release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: 'windows-latest'
            rust-targets: 'x86_64-pc-windows-msvc'
            tauri-args: ''
          # Only Apple Silicon (M-series).
          - platform: 'macos-latest'
            rust-targets: 'aarch64-apple-darwin'
            tauri-args: '--target aarch64-apple-darwin'
          - platform: 'ubuntu-latest'
            rust-targets: 'x86_64-unknown-linux-gnu'
            tauri-args: ''

    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v4

      - name: Install Linux deps
        if: matrix.platform == 'ubuntu-latest'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            build-essential \
            curl wget file \
            libxdo-dev \
            libssl-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev

      - name: Setup Rust (stable + targets + wasm32)
        shell: bash
        run: |
          for attempt in 1 2 3; do
            rustup update stable --no-self-update && break
            echo "rustup update attempt $attempt failed, retrying in 10s..." >&2
            sleep 10
          done
          rustup default stable
          for attempt in 1 2 3; do
            rustup target add ${{ matrix.rust-targets }} wasm32-unknown-unknown && break
            echo "target add attempt $attempt failed, retrying in 10s..." >&2
            sleep 10
          done
          rustc --version

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: '. -> target'
          key: ${{ matrix.platform }}

      - name: Install wasm-pack
        uses: jetli/wasm-pack-action@v0.4.0
        with:
          version: 'latest'

      - uses: pnpm/action-setup@v4
        with:
          version: 10

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile=false
      # crates/lgs-wasm/pkg/ is generated here and embedded by preview.rs via
      # include_dir!() — must run before any cargo command.
      - run: pnpm wasm:build
      - run: pnpm --filter ui build

      # The git tag is the source of truth for the release version.
      # Writing it into tauri.conf.json ensures tauri-action produces artefacts
      # named `Stake.Dev.Tool_<tag>_...` — otherwise a forgotten bump in the
      # config file silently desyncs asset names from the rename/manifest
      # rules and ships a broken updater for Windows/Linux.
      - name: Sync tauri.conf.json version to tag
        shell: bash
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          node -e "
            const fs = require('fs');
            const p = 'crates/desktop/tauri.conf.json';
            const c = JSON.parse(fs.readFileSync(p, 'utf8'));
            c.version = '${VERSION}';
            fs.writeFileSync(p, JSON.stringify(c, null, 2) + '\n');
          "
          echo "tauri.conf.json version set to ${VERSION}"

      - name: Build + sign Tauri app
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Required for signed updater artefacts.
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          tagName: ${{ github.ref_name }}
          releaseName: 'Stake Dev Tool ${{ github.ref_name }}'
          releaseBody: 'See the [changelog](https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md) for details.'
          releaseDraft: true
          prerelease: false
          projectPath: .
          args: --config crates/desktop/tauri.conf.json ${{ matrix.tauri-args }}

  # Rename Tauri's auto-generated asset names to a clean, consistent scheme
  # before generating the manifest. Tauri produces inconsistent names like
  # `Stake.Dev.Tool_0.3.0_x64-setup.exe` and `Stake.Dev.Tool_aarch64.app.tar.gz`
  # (dots in product name, mixed `x64`/`amd64`, missing version on macOS).
  # We standardize on: `Stake-Dev-Tool-vX.Y.Z-{windows,macos,linux}-{x64,arm64}.<ext>`.
  rename:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Rename release assets to a clean, consistent scheme
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ github.ref_name }}
          REPO: ${{ github.repository }}
        run: |
          set -euo pipefail
          VERSION="${TAG#v}"

          # `gh release view --json assets` doesn't expose the numeric asset
          # `id` directly, but `apiUrl` ends with it. Extract it via parameter
          # expansion (`${var##*/}` keeps everything after the last slash).
          gh release view "$TAG" --repo "$REPO" --json assets \
            --jq '.assets[] | "\(.apiUrl)\t\(.name)"' > assets.tsv

