release.yml

name: Release Build

on:
  push:
    branches:
      - release

jobs:
  release:
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: 'macos-latest'
            args: '--target aarch64-apple-darwin'
          - platform: 'macos-latest'
            args: '--target x86_64-apple-darwin'
          - platform: 'ubuntu-22.04'
            args: ''
          - platform: 'windows-latest'
            args: ''

    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - name: Install dependencies (Ubuntu only)
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      - name: Install frontend dependencies
        run: yarn install

      - name: Get version from package.json
        id: version
        shell: bash
        run: echo "VERSION=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT

      - name: Check signing configuration
        shell: bash
        run: |
          if [ -n "${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}" ]; then
            echo "✓ TAURI_SIGNING_PRIVATE_KEY is set (length: ${#TAURI_SIGNING_PRIVATE_KEY})"
          else
            echo "✗ TAURI_SIGNING_PRIVATE_KEY is NOT set"
          fi
          if [ -n "${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}" ]; then
            echo "✓ TAURI_SIGNING_PRIVATE_KEY_PASSWORD is set"
          else
            echo "✗ TAURI_SIGNING_PRIVATE_KEY_PASSWORD is NOT set"
          fi
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}

      - name: Extract changelog for this version
        id: changelog
        shell: bash
        run: |
          VERSION="${{ steps.version.outputs.VERSION }}"
          # Extract the section for this version from CHANGELOG.md
          # Finds content between ## [VERSION] and the next ## [
          CHANGELOG=$(awk "/## \[${VERSION}\]/{flag=1; next} /## \[/{flag=0} flag" CHANGELOG.md)

          # Output to GitHub Actions in multiline format
          echo "CHANGELOG<<EOF" >> $GITHUB_OUTPUT
          echo "$CHANGELOG" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

          echo "Extracted changelog:"
          echo "$CHANGELOG"

      - uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
          PUBLIC_SUPABASE_URL: ${{ secrets.PUBLIC_SUPABASE_URL }}
          PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.PUBLIC_SUPABASE_ANON_KEY }}
          PUBLIC_SENTRY_DSN: ${{ secrets.PUBLIC_SENTRY_DSN }}
        with:
          tagName: v${{ steps.version.outputs.VERSION }}
          releaseName: 'Dota Keeper v${{ steps.version.outputs.VERSION }}'
          releaseBody: ${{ steps.changelog.outputs.CHANGELOG }}
          releaseDraft: true
          prerelease: false
          args: ${{ matrix.args }}

      - name: Verify signature files were created
        shell: bash
        run: |
          echo "Checking for .sig files in target directory..."
          find src-tauri/target -name "*.sig" -type f || echo "No .sig files found"
          echo ""
          echo "Listing all files in bundle directories:"
          find src-tauri/target -type d -name "bundle" -exec sh -c 'echo "=== {} ==="; ls -la "{}" 2>/dev/null || true' \;
          echo ""
          echo "Searching for any signature-related files:"
          find src-tauri/target -type f \( -name "*.sig" -o -name "*signature*" \) 2>/dev/null || echo "No signature files found"

      - name: List all release assets
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "Listing all assets in the draft release..."
          gh release view "v${{ steps.version.outputs.VERSION }}" --json assets --jq '.assets[].name' || echo "Could not list release assets"

  android:
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v4

      - name: Setup Java 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install Rust stable + Android targets
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android

      - name: Install Android NDK r27
        run: |
          "$ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager" --install "ndk;27.0.12077973"
          echo "NDK_HOME=$ANDROID_SDK_ROOT/ndk/27.0.12077973" >> $GITHUB_ENV

      - name: Install frontend dependencies
        run: yarn install

      - name: Create cargo-tauri wrapper
        run: |
          printf '#!/bin/sh\nshift\nexec yarn tauri "$@"\n' > ~/.cargo/bin/cargo-tauri
          chmod +x ~/.cargo/bin/cargo-tauri

      - name: Get version from package.json
        id: version
        run: echo "VERSION=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT

      - name: Decode keystore
        run: echo "${{ secrets.ANDROID_KEYSTORE }}" | base64 --decode > "$RUNNER_TEMP/release.keystore"

      - name: Build release AAB
        env:
          NDK_HOME: ${{ env.NDK_HOME }}
          POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
          PUBLIC_SUPABASE_URL: ${{ secrets.PUBLIC_SUPABASE_URL }}
          PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.PUBLIC_SUPABASE_ANON_KEY }}
          PUBLIC_SENTRY_DSN: ${{ secrets.PUBLIC_SENTRY_DSN }}
        run: yarn tauri android build --aab true

      - name: Sign AAB
        run: |
          UNSIGNED=$(find src-tauri/gen/android/app/build/outputs/bundle -name "*.aab" | head -1)
          SIGNED="dota-keeper-${{ steps.version.outputs.VERSION }}-android.aab"
          jarsigner -verbose \
            -sigalg SHA256withRSA \
            -digestalg SHA-256 \
            -keystore "$RUNNER_TEMP/release.keystore" \
            -storepass "${{ secrets.ANDROID_STORE_PASSWORD }}" \
            -keypass "${{ secrets.ANDROID_KEY_PASSWORD }}" \
            -signedjar "$SIGNED" \
            "$UNSIGNED" \
            "${{ secrets.ANDROID_KEY_ALIAS }}"
          echo "SIGNED_AAB=$SIGNED" >> $GITHUB_ENV

