release.yml

name: Release

# Builds the Tauri app on every `v*` tag push, creates a GitHub release with
# the NSIS installer attached, and dispatches `optimizationmaxxing-released`
# to MaxxTopia/maxxtopia so the Download CTA on the site auto-updates.

on:
    push:
        tags:
            - "v*"
    workflow_dispatch:

permissions:
    contents: write

jobs:
    publish:
        runs-on: windows-latest

        steps:
            - uses: actions/checkout@v4

            - name: Use Node.js 20
              uses: actions/setup-node@v4
              with:
                  node-version: 20
                  cache: "npm"

            - name: Install Rust toolchain
              uses: dtolnay/rust-toolchain@stable

            - name: Cache cargo
              uses: actions/cache@v4
              with:
                  path: |
                      ~/.cargo/registry
                      ~/.cargo/git
                      src-tauri/target
                  key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock', 'src-tauri/Cargo.toml') }}

            - name: Install npm dependencies
              run: npm ci

            - name: Audit tweak catalog before packaging
              run: npm run audit:catalog

            # tauri-action handles: tauri build (npm script wraps), bundle the
            # NSIS installer, optionally sign, create a draft GitHub release
            # for the matching tag, and upload all bundled artifacts to it.
            - name: Build + Release
              uses: tauri-apps/tauri-action@v0
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                  # Auto-update signing — both must be set as repo secrets.
                  # See README in vip-worker/ for similar setup pattern.
                  # If either is missing, tauri-action skips signing + the
                  # latest.json artifact won't be produced (manual install
                  # still works, just no in-app update prompts).
                  TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
                  TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
              with:
                  tagName: ${{ github.ref_name }}
                  releaseName: "Optimizationmaxxing ${{ github.ref_name }}"
                  releaseBody: |
                      ## Highlights

                      - Pricing now keeps the public Free vs VIP comparison focused; the regular lifetime path remains $115.
                      - The free path remains useful with 70 of 100 catalog tweaks, measured before/after tools, restore support, and the free Tune Now lane; VIP adds the deeper catalog, Match Scan, Asta Mode, full presets, and future packs.
                      - The Fortnite NVIDIA profile and guide now use the conservative four-setting baseline, current driver checks, and Chapter 7 Season 4: Override freshness notes.

                      Auto-built by CI from tag `${{ github.ref_name }}`. The signed `latest.json`, installer, and signature are verified before the release is published.
                  releaseDraft: true
                  prerelease: false
                  # Emits a `latest.json` manifest alongside the .exe so the
                  # Tauri updater plugin can find new builds. Endpoints
                  # config in tauri.conf.json points at this file.
                  updaterJsonPreferNsis: true

            # Auto-publish the draft release once all three updater artifacts
            # (.exe, .exe.sig, latest.json) are confirmed attached. This is the
            # piece that lets the project ship updates with NO human in the loop:
            # the Tauri updater + the maxxtopia Download CTA both read
            # releases/latest/download/..., which only resolves to NON-draft
            # releases. If any artifact is missing the release stays a draft and
            # this step fails loudly rather than shipping a half-built update.
            - name: Auto-publish release (verify updater artifacts first)
              if: success() && startsWith(github.ref, 'refs/tags/v')
              shell: bash
              env:
                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
              run: |
                  TAG="${GITHUB_REF_NAME}"
                  VERSION="${TAG#v}"
                  EXE="optimizationmaxxing_${VERSION}_x64-setup.exe"
                  ASSETS=$(gh release view "$TAG" --repo "$GITHUB_REPOSITORY" --json assets --jq '.assets[].name')
                  echo "Assets on $TAG:"; echo "$ASSETS"
                  have_exe=$(echo "$ASSETS"  | grep -c "^${EXE}$"        || true)
                  have_sig=$(echo "$ASSETS"  | grep -c "\.sig$"          || true)
                  have_json=$(echo "$ASSETS" | grep -c "^latest\.json$"  || true)
                  if [ "$have_exe" -ge 1 ] && [ "$have_sig" -ge 1 ] && [ "$have_json" -ge 1 ]; then
                      echo "All updater artifacts present -> publishing release."
                      gh release edit "$TAG" --repo "$GITHUB_REPOSITORY" --draft=false
                  else
                      echo "::error::Missing updater artifact(s): exe=$have_exe sig=$have_sig latest.json=$have_json. Release left as draft."
                      exit 1
                  fi

            # Cross-repo: notify maxxtopia.com so the Download CTA on
            # /optimizationmaxxing updates to the new installer. Listener
            # workflow on the other side rewrites
            # src/data/optimizationmaxxing-release.json, commits, and
            # Cloudflare Pages auto-deploys.
            #
            # Requires repo secret `MAXXTOPIA_DISPATCH_PAT` — a fine-grained
            # PAT with Contents:Read+Write + Metadata:Read on
            # MaxxTopia/maxxtopia.  Skips silently if missing so the build
            # itself still ships.
            - name: Notify maxxtopia of new release
              if: success() && startsWith(github.ref, 'refs/tags/v') && env.HAS_PAT == 'true'
              shell: bash
              env:
                  PAT: ${{ secrets.MAXXTOPIA_DISPATCH_PAT }}
                  HAS_PAT: ${{ secrets.MAXXTOPIA_DISPATCH_PAT != '' }}
              run: |
                  TAG="${GITHUB_REF_NAME}"
                  VERSION="${TAG#v}"
                  curl --fail-with-body -X POST \
                       -H "Accept: application/vnd.github+json" \
                       -H "Authorization: Bearer ${PAT}" \
                       -H "X-GitHub-Api-Version: 2022-11-28" \
                       https://api.github.com/repos/MaxxTopia/maxxtopia/dispatches \
                       -d "$(jq -n \
                           --arg version "${TAG}" \
                           --arg installerUrl "https://github.com/MaxxTopia/optimizationmaxxing/releases/download/${TAG}/optimizationmaxxing_${VERSION}_x64-setup.exe" \
                           --arg releasePageUrl "https://github.com/MaxxTopia/optimizationmaxxing/releases/tag/${TAG}" \
                           '{event_type: "optimizationmaxxing-released", client_payload: {version: $version, installerUrl: $installerUrl, releasePageUrl: $releasePageUrl}}')"