name: 🖥️ Build Desktop

on:
  push:
    branches:
      - "**"
    paths:
      - "apps/desktop/**"
      - "packages/**"
      - "pnpm-lock.yaml"
      - ".github/workflows/build-desktop.yml"
  workflow_dispatch:
    inputs:
      tag_version:
        type: boolean
        description: "Tag Version"
      store:
        type: boolean
        description: "Build for Mac App Store and Microsoft Store"
      upload_to_app_store:
        type: boolean
        description: "Upload the Mac App Store pkg to App Store Connect"
        default: true
      build_version:
        type: string
        description: "Build Version, only available when mas is true"

# https://docs.github.com/en/enterprise-cloud@latest/actions/writing-workflows/choosing-what-your-workflow-does/control-the-concurrency-of-workflows-and-jobs
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.tag_version == 'true' && 'tag-version' || github.event.inputs.store == 'true' && 'store' || 'manual') || 'build' }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
env:
  VITE_WEB_URL: ${{ vars.VITE_WEB_URL }}
  VITE_API_URL: ${{ vars.VITE_API_URL }}
  VITE_SENTRY_DSN: ${{ vars.VITE_SENTRY_DSN }}
  VITE_FIREBASE_CONFIG: ${{ vars.VITE_FIREBASE_CONFIG }}
  SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
  NODE_OPTIONS: --max-old-space-size=8192

jobs:
  release:
    if: >-
      github.secret_source != 'None' &&
      (
        github.event_name != 'push' ||
        !(
          (github.ref == 'refs/heads/main' && contains(github.event.head_commit.message || '', 'release(desktop):')) ||
          (github.ref == 'refs/heads/mobile-main' && contains(github.event.head_commit.message || '', 'release(mobile):'))
        )
      )
    runs-on: ${{ matrix.os }}
    env:
      PROD: ${{ github.event.inputs.tag_version == 'true' || github.ref_type == 'tag' || github.event.inputs.store == 'true' }}
      RELEASE: ${{ github.event.inputs.tag_version == 'true' || github.ref_type == 'tag' }}

    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, ubuntu-latest, windows-latest]
        exclude:
          - os: ${{ github.event.inputs.store == 'true' && 'ubuntu-latest' }}

    permissions:
      id-token: write
      contents: write
      attestations: write

    steps:
      - name: Check out Git repository Fully
        uses: actions/checkout@v7
        if: env.PROD == 'true'
        with:
          fetch-depth: 0
          lfs: true
      - name: Check out Git repository
        uses: actions/checkout@v7
        if: env.PROD == 'false'
        with:
          fetch-depth: 1
          lfs: true

      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Use Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: "pnpm"

      - name: Install Python setuptools
        if: runner.os == 'macOS'
        run: brew install python-setuptools

      - name: Install appdmg
        if: runner.os == 'macOS'
        run: pnpm add -g appdmg

      - name: Install the Apple certificate and provisioning profile
        env:
          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
          BUILD_CERTIFICATE_MAS_BASE64: ${{ secrets.BUILD_CERTIFICATE_MAS_BASE64 }}
          BUILD_CERTIFICATE_MASPKG_BASE64: ${{ secrets.BUILD_CERTIFICATE_MASPKG_BASE64 }}
          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
          BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        if: runner.os == 'macOS' && env.BUILD_CERTIFICATE_BASE64 != '' && env.BUILD_CERTIFICATE_MAS_BASE64 != '' && env.BUILD_CERTIFICATE_MASPKG_BASE64 != '' && env.BUILD_PROVISION_PROFILE_BASE64 != ''
        run: |
          # create variables
          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
          CERTIFICATE_MAS_PATH=$RUNNER_TEMP/build_certificate_mas.p12
          CERTIFICATE_MASPKG_PATH=$RUNNER_TEMP/build_certificate_maspkg.p12
          PP_PATH=$RUNNER_TEMP/build_pp.provisionprofile
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

          # import certificate and provisioning profile from secrets
          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
          echo -n "$BUILD_CERTIFICATE_MAS_BASE64" | base64 --decode -o $CERTIFICATE_MAS_PATH
          echo -n "$BUILD_CERTIFICATE_MASPKG_BASE64" | base64 --decode -o $CERTIFICATE_MASPKG_PATH
          echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode -o $PP_PATH