          # Match any `_X.Y.Z_` segment rather than the exact tag version, so a
          # drift between tauri.conf.json and the git tag (which we now guard
          # against in the build job anyway) can't silently break the rename
          # and leave the updater manifest incomplete.
          rename_rule() {
            echo "$1" | sed -E "
              s/^Stake\.Dev\.Tool_[0-9]+\.[0-9]+\.[0-9]+_x64-setup\.exe$/Stake-Dev-Tool-v${VERSION}-windows-x64.exe/;
              s/^Stake\.Dev\.Tool_[0-9]+\.[0-9]+\.[0-9]+_x64-setup\.exe\.sig$/Stake-Dev-Tool-v${VERSION}-windows-x64.exe.sig/;
              s/^Stake\.Dev\.Tool_aarch64\.app\.tar\.gz$/Stake-Dev-Tool-v${VERSION}-macos-arm64.app.tar.gz/;
              s/^Stake\.Dev\.Tool_aarch64\.app\.tar\.gz\.sig$/Stake-Dev-Tool-v${VERSION}-macos-arm64.app.tar.gz.sig/;
              s/^Stake\.Dev\.Tool_[0-9]+\.[0-9]+\.[0-9]+_amd64\.AppImage$/Stake-Dev-Tool-v${VERSION}-linux-x64.AppImage/;
              s/^Stake\.Dev\.Tool_[0-9]+\.[0-9]+\.[0-9]+_amd64\.AppImage\.sig$/Stake-Dev-Tool-v${VERSION}-linux-x64.AppImage.sig/;
              s/^Stake\.Dev\.Tool_[0-9]+\.[0-9]+\.[0-9]+_amd64\.deb$/Stake-Dev-Tool-v${VERSION}-linux-x64.deb/;
            "
          }

          # Build a set of names that are about to be created so we can
          # detect conflicts (e.g. left-over from a previous workflow run).
          target_names=$(while IFS=$'\t' read -r api_url old; do
            new=$(rename_rule "$old")
            if [ "$new" != "$old" ]; then echo "$new"; fi
          done < assets.tsv)

          # Pass 1: delete anything in the way — old `latest.json` (we'll
          # regenerate it in the manifest job) and any asset whose name
          # collides with one we're about to assign.
          while IFS=$'\t' read -r api_url old; do
            asset_id="${api_url##*/}"
            should_delete=false
            if [ "$old" = "latest.json" ]; then
              should_delete=true
            elif echo "$target_names" | grep -Fxq "$old"; then
              # Already-renamed asset from a previous (partially failed) run.
              # Tauri-action will have re-uploaded the original; drop the
              # leftover so the rename below can succeed.
              should_delete=true
            fi
            if [ "$should_delete" = true ]; then
              echo "Deleting (cleanup): $old"
              gh api -X DELETE "repos/$REPO/releases/assets/$asset_id" >/dev/null
            fi
          done < assets.tsv

          # Re-list assets after the cleanup pass so we don't try to rename
          # anything we just deleted.
          gh release view "$TAG" --repo "$REPO" --json assets \
            --jq '.assets[] | "\(.apiUrl)\t\(.name)"' > assets.tsv

          # Pass 2: actually rename.
          while IFS=$'\t' read -r api_url old; do
            asset_id="${api_url##*/}"
            new=$(rename_rule "$old")
            if [ "$new" != "$old" ]; then
              echo "Renaming: $old → $new"
              gh api -X PATCH "repos/$REPO/releases/assets/$asset_id" -f name="$new" >/dev/null
            else
              echo "Skipping (no rename rule): $old"
            fi
          done < assets.tsv

  # Build the updater manifest (latest.json) once all platforms finished and
  # attach it to the draft release so tauri-plugin-updater can find it.
  manifest:
    needs: rename
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build latest.json manifest
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ github.ref_name }}
          REPO: ${{ github.repository }}
        run: |
          set -euo pipefail
          VERSION="${TAG#v}"
          PUB_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"

          # `gh release view` works for drafts too (the API /releases/tags/
          # endpoint returns 404 for drafts). Get asset list + body.
          release_json=$(gh release view "$TAG" --json assets,body --repo "$REPO")

