name: Build

on:
  push:
    branches:
      - "**"
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag_version:
        type: boolean
        description: "Tag Version"
      mas:
        type: boolean
        description: "Build for Mac App Store"
      build_version:
        type: string
        description: "Build Version, only available when mas is true"

# https://docs.github.com/en/enterprise-cloud@latest/actions/writing-workflows/choosing-what-your-workflow-does/control-the-concurrency-of-workflows-and-jobs
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-build
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
env:
  VITE_WEB_URL: ${{ vars.VITE_WEB_URL }}
  VITE_API_URL: ${{ vars.VITE_API_URL }}
  VITE_SENTRY_DSN: ${{ vars.VITE_SENTRY_DSN }}
  VITE_OPENPANEL_CLIENT_ID: ${{ vars.VITE_OPENPANEL_CLIENT_ID }}
  VITE_OPENPANEL_API_URL: ${{ vars.VITE_OPENPANEL_API_URL }}
  VITE_FIREBASE_CONFIG: ${{ vars.VITE_FIREBASE_CONFIG }}
  NODE_OPTIONS: --max-old-space-size=8192

jobs:
  release:
    runs-on: ${{ matrix.os }}

    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, ubuntu-latest, windows-latest]
        exclude:
          - os: ${{ github.event.inputs.mas == 'true' && 'ubuntu-latest' }}
          - os: ${{ github.event.inputs.mas == 'true' && 'windows-latest' }}

    permissions:
      id-token: write
      contents: write
      attestations: write

    steps:
      - name: Check out Git repository Fully
        uses: actions/checkout@v4
        if: github.event.inputs.tag_version == 'true' || github.ref_type == 'tag'
        with:
          fetch-depth: 0
          lfs: true
      - name: Check out Git repository
        uses: actions/checkout@v4
        if: github.event.inputs.tag_version != 'true' && github.ref_type != 'tag'
        with:
          fetch-depth: 1
          lfs: true

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Use Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: "pnpm"

      - name: Install Python setuptools
        if: runner.os == 'macOS'
        run: brew install python-setuptools

      - name: Install appdmg
        if: runner.os == 'macOS'
        run: pnpm add -g appdmg

      - name: Install the Apple certificate and provisioning profile
        env:
          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
          BUILD_CERTIFICATE_MAS_BASE64: ${{ secrets.BUILD_CERTIFICATE_MAS_BASE64 }}
          BUILD_CERTIFICATE_MASPKG_BASE64: ${{ secrets.BUILD_CERTIFICATE_MASPKG_BASE64 }}
          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
          BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        if: runner.os == 'macOS' && env.BUILD_CERTIFICATE_BASE64 != '' && env.BUILD_CERTIFICATE_MAS_BASE64 != '' && env.BUILD_CERTIFICATE_MASPKG_BASE64 != '' && env.BUILD_PROVISION_PROFILE_BASE64 != ''
        run: |
          # create variables
          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
          CERTIFICATE_MAS_PATH=$RUNNER_TEMP/build_certificate_mas.p12
          CERTIFICATE_MASPKG_PATH=$RUNNER_TEMP/build_certificate_maspkg.p12
          PP_PATH=$RUNNER_TEMP/build_pp.provisionprofile
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

          # import certificate and provisioning profile from secrets
          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
          echo -n "$BUILD_CERTIFICATE_MAS_BASE64" | base64 --decode -o $CERTIFICATE_MAS_PATH
          echo -n "$BUILD_CERTIFICATE_MASPKG_BASE64" | base64 --decode -o $CERTIFICATE_MASPKG_PATH
          echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode -o $PP_PATH

          # create temporary keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # import certificate to keychain
          security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security import $CERTIFICATE_MAS_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security import $CERTIFICATE_MASPKG_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH
          security find-identity $KEYCHAIN_PATH

          # apply provisioning profile
          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
          cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles

      - name: Install dependencies
        run: pnpm i
      - name: Update main hash
        run: |
          cd apps/desktop
          pnpm update:main-hash
      - name: Build
        if: runner.os != 'macOS'
        run: pnpm build:electron
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}

      - name: Build (macOS)
        if: runner.os == 'macOS' && github.event.inputs.mas != 'true'
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          OSX_SIGN_KEYCHAIN_PATH: ${{ runner.temp }}/app-signing.keychain-db
          OSX_SIGN_IDENTITY: ${{ secrets.OSX_SIGN_IDENTITY }}
        uses: nick-fields/retry@v3
        with:
          max_attempts: 3
          timeout_minutes: 10
          command: pnpm build:macos

      - name: Build (Mac App Store)
        if: runner.os == 'macOS' && github.event.inputs.mas == 'true'
        env:
          OSX_SIGN_KEYCHAIN_PATH: ${{ runner.temp }}/app-signing.keychain-db
          OSX_SIGN_IDENTITY: ${{ secrets.OSX_SIGN_IDENTITY_MAS }}
          OSX_SIGN_PROVISIONING_PROFILE_PATH: ${{ runner.temp }}/build_pp.provisionprofile
          BUILD_VERSION: ${{ github.event.inputs.build_version }}
        run: pnpm build:mas