          # create temporary keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # import certificate to keychain
          security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security import $CERTIFICATE_MAS_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security import $CERTIFICATE_MASPKG_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH
          security find-identity $KEYCHAIN_PATH

          # apply provisioning profile
          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
          cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles

      - name: Install dependencies
        run: pnpm i

      - name: Prebuild packages (Windows)
        if: runner.os == 'windows'
        run: pnpm run build:packages

      - name: Update main hash
        working-directory: apps/desktop
        run: pnpm update:main-hash
      - name: Build - Vite
        working-directory: apps/desktop
        run: pnpm build:electron-vite ${{ env.PROD == 'false' && '--mode staging' || '' }}

      - name: Build - Windows and Linux
        if: runner.os == 'Linux' || (runner.os == 'Windows' && github.event.inputs.store != 'true')
        working-directory: apps/desktop
        run: pnpm build:electron-forge ${{ env.PROD == 'false' && '--mode=staging' || '' }}

      - name: Build - macOS
        if: runner.os == 'macOS' && github.event.inputs.store != 'true'
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          OSX_SIGN_KEYCHAIN_PATH: ${{ runner.temp }}/app-signing.keychain-db
          OSX_SIGN_IDENTITY: ${{ secrets.OSX_SIGN_IDENTITY }}
        uses: nick-fields/retry@v4
        with:
          max_attempts: 3
          timeout_minutes: 10
          command: |
            cd apps/desktop
            npx electron-forge make --arch=x64 --platform=darwin ${{ env.PROD == 'false' && '--mode=staging' || '' }}
            npx electron-forge make --arch=arm64 --platform=darwin ${{ env.PROD == 'false' && '--mode=staging' || '' }}
            npx tsx scripts/merge-yml.ts

      - name: Resolve desktop build version
        if: runner.os == 'macOS' && github.event.inputs.store == 'true'
        id: desktop_build_version
        shell: bash
        run: |
          set -euo pipefail

          build_version="${{ github.event.inputs.build_version }}"

          if [ -n "$build_version" ]; then
            echo "Using provided desktop build version: $build_version"
            echo "build_version=$build_version" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          git fetch --tags --force

          latest_tag="$(git tag -l 'desktop-build/v*' --sort=-v:refname | head -n 1)"
          if [ -z "$latest_tag" ]; then
            last_build=110
          else
            last_build="${latest_tag#desktop-build/v}"
          fi

          build_version=$((last_build + 1))
          build_tag="desktop-build/v${build_version}"

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag "$build_tag"
          git push origin "$build_tag"

          echo "Reserved desktop build version: ${build_version}"
          echo "build_version=$build_version" >> "$GITHUB_OUTPUT"

      - name: Build - Mac App Store
        if: runner.os == 'macOS' && github.event.inputs.store == 'true'
        env:
          OSX_SIGN_KEYCHAIN_PATH: ${{ runner.temp }}/app-signing.keychain-db
          OSX_SIGN_IDENTITY: ${{ secrets.OSX_SIGN_IDENTITY_MAS }}
          OSX_SIGN_PROVISIONING_PROFILE_PATH: ${{ runner.temp }}/build_pp.provisionprofile
          BUILD_VERSION: ${{ steps.desktop_build_version.outputs.build_version }}
        working-directory: apps/desktop
        run: pnpm build:electron-forge:mas

      - name: Build - Microsoft Store
        if: runner.os == 'Windows' && github.event.inputs.store == 'true'
        working-directory: apps/desktop
        run: pnpm build:electron-forge:ms

      - name: Build - Renderer
        if: runner.os == 'Linux'
        working-directory: apps/desktop
        run: pnpm build:render

      - name: Upload file (macos-arm64-dmg)
        uses: actions/upload-artifact@v7
        if: runner.os == 'macOS'
        with:
          name: macos-arm64-dmg
          path: |
            apps/desktop/out/make/**/*arm64.dmg
            apps/desktop/out/make/**/latest-mac.yml
          retention-days: 90

