release.yml

name: Release

permissions:
  contents: write

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

on:
  workflow_dispatch:
  push:
    tags:
      - "v*"

jobs:
  release:
    name: Build + Publish
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-15-intel
            script: npm run release:mac:x64
          - os: macos-latest
            script: npm run release:mac:arm64
          - os: windows-2022
            script: npm run release:win
          - os: ubuntu-latest
            script: npm run release:linux
    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - run: npm ci

      - name: Build and publish macOS
        if: runner.os == 'macOS'
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          GITHUB_TOKEN: ${{ github.token }}
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          missing=()
          for name in CSC_LINK CSC_KEY_PASSWORD APPLE_ID APPLE_APP_SPECIFIC_PASSWORD APPLE_TEAM_ID; do
            if [[ -z "${!name}" ]]; then
              missing+=("$name")
            fi
          done

          if (( ${#missing[@]} > 0 )); then
            echo "::error::Missing required macOS signing/notarization secrets: ${missing[*]}"
            exit 1
          fi

          echo "Code signing and notarization enabled"
          ${{ matrix.script }}

      - name: Build and publish
        if: runner.os != 'macOS'
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          ${{ matrix.script }}

  publish-npm:
    name: Package npm zip
    needs: release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - run: npm ci

      - run: npm run pack:npm

      - name: Create and upload zip
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          cd npm-package
          zip -r ../fello-server-$(node -p "require('./package.json').version").zip .
          cd ..
          TAG="${GITHUB_REF#refs/tags/}"
          gh release upload "$TAG" fello-server-*.zip --clobber

  merge-mac-yml:
    name: Merge latest-mac.yml
    needs: release
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Merge mac update yml files
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          TAG="${GITHUB_REF#refs/tags/}"

          # Wait for release assets to be available
          sleep 10

          # Download current latest-mac.yml from the release
          gh release download "$TAG" -p "latest-mac.yml" -D /tmp/update-yml || true

          if [ ! -f /tmp/update-yml/latest-mac.yml ]; then
            echo "latest-mac.yml not found in release, skipping merge"
            exit 0
          fi

          # Check if it already contains both architectures
          if grep -q "arm64" /tmp/update-yml/latest-mac.yml && grep -q "x64\|x86_64" /tmp/update-yml/latest-mac.yml; then
            echo "latest-mac.yml already contains both architectures"
            exit 0
          fi

          # Find all mac zip files in the release to build a complete files list
          ASSETS=$(gh release view "$TAG" --json assets -q '.assets[].name' | grep -E '\.zip$' | grep -i mac)

          # Download all mac zip assets to compute sha512
          mkdir -p /tmp/mac-zips
          for asset in $ASSETS; do
            gh release download "$TAG" -p "$asset" -D /tmp/mac-zips
          done

          # Rebuild latest-mac.yml with all mac zip files
          VERSION=$(grep "^version:" /tmp/update-yml/latest-mac.yml | awk '{print $2}')
          RELEASE_DATE=$(grep "^releaseDate:" /tmp/update-yml/latest-mac.yml | cut -d' ' -f2-)

          {
            echo "version: $VERSION"
            echo "files:"
            for asset in $ASSETS; do
              SHA512=$(shasum -a 512 "/tmp/mac-zips/$asset" | awk '{print $1}' | xxd -r -p | base64 | tr -d '\n')
              SIZE=$(stat -f%z "/tmp/mac-zips/$asset" 2>/dev/null || stat -c%s "/tmp/mac-zips/$asset")
              echo "  - url: $asset"
              echo "    sha512: $SHA512"
              echo "    size: $SIZE"
            done
            echo "releaseDate: $RELEASE_DATE"
          } > /tmp/update-yml/latest-mac.yml

          # Upload the merged yml back to the release
          gh release upload "$TAG" /tmp/update-yml/latest-mac.yml --clobber