      - name: Upload AAB as workflow artifact
        uses: actions/upload-artifact@v4
        with:
          name: dota-keeper-${{ steps.version.outputs.VERSION }}-android
          path: ${{ env.SIGNED_AAB }}
          retention-days: 30

      - name: Upload to Google Play (internal track, draft)
        uses: r0adkll/upload-google-play@v1
        with:
          serviceAccountJsonPlainText: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
          packageName: com.dotakeeper.dotakeeper.beta
          releaseFiles: ${{ env.SIGNED_AAB }}
          track: internal
          status: draft

  update-release-json:
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: release

      - name: Get version from package.json
        id: version
        run: echo "VERSION=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT

      - name: Download and inspect release signatures
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${{ steps.version.outputs.VERSION }}"
          echo "=== Release assets for v${VERSION} ==="
          gh release view "v${VERSION}" --json assets --jq '.assets[].name' || echo "Could not list assets"

          mkdir -p ./signatures

          # Download all .sig files
          echo ""
          echo "=== Downloading .sig files ==="
          gh release download "v${VERSION}" --pattern "*.sig" --dir ./signatures 2>&1 || \
            echo "Warning: gh release download failed or no .sig files found"

          echo ""
          echo "=== Downloaded signature files ==="
          ls -la ./signatures/ 2>/dev/null || echo "No files downloaded"

      - name: Update latest.json
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${{ steps.version.outputs.VERSION }}"
          PUB_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")

          WIN_SIG=""
          LINUX_SIG=""
          MACOS_X64_SIG=""
          MACOS_ARM_SIG=""

          # Classify each downloaded .sig file by its name.
          # Order matters: aarch64 before x64, amd64 before x64, .app.tar.gz before plain x64.
          for f in ./signatures/*.sig; do
            [ -f "$f" ] || continue
            name=$(basename "$f")
            echo "Classifying: $name"
            case "$name" in
              *aarch64*)            MACOS_ARM_SIG=$(cat "$f");  echo "  → macOS ARM" ;;
              *amd64*)              LINUX_SIG=$(cat "$f");       echo "  → Linux x64" ;;
              *x64.app.tar.gz.sig)  MACOS_X64_SIG=$(cat "$f");  echo "  → macOS x64" ;;
              *x64*)                WIN_SIG=$(cat "$f");         echo "  → Windows x64" ;;
              *)                    echo "  → unrecognised, skipping" ;;
            esac
          done

          echo ""
          echo "Windows sig present:    $([ -n "$WIN_SIG" ] && echo yes || echo NO)"
          echo "Linux sig present:      $([ -n "$LINUX_SIG" ] && echo yes || echo NO)"
          echo "macOS x64 sig present:  $([ -n "$MACOS_X64_SIG" ] && echo yes || echo NO)"
          echo "macOS ARM sig present:  $([ -n "$MACOS_ARM_SIG" ] && echo yes || echo NO)"

          mkdir -p meta/autoupdate

          cat > meta/autoupdate/latest.json << EOF
          {
            "version": "${VERSION}",
            "notes": "Release v${VERSION}",
            "pub_date": "${PUB_DATE}",
            "platforms": {
              "windows-x86_64": {
                "signature": "${WIN_SIG}",
                "url": "https://github.com/stringhandler/dota-keeper/releases/download/v${VERSION}/Dota.Keeper_${VERSION}_x64_en-US.msi"
              },
              "linux-x86_64": {
                "signature": "${LINUX_SIG}",
                "url": "https://github.com/stringhandler/dota-keeper/releases/download/v${VERSION}/Dota.Keeper_${VERSION}_amd64.AppImage.tar.gz"
              },
              "darwin-x86_64": {
                "signature": "${MACOS_X64_SIG}",
                "url": "https://github.com/stringhandler/dota-keeper/releases/download/v${VERSION}/Dota.Keeper_x64.app.tar.gz"
              },
              "darwin-aarch64": {
                "signature": "${MACOS_ARM_SIG}",
                "url": "https://github.com/stringhandler/dota-keeper/releases/download/v${VERSION}/Dota.Keeper_aarch64.app.tar.gz"
              }
            }
          }
          EOF

          echo ""
          echo "=== Generated latest.json ==="
          cat meta/autoupdate/latest.json

      - name: Commit latest.json to repo
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add meta/autoupdate/latest.json
          git diff --cached --quiet || git commit -m "chore: update latest.json for v${{ steps.version.outputs.VERSION }}"
          git push

      - name: Upload latest.json to release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${{ steps.version.outputs.VERSION }}"
          gh release upload "v${VERSION}" meta/autoupdate/latest.json --clobber