          # Construct the stable public URL from tag + asset name, NOT the URL
          # returned by gh — drafts return temporary `untagged-xxx` slugs that
          # break once the release is published.
          asset_url() {
            local name="$1"
            # URL-encode spaces to %20 and keep everything else.
            local encoded=$(echo "$name" | jq -Rr @uri)
            echo "https://github.com/${REPO}/releases/download/${TAG}/${encoded}"
          }
          asset_names=$(echo "$release_json" | jq -r '.assets[].name')

          find_asset() {
            local pattern="$1"
            echo "$asset_names" | grep -E "$pattern" | head -n1 || true
          }

          # Download signature files (contents, not just URLs) to embed in manifest.
          mkdir -p sigs
          download_sig() {
            local name="$1"
            if [ -n "$name" ]; then
              gh release download "$TAG" --pattern "$name" --dir sigs --clobber --repo "$REPO" || true
              cat "sigs/$name" 2>/dev/null || true
            fi
          }

          win_exe=$(find_asset 'windows-x64\.exe$')
          win_sig_name=$(find_asset 'windows-x64\.exe\.sig$')
          mac_tar=$(find_asset 'macos-arm64\.app\.tar\.gz$')
          mac_sig_name=$(find_asset 'macos-arm64\.app\.tar\.gz\.sig$')
          linux_app=$(find_asset 'linux-x64\.AppImage$')
          linux_sig_name=$(find_asset 'linux-x64\.AppImage\.sig$')

          echo "Found assets:"
          echo "  win: $win_exe / $win_sig_name"
          echo "  mac: $mac_tar / $mac_sig_name"
          echo "  linux: $linux_app / $linux_sig_name"

          # Refuse to publish a half-built manifest: the build matrix produces
          # all three platforms, so any missing asset means the rename step
          # didn't catch an artefact. Silently shipping only darwin-aarch64 is
          # exactly how the v0.3.7/0.3.8 updater broke for Windows.
          missing=()
          [ -z "$win_exe" ] || [ -z "$win_sig_name" ] && missing+=("windows")
          [ -z "$mac_tar" ] || [ -z "$mac_sig_name" ] && missing+=("macos")
          [ -z "$linux_app" ] || [ -z "$linux_sig_name" ] && missing+=("linux")
          if [ ${#missing[@]} -gt 0 ]; then
            echo "::error::Missing updater assets for: ${missing[*]}"
            echo "Assets present on the release:"
            echo "$asset_names" | sed 's/^/  - /'
            exit 1
          fi

          platforms_json="{}"
          if [ -n "$win_exe" ] && [ -n "$win_sig_name" ]; then
            sig=$(download_sig "$win_sig_name")
            url=$(asset_url "$win_exe")
            platforms_json=$(echo "$platforms_json" | jq \
              --arg sig "$sig" --arg url "$url" \
              '. + {"windows-x86_64": {"signature": $sig, "url": $url}}')
          fi
          if [ -n "$mac_tar" ] && [ -n "$mac_sig_name" ]; then
            sig=$(download_sig "$mac_sig_name")
            url=$(asset_url "$mac_tar")
            platforms_json=$(echo "$platforms_json" | jq \
              --arg sig "$sig" --arg url "$url" \
              '. + {"darwin-aarch64": {"signature": $sig, "url": $url}}')
          fi
          if [ -n "$linux_app" ] && [ -n "$linux_sig_name" ]; then
            sig=$(download_sig "$linux_sig_name")
            url=$(asset_url "$linux_app")
            platforms_json=$(echo "$platforms_json" | jq \
              --arg sig "$sig" --arg url "$url" \
              '. + {"linux-x86_64": {"signature": $sig, "url": $url}}')
          fi

          notes=$(echo "$release_json" | jq -r '.body // ""')

          jq -n \
            --arg version "$VERSION" \
            --arg notes "$notes" \
            --arg pub_date "$PUB_DATE" \
            --argjson platforms "$platforms_json" \
            '{version: $version, notes: $notes, pub_date: $pub_date, platforms: $platforms}' \
            > latest.json

          echo "=== latest.json ==="
          cat latest.json

          gh release upload "$TAG" latest.json --clobber --repo "$REPO"