ matrix.arch }}/lcp.node &&
#         ls -als .github_release/LIB/${{ matrix.os }}/${{ matrix.arch }}/ &&
#         node .github_release/LIB/checksum.js .github_release/LIB/${{ matrix.os }}/${{ matrix.arch }}/lcp.node &&
#         rm .github_release/LIB/${{ matrix.os }}/${{ matrix.arch }}/lcp.node
#       shell: bash
#       env:
#         LIB_PASS: ${{ secrets.S14 }}
# ############################################
#     - name: forced EXIT
#       run: exit 1 && false
#       shell: bash
#       continue-on-error: false
# ###########################
###########################
    - name: Get NPM cache
      id: npm-config-get-cache
      run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}
      shell: bash
      # run: echo "dir=$(npm config get cache)" >> ${env:GITHUB_OUTPUT}
      # shell: pwsh
###########################
# https://github.com/actions/cache/commits/v6.1.0
# https://github.com/actions/cache/commits/55cc8345863c7cc4c66a329aec7e433d2d1c52a9
# https://github.com/actions/cache/compare/v6.1.0...55cc8345863c7cc4c66a329aec7e433d2d1c52a9
    - name: Action Cache
      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
      id: action-cache
      with:
        path: ${{ steps.npm-config-get-cache.outputs.dir }}
        key: npm-electron-cache-continuous-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('package-lock.json') }}
        restore-keys: |
          npm-electron-cache-continuous-${{ runner.os }}-${{ runner.arch }}-
###########################
    - name: NPM Cache NOT HIT
      run: echo "NPM Cache NOT HIT - not restored at all, or restored with restore-keys instead of primary key"
      if: steps.action-cache.outputs.cache-hit != 'true'
###########################
    - name: NPM Cache HIT
      run: echo "NPM Cache HIT - restored with primary key"
      if: steps.action-cache.outputs.cache-hit == 'true'
###########################
    - run: ls -als "$(npm config get cache)"
      shell: bash
###########################
    - run: npm cache verify
###########################
    - run: python --version || echo ok || true
###########################
    - run: python3 --version || echo ok || true
###########################
    - run: pip --version || echo ok || true
###########################
    # PYTHON 3.12 distutils deprecation remediation:
    #- run: python3 -m pip install packaging || python -m pip install packaging
    - run: python3 -m pip install setuptools || python -m pip install setuptools
###########################
    # - run: npm --global install asar
###########################
    - name: package patch 1
      run: >
        node scripts/package-ci-patch.js package.json ${{ github.run_id }} &&
        cat package.json | grep -i VERSION &&
        cat package.json
      shell: bash
###########################
    - name: package patch 2
      run: >
        node scripts/package-ci-patch.js src/package.json ${{ github.run_id }} &&
        cat src/package.json | grep -i VERSION &&
        cat src/package.json
      shell: bash
###########################
# - name: package lock patch
#   run: node scripts/package-lock-patch.js && cat package-lock.json | grep -i divina-player-js
#   shell: bash
###########################
    - run: git --no-pager diff
###########################
#    - run: npm cache clean --force
###########################
#    - run: npm cache verify
###########################
# - run: cat package-lock.json | grep -i divina-player-js
###########################
    - name: NPM install (arm64)
      #if: ${{ matrix.osarch == 'linux-arm' || matrix.osarch == 'windows-arm' || matrix.osarch == 'macos-arm' }}
      if: endsWith(matrix.osarch, '-arm')
      #(ls -alsR ~/.cache/electron/ || ls -alsR ~/Library/Caches/electron/ || ls -alsR ~/AppData/Local/electron/Cache/ || echo OK)
      run: >
        npm ci --ignore-scripts --foreground-scripts --allow-git=root --cpu=arm64 &&
        cd node_modules/electron &&
        DEBUG=@electron/get* force_no_cache=false electron_config_cache="$(npm config get cache)" npm_config_arch=arm64 ELECTRON_INSTALL_ARCH=arm64 node install.js --cpu=arm64 &&