      - name: Upload file (macos-x64-dmg)
        uses: actions/upload-artifact@v7
        if: runner.os == 'macOS'
        with:
          name: macos-x64-dmg
          path: |
            apps/desktop/out/make/**/*x64.dmg
            apps/desktop/out/make/**/latest-mac.yml
          retention-days: 90

      - name: Upload file (macos-mas-pkg)
        uses: actions/upload-artifact@v7
        if: runner.os == 'macOS'
        with:
          name: macos-mas-pkg
          path: |
            apps/desktop/out/make/**/*.pkg
          retention-days: 90

      - name: Upload Mac App Store package to App Store Connect
        if: runner.os == 'macOS' && github.event.inputs.store == 'true' && github.event.inputs.upload_to_app_store == 'true'
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
        shell: bash
        run: |
          set -euo pipefail

          pkg_path="$(find apps/desktop/out/make -type f -name '*.pkg' | sort | head -n 1)"

          if [ -z "$pkg_path" ]; then
            echo "No Mac App Store package found under apps/desktop/out/make" >&2
            exit 1
          fi

          .github/scripts/upload-mas-pkg.sh "$pkg_path"

      - name: Upload file (windows-x64-exe unsigned)
        uses: actions/upload-artifact@v7
        id: upload-unsigned-windows-x64-exe
        if: runner.os == 'windows' && github.event.inputs.store != 'true'
        with:
          name: windows-x64-exe
          path: |
            apps/desktop/out/make/**/*x64.exe
            apps/desktop/out/make/**/latest.yml
          retention-days: 90

      - uses: signpath/github-action-submit-signing-request@v2.2
        continue-on-error: true
        if: runner.os == 'windows' && env.RELEASE == 'true' && github.event.inputs.store != 'true'
        with:
          api-token: "${{ secrets.SIGNPATH_API_TOKEN }}"
          organization-id: "8c651516-fdaf-40a1-9fea-001dffde850e"
          project-slug: "Folo"
          signing-policy-slug: "release-signing"
          artifact-configuration-slug: "github"
          github-artifact-id: "${{ steps.upload-unsigned-windows-x64-exe.outputs.artifact-id }}"
          output-artifact-directory: "apps/desktop/out/make/"

      - name: Update latest.yml
        if: runner.os == 'windows' && env.RELEASE == 'true' && github.event.inputs.store != 'true'
        run: npx tsx apps/desktop/scripts/update-windows-yml.ts

      - name: Upload file (windows-x64-exe signed)
        uses: actions/upload-artifact@v7
        if: runner.os == 'windows' && env.RELEASE == 'true' && github.event.inputs.store != 'true'
        with:
          name: windows-x64-exe
          path: |
            apps/desktop/out/make/**/*x64.exe
            apps/desktop/out/make/**/latest.yml
          retention-days: 90
          overwrite: true

      - name: Upload file (windows-x64-appx)
        uses: actions/upload-artifact@v7
        if: runner.os == 'windows'
        with:
          name: windows-x64-appx
          path: |
            apps/desktop/out/make/**/*.appx
          retention-days: 90

      - name: Upload file (linux-x64-appimage)
        uses: actions/upload-artifact@v7
        if: runner.os == 'linux'
        with:
          name: linux-x64-appimage
          path: |
            apps/desktop/out/make/**/*x64.AppImage
            apps/desktop/out/make/**/latest-linux.yml
          retention-days: 90

      - name: Prepare release assets for aggregation
        if: env.RELEASE == 'true'
        env:
          DESKTOP_RELEASE_ASSET_DIR: ${{ runner.temp }}/desktop-release-assets
        shell: bash
        run: |
          node --input-type=module <<'EOF'
          import { cpSync, existsSync, mkdirSync, rmSync } from "node:fs"
          import { join } from "node:path"

          const stageDir = process.env.DESKTOP_RELEASE_ASSET_DIR

          if (!stageDir) {
            throw new Error("DESKTOP_RELEASE_ASSET_DIR is not set")
          }

          rmSync(stageDir, { recursive: true, force: true })
          mkdirSync(join(stageDir, "apps", "desktop", "out"), { recursive: true })

          const pathsToCopy = [
            ["apps/desktop/out/make", join(stageDir, "apps", "desktop", "out", "make")],
            ["apps/desktop/dist", join(stageDir, "apps", "desktop", "dist")],
          ]

          for (const [sourcePath, destinationPath] of pathsToCopy) {
            if (!existsSync(sourcePath)) {
              continue
            }

            cpSync(sourcePath, destinationPath, { recursive: true })
          }
          EOF