      - name: Build Renderer
        if: runner.os == 'Linux'
        run: pnpm build:render
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}

      - name: Upload file (macos-arm64-dmg)
        uses: actions/upload-artifact@v4
        if: runner.os == 'macOS'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          name: macos-arm64-dmg
          path: |
            apps/desktop/out/make/**/*arm64.dmg
            apps/desktop/out/make/**/latest-mac.yml
          retention-days: 90

      - name: Upload file (macos-x64-dmg)
        uses: actions/upload-artifact@v4
        if: runner.os == 'macOS'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          name: macos-x64-dmg
          path: |
            apps/desktop/out/make/**/*x64.dmg
            apps/desktop/out/make/**/latest-mac.yml
          retention-days: 90

      - name: Upload file (macos-mas-pkg)
        uses: actions/upload-artifact@v4
        if: runner.os == 'macOS'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          name: macos-mas-pkg
          path: |
            apps/desktop/out/make/**/*.pkg
          retention-days: 90

      - name: Upload file (windows-x64-exe unsigned)
        uses: actions/upload-artifact@v4
        id: upload-unsigned-windows-x64-exe
        if: runner.os == 'windows'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          name: windows-x64-exe
          path: |
            apps/desktop/out/make/**/*x64.exe
            apps/desktop/out/make/**/latest.yml
          retention-days: 90

      - uses: signpath/github-action-submit-signing-request@v1.1
        continue-on-error: true
        if: runner.os == 'windows' && (github.ref_type == 'tag' || github.event.inputs.tag_version == 'true')
        with:
          api-token: "${{ secrets.SIGNPATH_API_TOKEN }}"
          organization-id: "8c651516-fdaf-40a1-9fea-001dffde850e"
          project-slug: "Folo"
          signing-policy-slug: "release-signing"
          artifact-configuration-slug: "github"
          github-artifact-id: "${{ steps.upload-unsigned-windows-x64-exe.outputs.artifact-id }}"
          output-artifact-directory: "apps/desktop/out/make/"

      - name: Update latest.yml
        if: runner.os == 'windows' && (github.ref_type == 'tag' || github.event.inputs.tag_version == 'true')
        run: npx tsx apps/desktop/scripts/update-windows-yml.ts

      - name: Upload file (windows-x64-exe signed)
        uses: actions/upload-artifact@v4
        if: runner.os == 'windows' && (github.ref_type == 'tag' || github.event.inputs.tag_version == 'true')
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          name: windows-x64-exe
          path: |
            apps/desktop/out/make/**/*x64.exe
            apps/desktop/out/make/**/latest.yml
          retention-days: 90
          overwrite: true

      - name: Upload file (windows-x64-appx)
        uses: actions/upload-artifact@v4
        if: runner.os == 'windows'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          name: windows-x64-appx
          path: |
            apps/desktop/out/make/**/*.appx
          retention-days: 90

      - name: Upload file (linux-x64-appimage)
        uses: actions/upload-artifact@v4
        if: runner.os == 'linux'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          name: linux-x64-appimage
          path: |
            apps/desktop/out/make/**/*x64.AppImage
            apps/desktop/out/make/**/latest-linux.yml
          retention-days: 90

      - name: Generate artifact attestation
        if: github.ref_type == 'tag' || github.event.inputs.tag_version == 'true'
        continue-on-error: true
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: |
            apps/desktop/out/make/**/Folo-*.dmg
            apps/desktop/out/make/**/Folo-*.zip
            apps/desktop/out/make/**/Folo-*.exe
            apps/desktop/out/make/**/Folo-*.AppImage
            apps/desktop/out/make/**/*.yml
            apps/desktop/dist/manifest.yml
            apps/desktop/dist/*.tar.gz

      - run: npx changelogithub
        if: github.ref_type == 'tag' || github.event.inputs.tag_version == 'true'
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Version
        id: version
        uses: ./.github/actions/setup-version
        with:
          type: "desktop"

      - name: Create Release Draft
        if: github.ref_type == 'tag' || github.event.inputs.tag_version == 'true'
        uses: softprops/action-gh-release@v2
        with:
          name: v${{ steps.version.outputs.APP_VERSION }}
          draft: false
          prerelease: true
          tag_name: v${{ steps.version.outputs.APP_VERSION }}
          files: |
            apps/desktop/out/make/**/Folo-*.dmg
            apps/desktop/out/make/**/Folo-*.zip
            apps/desktop/out/make/**/Folo-*.exe
            apps/desktop/out/make/**/Folo-*.AppImage
            apps/desktop/out/make/**/*.yml
            apps/desktop/dist/manifest.yml
            apps/desktop/dist/*.tar.gz