release.yml

name: Release

# 打 v* tag → 产出全部发布物：
#   - Windows：Dc.App self-contained zip（release job）
#   - Linux：Dc.Cli self-contained 单文件 tarball（x64/arm64）+ 多架构 Docker 镜像推 GHCR（linux job）
# 全部挂到同一个 GitHub Release。workflow_dispatch 为「干跑」：只产 artifact、镜像 build 不 push、不发 Release。
on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      version:
        description: '版本号（不带 v 前缀；留空用 0.0.0-dev）'
        required: false
        default: '0.0.0-dev'

permissions:
  contents: write   # gh release create / upload 需要写权限
  packages: write   # 推送 Docker 镜像到 GHCR 需要

jobs:
  release:
    name: Build & Release (self-contained win-x64)
    # WPF + net8.0-windows 必须 Windows runner
    runs-on: windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        # vendor/ClassicClient 已内置在仓库中（非 submodule），无需 submodules

      - name: Setup .NET 8
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0.x'

      - name: 解析版本号
        id: ver
        shell: bash
        run: |
          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
            V="${GITHUB_REF_NAME#v}"          # v1.2.3 → 1.2.3
          else
            V="${{ github.event.inputs.version }}"
          fi
          echo "version=$V" >> "$GITHUB_OUTPUT"
          echo "解析版本号：$V"

      # 自带运行时发布（文件夹形态）：用户无需安装 .NET 8 桌面运行时，解压双击 Dc.App.exe 即用。
      # - Platform=x64 + CustomTestTarget=net8.0-windows：vendor COM 工程必需（见 README 构建说明）
      # - 不裁剪（WPF 反射重，PublishTrimmed 会崩）
      # - 不用 PublishSingleFile：vendored Technosoftware LicenseHandler 用 Assembly.Location，
      #   单文件下它返回空串（IL3000），既过不了 vendor 的 TreatWarningsAsErrors、运行时也会让
      #   License/DA/AE 逻辑出错。故发布成文件夹（exe + dll），再整体打 zip。
      # - NuGetAuditMode=direct：self-contained 还原会把 vendored 老代码的传递依赖 System.Private.Uri
      #   4.3.0（已知 CVE、够不着也修不了）拉进运行时图，叠加 vendor 的 audit-all + 警告即错误会让还原
      #   失败。降为只审计直接依赖：仍保护自引包，但不为 vendored 深层传递漏洞卡发布。CI 构建不受影响。
      - name: Publish (self-contained win-x64)
        shell: pwsh
        run: >
          dotnet publish src/Dc.App/Dc.App.csproj
          --configuration Release
          --runtime win-x64
          --self-contained true
          -p:Platform=x64
          -p:CustomTestTarget=net8.0-windows
          -p:DebugType=none
          -p:NuGetAuditMode=direct
          -p:Version=${{ steps.ver.outputs.version }}
          --output publish

      - name: 打包 zip
        id: zip
        shell: pwsh
        run: |
          $ver = "${{ steps.ver.outputs.version }}"
          $name = "Dc-v$ver-win-x64.zip"
          # 清掉第三方包可能带的 pdb（自己的已 DebugType=none），让 zip 更干净
          Get-ChildItem publish -Recurse -Filter *.pdb | Remove-Item -Force -ErrorAction SilentlyContinue
          # publish/* 顶层入 zip，避免多套一层目录
          Compress-Archive -Path publish/* -DestinationPath $name -Force
          "name=$name" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
          Get-Item $name | Select-Object Name, @{n='大小MB';e={[math]::Round($_.Length/1MB,1)}} | Format-Table

      # 干跑（workflow_dispatch，无 tag）：仅上传 artifact 供下载验证，不发 Release
      - name: 上传 artifact（干跑验证）
        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.zip.outputs.name }}
          path: ${{ steps.zip.outputs.name }}
          retention-days: 14