      - name: Upload release assets for aggregation
        if: env.RELEASE == 'true'
        uses: actions/upload-artifact@v7
        with:
          name: desktop-release-assets-${{ runner.os }}
          path: ${{ runner.temp }}/desktop-release-assets
          if-no-files-found: error
          retention-days: 7

      - name: Generate artifact attestation
        if: env.RELEASE == 'true'
        continue-on-error: true
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: |
            apps/desktop/out/make/**/Folo-*.dmg
            apps/desktop/out/make/**/Folo-*.zip
            apps/desktop/out/make/**/Folo-*.exe
            apps/desktop/out/make/**/Folo-*.AppImage
            apps/desktop/out/make/**/*.yml
            apps/desktop/dist/manifest.yml
            apps/desktop/dist/*.tar.gz

  publish-release:
    if: github.secret_source != 'None' && needs.release.result == 'success' && (github.event.inputs.tag_version == 'true' || github.ref_type == 'tag')
    needs: release
    runs-on: ubuntu-latest

    permissions:
      contents: write

    steps:
      - name: Check out Git repository Fully
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          lfs: true

      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Use Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm i

      - name: Download release assets
        uses: actions/download-artifact@v8
        with:
          pattern: desktop-release-assets-*
          path: .
          merge-multiple: true

      - name: Ensure zstd
        shell: bash
        run: |
          if command -v zstd >/dev/null 2>&1; then
            zstd --version
            exit 0
          fi

          sudo apt-get update
          sudo apt-get install -y zstd

      - name: Build desktop OTA release assets
        env:
          OTA_PRODUCT: desktop
        run: node .github/scripts/build-ota-release.mjs

      - run: npx changelogithub
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ github.token }}

      - name: Setup Version
        id: version
        uses: ./.github/actions/setup-version
        with:
          type: "desktop"

      - name: Prepare Release Notes
        id: release_notes
        shell: bash
        run: |
          version="${{ steps.version.outputs.APP_VERSION }}"
          changelog_file="apps/desktop/changelog/${version}.md"
          release_notes_file="$RUNNER_TEMP/desktop-release-notes.md"

          if [ -f "$changelog_file" ]; then
            cp "$changelog_file" "$release_notes_file"
          else
            {
              echo "# What's New in v${version}"
              echo
              echo "- No changelog file found at ${changelog_file}."
            } > "$release_notes_file"
          fi

          echo "body_path=${release_notes_file}" >> "$GITHUB_OUTPUT"

      - name: Prepare release files
        id: release_files
        shell: bash
        run: |
          release_files="$RUNNER_TEMP/desktop-release-files.txt"

          cat <<'EOF' > "$release_files"
          apps/desktop/out/make/**/Folo-*.dmg
          apps/desktop/out/make/**/Folo-*.zip
          apps/desktop/out/make/**/Folo-*.exe
          apps/desktop/out/make/**/Folo-*.AppImage
          apps/desktop/out/make/**/*.yml
          apps/desktop/dist/manifest.yml
          apps/desktop/dist/*.tar.gz
          apps/desktop/dist/ota-release.json
          EOF

          if [ -f apps/desktop/dist.tar.zst ]; then
            echo "apps/desktop/dist.tar.zst" >> "$release_files"
          fi

          {
            echo "files<<EOF"
            cat "$release_files"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Create Release Draft
        uses: softprops/action-gh-release@v3
        with:
          name: Desktop v${{ steps.version.outputs.APP_VERSION }}
          draft: false
          prerelease: true
          tag_name: desktop/v${{ steps.version.outputs.APP_VERSION }}
          body_path: ${{ steps.release_notes.outputs.body_path }}
          files: ${{ steps.release_files.outputs.files }}