        cd -
      shell: bash
      #export npm_config_arch=arm64 && export npm_config_cpu=arm64 &&
###########################
    - name: NPM install (x64)
      #if: ${{ matrix.osarch == 'linux-intel' || matrix.osarch == 'windows-intel' || matrix.osarch == 'macos-intel' }}
      if: endsWith(matrix.osarch, '-intel')
      #(ls -alsR ~/.cache/electron/ || ls -alsR ~/Library/Caches/electron/ || ls -alsR ~/AppData/Local/electron/Cache/ || echo OK)
      run: >
        npm ci --ignore-scripts --foreground-scripts --allow-git=root --cpu=x64 &&
        cd node_modules/electron &&
        DEBUG=@electron/get* force_no_cache=false electron_config_cache="$(npm config get cache)" npm_config_arch=x64 ELECTRON_INSTALL_ARCH=x64 node install.js --cpu=x64 &&
        cd -
      shell: bash
      #export npm_config_arch=x64 && export npm_config_cpu=x64 &&
###########################
#    - run: npm cache verify
###########################
    - name: Electron version + arch (Windows)
      #if: ${{ matrix.osarch == 'windows-intel' || matrix.osarch == 'windows-arm' }}
      if: startsWith(matrix.osarch, 'windows-')
      run: >
        (dumpbin /headers "node_modules\electron\dist\electron.exe" | findstr /i machine) &&
        (node_modules\\electron\\dist\\electron.exe --no-sandbox --version || echo INVALID_ARCH || true) &&
        (node_modules\\electron\\dist\\electron.exe --no-sandbox --abi || echo INVALID_ARCH || true)
      shell: cmd
      continue-on-error: true
###########################
    - name: Electron version + arch (Linux)
      #if: ${{ matrix.osarch == 'linux-intel' || matrix.osarch == 'linux-arm' }}
      if: startsWith(matrix.osarch, 'linux-')
      run: >
        pwd && (ls -alsR node_modules/electron) &&
        (file node_modules/electron/dist/electron) &&
        (node_modules/electron/dist/electron --no-sandbox --version || echo INVALID_ARCH || true) &&
        (node_modules/electron/dist/electron --no-sandbox --abi || echo INVALID_ARCH || true)
###########################
    - name: Electron version + arch (MacOS)
      #if: ${{ matrix.osarch == 'macos-intel' || matrix.osarch == 'macos-arm' }}
      if: startsWith(matrix.osarch, 'macos-')
      run: >
        pwd &&
        (ls -alsR node_modules/electron) &&
        (file node_modules/electron/dist/Electron.app/Contents/MacOS/Electron) &&
        (node_modules/electron/dist/Electron.app/Contents/MacOS/Electron --no-sandbox --version || echo INVALID_ARCH || true) &&
        (node_modules/electron/dist/Electron.app/Contents/MacOS/Electron --no-sandbox --abi || echo INVALID_ARCH || true)
###########################
    - run: npm list -g node-gyp || echo ok || true
###########################
    - run: npm list node-gyp || echo ok || true
###########################
    - run: >
        node -e '
        const path = require("path");
        const fs = require("fs");
        const filePath = path.join(process.cwd(), "package.json");
        let fileStr = fs.readFileSync(filePath, { encoding: "utf8" });
        fileStr = fileStr.replace(/"sign": true,/g, `"sign": false,`);
        fileStr = fileStr.replace(/"hardenedRuntime": true,/g, `"hardenedRuntime": false, "identity": null,`);
        fs.writeFileSync(filePath, fileStr, { encoding: "utf8" });
        '
      continue-on-error: true
###########################
    - name: non-PR action (build and package) ARM
      env:
        USE_HARD_LINKS: 'false' # Electron Builder workaround
      #if: ${{ matrix.osarch == 'linux-arm' || matrix.osarch == 'windows-arm' || matrix.osarch == 'macos-arm' }}
      if: ${{ endsWith(matrix.osarch, '-arm') }}
      #run: sed 's/--x64/--arm64/g' ./package.json > ./package.json.new && mv ./package.json.new ./package.json && npm run package:${{ matrix.packname }} && sed 's/--arm64/--x64/g' ./package.json > ./package.json.new && mv ./package.json.new ./package.json
      run: >
        node -e '
        const path = require("path");
        const fs = require("fs");
