name: Tauri Release Builds

permissions:
  contents: read

on:
  workflow_dispatch:
  push:
    tags:
      - 'tauri-v*'

jobs:
  bundle:
    name: ${{ matrix.name }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: macos-arm64
            os: macos-14
            args: --target aarch64-apple-darwin
          - name: windows-x64
            os: windows-latest
            args: ''
    env:
      REQUIRE_SIGNING: ${{ startsWith(github.ref, 'refs/tags/tauri-v') }}
      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
      APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
      APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
      APPLE_ID: ${{ secrets.APPLE_ID }}
      APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
      WINDOWS_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }}
      WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.name == 'macos-arm64' && 'aarch64-apple-darwin' || '' }}

      - run: npm ci

      - name: Validate release signing configuration
        shell: bash
        run: node scripts/release-preflight.mjs ${{ runner.os == 'macOS' && 'macos' || 'windows' }}

      - name: Import Windows signing certificate
        if: runner.os == 'Windows' && env.WINDOWS_CERTIFICATE_BASE64 != ''
        shell: pwsh
        run: |
          $pfxPath = Join-Path $env:RUNNER_TEMP 'opsxshell-signing.pfx'
          [IO.File]::WriteAllBytes($pfxPath, [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE_BASE64))
          $password = ConvertTo-SecureString $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force
          $certificate = Import-PfxCertificate -FilePath $pfxPath -CertStoreLocation Cert:\CurrentUser\My -Password $password
          $config = @{ bundle = @{ windows = @{
            certificateThumbprint = $certificate.Thumbprint
            digestAlgorithm = 'sha256'
            timestampUrl = 'http://timestamp.digicert.com'
          } } } | ConvertTo-Json -Depth 4
          Set-Content -Path src-tauri/tauri.signing.conf.json -Value $config

      - name: Import Apple Developer ID certificate
        if: runner.os == 'macOS' && env.APPLE_CERTIFICATE != ''
        uses: apple-actions/import-codesign-certs@v3
        with:
          p12-file-base64: ${{ env.APPLE_CERTIFICATE }}
          p12-password: ${{ env.APPLE_CERTIFICATE_PASSWORD }}

      - name: Configure Apple Developer ID signing
        if: runner.os == 'macOS' && env.APPLE_CERTIFICATE != ''
        shell: bash
        run: |
          node -e "require('fs').writeFileSync('src-tauri/tauri.signing.conf.json', JSON.stringify({ bundle: { macOS: { signingIdentity: process.env.APPLE_SIGNING_IDENTITY } } }))"

      - name: Build native package
        if: (runner.os != 'Windows' || env.WINDOWS_CERTIFICATE_BASE64 == '') && (runner.os != 'macOS' || env.APPLE_CERTIFICATE == '')
        run: npm run build:tauri -- ${{ matrix.args }}

      - name: Build signed Windows package
        if: runner.os == 'Windows' && env.WINDOWS_CERTIFICATE_BASE64 != ''
        run: npm run build:tauri -- --config src-tauri/tauri.signing.conf.json

      - name: Build signed macOS package
        if: runner.os == 'macOS' && env.APPLE_CERTIFICATE != ''
        run: npm run build:tauri -- ${{ matrix.args }} --config src-tauri/tauri.signing.conf.json

      - name: Verify native package
        shell: bash
        run: node scripts/verify-release.mjs ${{ runner.os == 'macOS' && 'macos' || 'windows' }}

      - name: Upload package
        uses: actions/upload-artifact@v4
        with:
          name: opsxshell-${{ matrix.name }}
          path: |
            src-tauri/target/${{ matrix.name == 'macos-arm64' && 'aarch64-apple-darwin/release/bundle/**' || 'release/bundle/**' }}
          if-no-files-found: error