name: Nightly Release

on:
  schedule:
    - cron: "0 22 * * *" # Runs at 10 PM UTC every day

env:
  VITE_WEB_URL: ${{ vars.VITE_WEB_URL }}
  VITE_API_URL: ${{ vars.VITE_API_URL }}
  VITE_IMGPROXY_URL: ${{ vars.VITE_IMGPROXY_URL }}
  VITE_SENTRY_DSN: ${{ vars.VITE_SENTRY_DSN }}
  VITE_OPENPANEL_CLIENT_ID: ${{ vars.VITE_OPENPANEL_CLIENT_ID }}
  VITE_OPENPANEL_API_URL: ${{ vars.VITE_OPENPANEL_API_URL }}
  VITE_FIREBASE_CONFIG: ${{ vars.VITE_FIREBASE_CONFIG }}
  NODE_OPTIONS: --max-old-space-size=8192

jobs:
  nightly-release:
    runs-on: ${{ matrix.os }}

    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, ubuntu-latest, windows-latest]

    permissions:
      id-token: write
      contents: write
      attestations: write

    steps:
      - name: Check out Git repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          lfs: true

      - name: Cache pnpm modules
        uses: actions/cache@v4
        with:
          path: ~/.pnpm-store
          key: ${{ matrix.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ matrix.os }}-

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Use Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: "pnpm"

      - name: Install Python setuptools
        if: runner.os == 'macOS'
        run: brew install python-setuptools

      - name: Install appdmg
        if: runner.os == 'macOS'
        run: pnpm add -g appdmg

      - name: Install the Apple certificate and provisioning profile
        if: runner.os == 'macOS'
        env:
          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
          BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          # create variables
          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
          PP_PATH=$RUNNER_TEMP/build_pp.provisionprofile
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

          # import certificate and provisioning profile from secrets
          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
          echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode -o $PP_PATH

          # create temporary keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # import certificate to keychain
          security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH

          # apply provisioning profile
          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
          cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles

      - name: Install dependencies
        run: pnpm i

      - name: Set nightly version
        shell: bash
        run: |
          # Get the current version from package.json
          CURRENT_VERSION=$(node -p "require('./package.json').version")
          # Remove any existing prerelease identifier (e.g., -alpha.1)
          BASE_VERSION=$(echo $CURRENT_VERSION | sed -E 's/(-[a-zA-Z]+\.[0-9]+)$//')
          # Generate the nightly version
          NIGHTLY_DATE=$(date +'%Y%m%d')
          NIGHTLY_VERSION="${BASE_VERSION}-nightly.${NIGHTLY_DATE}"
          echo "NIGHTLY_VERSION=$NIGHTLY_VERSION" >> $GITHUB_ENV
          # Update version in package.json
          if [[ "$RUNNER_OS" == "Windows" ]]; then
            sed -i "s/\"version\": \".*\"/\"version\": \"$NIGHTLY_VERSION\"/" package.json
          elif [[ "$RUNNER_OS" == "macOS" ]]; then
            sed -i '' "s/\"version\": \".*\"/\"version\": \"$NIGHTLY_VERSION\"/" package.json
          else
            sed -i "s/\"version\": \".*\"/\"version\": \"$NIGHTLY_VERSION\"/" package.json
          fi
          echo "Updated version to $NIGHTLY_VERSION"

      - name: Build
        if: matrix.os != 'macos-latest'
        run: pnpm build
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}

      - name: Build (macOS)
        if: matrix.os == 'macos-latest'
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          KEYCHAIN_PATH: ${{ runner.temp }}/app-signing.keychain-db
        run: pnpm build:macos

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.os }}-nightly
          path: |
            out/make/**/*.zip
            out/make/**/*.exe
            out/make/**/*.AppImage
            out/make/**/*.yml
            out/make/**/*.dmg
          retention-days: 7

      - name: Generate artifact attestation
        continue-on-error: true
        uses: actions/attest-build-provenance@v1
        with:
          subject-path: |
            out/make/**/*.dmg
            out/make/**/*.zip
            out/make/**/*.exe
            out/make/**/*.AppImage
            out/make/**/*.yml

      - name: Create Nightly Release
        uses: softprops/action-gh-release@v2
        with:
          name: Nightly ${{ env.NIGHTLY_VERSION }}
          draft: false
          prerelease: true
          tag_name: nightly-${{ env.NIGHTLY_VERSION }}
          files: |
            out/make/**/*.dmg
            out/make/**/*.zip
            out/make/**/*.exe
            out/make/**/*.AppImage
            out/make/**/*.yml
          body: |
            This is an automated nightly release for testing purposes.
            Version: 0.0.0-nightly.${{ env.NIGHTLY_VERSION }}

            **Warning:** This build may be unstable and is not recommended for production use.
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}