        const filePath = path.join(process.cwd(), "package.json");
        let fileStr = fs.readFileSync(filePath, { encoding: "utf8" });
        fileStr = fileStr.replace(/--x64/g, "--arm64");
        fs.writeFileSync(filePath, fileStr, { encoding: "utf8" });
        ' &&
        npm run package:${{ matrix.packname }}
###########################
    - name: non-PR action (build and package) INTEL
      env:
          USE_HARD_LINKS: 'false' # Electron Builder workaround
      #if: ${{ matrix.osarch == 'linux-intel' || matrix.osarch == 'windows-intel' || matrix.osarch == 'macos-intel' }}
      if: ${{ endsWith(matrix.osarch, '-intel') }}
      run: >
        node -e '
        const path = require("path");
        const fs = require("fs");
        const filePath = path.join(process.cwd(), "package.json");
        let fileStr = fs.readFileSync(filePath, { encoding: "utf8" });
        fileStr = fileStr.replace(/--arm64/g, "--x64");
        fs.writeFileSync(filePath, fileStr, { encoding: "utf8" });
        ' &&
        npm run package:${{ matrix.packname }}
#- run: ls -alsR release
###########################
    - name: Upload Artifact (Linux)
      #if: ${{ matrix.osarch == 'linux-intel' || matrix.osarch == 'linux-arm' }}
      if: startsWith(matrix.osarch, 'linux-')
# https://github.com/actions/upload-artifact/commits/v7.0.1
# https://github.com/actions/upload-artifact/commits/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
# https://github.com/actions/upload-artifact/compare/v7.0.1...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
      with:
        name: artifact-${{ matrix.release_tag }}-${{ github.run_id }}
        retention-days: 1
        compression-level: 0
        overwrite: false
        include-hidden-files: false
        archive: true
        path: |
          release/*.deb
          release/*.AppImage
        if-no-files-found: error
###########################
    - name: Upload Artifact (MacOS)
      #if: ${{ matrix.osarch == 'macos-intel' || matrix.osarch == 'macos-arm' }}
      if: startsWith(matrix.osarch, 'macos-')
# https://github.com/actions/upload-artifact/commits/v7.0.1
# https://github.com/actions/upload-artifact/commits/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
# https://github.com/actions/upload-artifact/compare/v7.0.1...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
      with:
        name: artifact-${{ matrix.release_tag }}-${{ github.run_id }}
        retention-days: 1
        compression-level: 0
        overwrite: false
        include-hidden-files: false
        archive: true
        path: |
          release/*.dmg
          !release/*.app
        if-no-files-found: error
###########################
# - name: Rename Windows ARM64 .exe
#   # if: startsWith(matrix.osarch, 'windows-') && endsWith(matrix.osarch, '-arm') # runner.os == 'Windows'
#   if: ${{ matrix.osarch == 'windows-arm' }}
#   run: >
#     cd release &&
#     ls -als &&
#     (for filename in *.exe ; do mv "$filename" "${filename%.*}-arm64.${filename##*.}" ; done) &&
#     ls -als &&
#     cd -
#   shell: bash
###########################
    - name: Upload Artifact (Windows)
      #if: ${{ matrix.osarch == 'windows-intel' || matrix.osarch == 'windows-arm' }}
      if: startsWith(matrix.osarch, 'windows-')
# https://github.com/actions/upload-artifact/commits/v7.0.1
# https://github.com/actions/upload-artifact/commits/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
# https://github.com/actions/upload-artifact/compare/v7.0.1...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
      with:
        name: artifact-${{ matrix.release_tag }}-${{ github.run_id }}
        retention-days: 1
        compression-level: 0
        overwrite: false
        include-hidden-files: false
        archive: true
        path: |
          release/*.exe
          !release/*.appx
        if-no-files-found: error
###########################
    #
    #
    #
    #
    #
    #
    #
    #
    #
    #
###########################
  release_job:
    needs: build_job
    timeout-minutes: 20
    permissions:
      actions: none
      artifact-metadata: none
      attestations: none
      checks: none
      contents: write # <==========
      deployments: none
      discussions: none
      id-token: none
      issues: none
      models: none
      packages: none
      pages: none
      pull-requests: none
      repository-projects: none
      security-events: none
      statuses: none
#   if: "!contains(toJSON(github.event.commits.*.message), '[skip-ci]')"
#   if: ${{ github.ref == 'refs/heads/develop' }}
#   if: "github.event_name != 'pull_request'"
    #
    # https://docs.github.com/en/actions/how-tos/manage-workflow-runs/skip-workflow-runs
    # [skip ci] is supported by default, not really needed here.
    # [skip cd] is a custom one we use to avoid triggering when pushing to the active branch (e.g. `develop`), when all we need is the subsequent release tag trigger (see `./release.yml`)
    if: "!contains(github.event.head_commit.message, 'skip cd') && !contains(github.event.head_commit.message, 'skip ci') && github.ref_name == 'develop' && github.repository_owner == 'edrlab' && github.repository == 'edrlab/thorium-reader'"
    runs-on: ${{ matrix.runson }}
    strategy:
      fail-fast: false
      matrix:
        osarch: [windows-intel, windows-arm, macos-intel, macos-arm, linux-intel, linux-arm]
        include:
          - osarch: windows-intel
            runson: ubuntu-latest # windows-2025
            packname: win
            release_tag: latest-windows-intel
          - osarch: windows-arm
            runson: ubuntu-latest # windows-2025
            packname: win
            release_tag: latest-windows-arm
          - osarch: macos-intel
            runson: ubuntu-latest # macos-latest #macos-14-arm64
            packname: 'mac:skip-notarize'
            release_tag: latest-macos-intel
          - osarch: macos-arm
            runson: ubuntu-latest # macos-latest #macos-14-arm64
            packname: 'mac:skip-notarize'
            release_tag: latest-macos-arm
          - osarch: linux-intel
            runson: ubuntu-latest # ubuntu-22.04 #ubuntu-latest is ubuntu-24.04
            packname: linux
            release_tag: latest-linux-intel
          - osarch: linux-arm
            runson: ubuntu-latest # ubuntu-22.04 #ubuntu-latest is ubuntu-24.04
            packname: linux
            release_tag: latest-linux-arm
    steps:
###########################
    - name: Checkout
# https://github.com/actions/checkout/commits/v7.0.1
# https://github.com/actions/checkout/commits/3d3c42e5aac5ba805825da76410c181273ba90b1
# https://github.com/actions/checkout/compare/v7.0.1...3d3c42e5aac5ba805825da76410c181273ba90b1
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      with:
        persist-credentials: false
###########################
    - name: Download Artifact
# https://github.com/actions/download-artifact/commits/v8.0.1
# https://github.com/actions/download-artifact/commits/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
# https://github.com/actions/download-artifact/compare/v8.0.1...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
      with:
        name: artifact-${{ matrix.release_tag }}-${{ github.run_id }}
#        artifact-ids: artifact-latest-linux-arm-${{ github.run_id }},artifact-latest-windows-arm-${{ github.run_id }},artifact-latest-macos-arm-${{ github.run_id }},artifact-latest-linux-intel-${{ github.run_id }},artifact-latest-windows-intel-${{ github.run_id }},artifact-latest-macos-intel-${{ github.run_id }}
#        merge-multiple: true
        path: release
###########################
    - name: GitHub Tagged Release Delete/ReCreate and Upload Build Artefacts
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: >
        ls -alsR release ;
        (gh release delete ${{ matrix.release_tag }} --cleanup-tag --yes || echo OK || true) ;
        gh release create ${{ matrix.release_tag }} --target=develop --latest=false --prerelease --title="${{ matrix.release_tag }} automated test build" --notes="Expand the 'Assets' below to reveal the download links (build job: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})" "./release/*.*"