      # 正式：打 v* tag 触发 → 创建 Release 并挂 zip（用内置 gh，免第三方 action）
      - name: 发布 GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          PRERELEASE=""
          [[ "${{ steps.ver.outputs.version }}" == *-* ]] && PRERELEASE="--prerelease"
          # Release 说明优先取 CHANGELOG.md 里本版本段落（## vX.Y.Z 到下一个 ## 之间）；
          # 抽不到（无对应段落）则回退 GitHub 自动生成（PR 列表）。
          VER="${{ steps.ver.outputs.version }}"
          awk -v h="## v$VER " 'index($0,h)==1{f=1;print;next} f&&/^## /{f=0} f{print}' CHANGELOG.md > RELEASE_NOTES.md || true
          if [[ -s RELEASE_NOTES.md ]]; then
            echo "Release 说明来自 CHANGELOG.md 的 v$VER 段落"
            NOTES=(--notes-file RELEASE_NOTES.md)
          else
            echo "CHANGELOG.md 无 v$VER 段落，回退自动生成说明"
            NOTES=(--generate-notes)
          fi
          gh release create "${GITHUB_REF_NAME}" \
            "${{ steps.zip.outputs.name }}" \
            --title "${GITHUB_REF_NAME}" \
            "${NOTES[@]}" \
            $PRERELEASE

  linux:
    name: Build & Release (Linux tarball + Docker 镜像)
    needs: release           # 等 release job 建好 Release，再往上挂 Linux tarball
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup .NET 8
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0.x'

      - name: 解析版本号 + 镜像标签
        id: ver
        run: |
          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
            V="${GITHUB_REF_NAME#v}"
          else
            V="${{ github.event.inputs.version }}"
          fi
          IMG="ghcr.io/$(echo '${{ github.repository_owner }}' | tr 'A-Z' 'a-z')/dc-cli"
          echo "version=$V" >> "$GITHUB_OUTPUT"
          # 预发布版本（含 -）不移动 latest
          if [[ "$V" == *-* ]]; then
            echo "tags=$IMG:$V" >> "$GITHUB_OUTPUT"
          else
            echo "tags=$IMG:$V,$IMG:latest" >> "$GITHUB_OUTPUT"
          fi
          echo "解析版本号：$V"

      # ── Linux self-contained 单文件 tarball（x64 + arm64，用户无需装 .NET 运行时） ──
      - name: Publish linux-x64
        run: >
          dotnet publish src/Dc.Cli/Dc.Cli.csproj -c Release -r linux-x64 --self-contained true
          -p:PublishSingleFile=true -p:DebugType=none -p:Version=${{ steps.ver.outputs.version }}
          -o publish/linux-x64
      - name: Publish linux-arm64
        run: >
          dotnet publish src/Dc.Cli/Dc.Cli.csproj -c Release -r linux-arm64 --self-contained true
          -p:PublishSingleFile=true -p:DebugType=none -p:Version=${{ steps.ver.outputs.version }}
          -o publish/linux-arm64
      - name: 打包 tar.gz
        run: |
          ver="${{ steps.ver.outputs.version }}"
          tar -C publish/linux-x64  -czf "Dc.Cli-v$ver-linux-x64.tar.gz" .
          tar -C publish/linux-arm64 -czf "Dc.Cli-v$ver-linux-arm64.tar.gz" .
          ls -lh *.tar.gz

      # ── 多架构 Docker 镜像 → GHCR ──
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login GHCR
        if: startsWith(github.ref, 'refs/tags/')
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build & Push 镜像（tag 时推 amd64+arm64，干跑只 build amd64）
        uses: docker/build-push-action@v6
        with:
          context: .
          push: ${{ startsWith(github.ref, 'refs/tags/') }}
          platforms: ${{ startsWith(github.ref, 'refs/tags/') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
          build-args: VERSION=${{ steps.ver.outputs.version }}
          tags: ${{ steps.ver.outputs.tags }}

      # 干跑：tarball 传 artifact（镜像已 build 验证、未推）
      - name: 上传 tarball artifact（干跑）
        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
        uses: actions/upload-artifact@v4
        with:
          name: dc-cli-linux
          path: "*.tar.gz"
          retention-days: 14

      # 正式：把 Linux tarball 挂到 release job 已创建的 Release
      - name: 附加 tarball 到 Release
        if: startsWith(github.ref, 'refs/tags/')
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload "${GITHUB_REF_NAME}" *.tar.gz --clobber