name: Release

on:
  push:
    tags:
      - 'v*'

jobs:
  create-release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Create draft release with auto-generated notes
        run: gh release create ${{ github.ref_name }} --draft --generate-notes --prerelease=${{ contains(github.ref_name, 'rc') }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  release:
    needs: create-release
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-15
            platform: mac
            release_command: ORCA_MAC_RELEASE=1 pnpm exec electron-builder --config config/electron-builder.config.cjs --mac --publish always
          - os: windows-latest
            platform: win
            release_command: pnpm exec electron-builder --config config/electron-builder.config.cjs --win --publish always
          - os: ubuntu-latest
            platform: linux
            release_command: pnpm exec electron-builder --config config/electron-builder.config.cjs --linux --publish always

    runs-on: ${{ matrix.os }}

    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          run_install: false

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Verify macOS signing environment
        if: matrix.platform == 'mac'
        run: node config/scripts/verify-macos-release-env.mjs
        env:
          CSC_LINK: ${{ secrets.MAC_CERTS }}
          CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTS_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

      - name: Build app
        run: pnpm build:release

      - name: Publish release artifacts
        run: ${{ matrix.release_command }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_LINK: ${{ secrets.MAC_CERTS }}
          CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTS_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

  publish-release:
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Publish release
        run: gh release edit ${{ github.ref_name }} --draft=false --repo ${{ github.repository }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}