build.yml

name: "Build iloader"

on:
  push:
    branches:
      - "*"
  pull_request:
    branches:
      - "*"
  workflow_dispatch:
  release:
    types: [published]

jobs:
  build:
    permissions:
      contents: write
    env:
      HAVE_SIGNING_SECRETS: ${{ secrets.DEV_ID_P12_BASE64 != '' && secrets.DEV_ID_P12_PASSWORD != '' && secrets.DEV_IDENTITY_NAME != '' }}
      HAVE_NOTARIZE_SECRETS: ${{ secrets.NOTARIZE_APPLE_ID != '' && secrets.NOTARIZE_APP_SPECIFIC_PASS != '' && secrets.NOTARIZE_TEAM_ID != '' }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: "ubuntu-22.04"
            args: "--bundles deb"
          - platform: "ubuntu-22.04"
            args: "--bundles rpm"
          - platform: "ubuntu-22.04"
            args: "--bundles appimage"
          - platform: "windows-latest"
            args: ""
          - platform: "macos-latest"
            args: "--target universal-apple-darwin"

    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v4

      - name: Cache Rust and bun dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            src-tauri/target
            node_modules
          key: ${{ matrix.platform }}-iloader-${{ hashFiles('**/Cargo.lock', 'package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-iloader-

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - name: Install Linux dependencies
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf perl make

      - name: Add MSVC to PATH
        if: matrix.platform == 'windows-latest'
        uses: ilammy/msvc-dev-cmd@v1

      - name: Install Perl and Make for Windows
        if: matrix.platform == 'windows-latest'
        run: |
          choco install strawberryperl make --no-progress

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install frontend dependencies
        run: bun i --frozen-lockfile

      - name: Clean old bundles
        if: matrix.platform != 'macos-latest'
        run: bunx rimraf src-tauri/target/release/bundle

      - name: Clean old bundles
        if: matrix.platform == 'macos-latest'
        run: |
          bunx rimraf src-tauri/target/aarch64-apple-darwin/release/bundle
          bunx rimraf src-tauri/target/x86_64-apple-darwin/release/bundle
          bunx rimraf src-tauri/target/universal-apple-darwin/release/bundle

      - name: Export Apple signing secrets (release only)
        if: matrix.platform == 'macos-latest' && env.HAVE_SIGNING_SECRETS == 'true' && github.event_name == 'release'
        run: |
          echo "APPLE_CERTIFICATE=${{ secrets.DEV_ID_P12_BASE64 }}" >> $GITHUB_ENV
          echo "APPLE_CERTIFICATE_PASSWORD=${{ secrets.DEV_ID_P12_PASSWORD }}" >> $GITHUB_ENV
          echo "APPLE_SIGNING_IDENTITY=${{ secrets.DEV_IDENTITY_NAME }}" >> $GITHUB_ENV
          echo "APPLE_TEAM_ID=${{ secrets.NOTARIZE_TEAM_ID }}" >> $GITHUB_ENV

      - name: Build
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          args: ${{ matrix.args }} ${{ github.event_name != 'release' && ' --config src-tauri/ci.conf.json' || '' }}
          includeUpdaterJson: ${{ github.event_name == 'release' }}
          releaseId: ${{ github.event_name == 'release' && github.event.release.id || '' }}
          assetNamePattern: "[name]-[platform]-[arch][ext]"

      - name: Notarize & Staple DMG (release only)
        if: matrix.platform == 'macos-latest' && env.HAVE_NOTARIZE_SECRETS == 'true' && github.event_name == 'release'
        run: |
          DMG_PATH=$(find src-tauri/target -name "*.dmg" -print -quit)
          if [ -z "$DMG_PATH" ]; then
            echo "No DMG found to notarize" >&2
            exit 1
          fi
          echo "Submitting $DMG_PATH to Apple notarization…"
          xcrun notarytool submit "$DMG_PATH" \
            --apple-id "${{ secrets.NOTARIZE_APPLE_ID }}" \
            --password "${{ secrets.NOTARIZE_APP_SPECIFIC_PASS }}" \
            --team-id "${{ secrets.NOTARIZE_TEAM_ID }}" \
            --wait --verbose
          xcrun stapler staple "$DMG_PATH"

      - name: Upload macOS DMG
        uses: actions/upload-artifact@v4
        if: matrix.platform == 'macos-latest'
        with:
          name: macos-dmg-universal
          path: ${{ github.workspace }}/src-tauri/target/**/release/bundle/**/*.dmg

      - name: Upload Linux DEB
        uses: actions/upload-artifact@v4
        if: matrix.platform == 'ubuntu-22.04' && matrix.args == '--bundles deb'
        with:
          name: linux-deb
          path: ${{ github.workspace }}/src-tauri/target/release/bundle/**/*.deb

      - name: Upload Linux RPM
        uses: actions/upload-artifact@v4
        if: matrix.platform == 'ubuntu-22.04' && matrix.args == '--bundles rpm'
        with:
          name: linux-rpm
          path: ${{ github.workspace }}/src-tauri/target/release/bundle/**/*.rpm

      - name: Upload Linux AppImage
        uses: actions/upload-artifact@v4
        if: matrix.platform == 'ubuntu-22.04' && matrix.args == '--bundles appimage'
        with:
          name: linux-appimage
          path: ${{ github.workspace }}/src-tauri/target/release/bundle/**/*.AppImage

      - name: Upload Windows EXE
        uses: actions/upload-artifact@v4
        if: matrix.platform == 'windows-latest'
        with:
          name: windows-exe
          path: |
            ${{ github.workspace }}/src-tauri/target/release/bundle/**/*.exe

  mark-latest:
    needs: build
    if: github.event_name == 'release'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Ensure gh CLI is available
        run: |
          if ! command -v gh >/dev/null; then
            sudo apt-get update
            sudo apt-get install -y gh
          fi

      - name: Authenticate gh
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token

      - name: Mark release as latest
        run: |
          gh release edit "${{ github.event.release.tag_name }}" --latest --repo "${{ github.repository }}"