release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: true

jobs:
  release:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        include:
          - os: windows-2022
          - os: ubuntu-22.04
          - os: macos-14

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Add macOS targets
        if: runner.os == 'macOS'
        run: |
          rustup target add aarch64-apple-darwin x86_64-apple-darwin

      - name: Install Linux system deps
        if: runner.os == 'Linux'
        shell: bash
        run: |
          set -euxo pipefail
          sudo apt-get update
          # Core build tools and pkg-config
          sudo apt-get install -y --no-install-recommends \
            build-essential \
            pkg-config \
            curl \
            wget \
            file \
            patchelf \
            libssl-dev
          # GTK/GLib stack for gdk-3.0, glib-2.0, gio-2.0
          sudo apt-get install -y --no-install-recommends \
            libgtk-3-dev \
            librsvg2-dev \
            libayatana-appindicator3-dev
          # WebKit2GTK (version differs across Ubuntu images; try 4.1 then 4.0)
          sudo apt-get install -y --no-install-recommends libwebkit2gtk-4.1-dev \
            || sudo apt-get install -y --no-install-recommends libwebkit2gtk-4.0-dev
          # libsoup also changed major version; prefer 3.0 with fallback to 2.4
          sudo apt-get install -y --no-install-recommends libsoup-3.0-dev \
            || sudo apt-get install -y --no-install-recommends libsoup2.4-dev

      - name: Setup pnpm
        uses: pnpm/action-setup@v2
        with:
          version: 10.12.3
          run_install: false

      - name: Get pnpm store directory
        id: pnpm-store
        shell: bash
        run: echo "path=$(pnpm store path --silent)" >> $GITHUB_OUTPUT

      - name: Setup pnpm cache
        uses: actions/cache@v4
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: ${{ runner.os }}-pnpm-store-

      - name: Install frontend deps
        run: pnpm install --frozen-lockfile

      - name: Set package versions from tag
        shell: bash
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          TAURI_VERSION="$VERSION"
          if [[ "$VERSION" =~ ^([0-9]+\.[0-9]+\.[0-9]+)-rc\.([0-9]+)$ ]]; then
            TAURI_VERSION="${BASH_REMATCH[1]}-${BASH_REMATCH[2]}"
          elif [[ "$VERSION" =~ ^([0-9]+\.[0-9]+\.[0-9]+)-preview\.([0-9]+)$ ]]; then
            TAURI_VERSION="${BASH_REMATCH[1]}-${BASH_REMATCH[2]}"
          fi
          echo "Setting package metadata version to $VERSION"
          echo "Setting Tauri bundle version to $TAURI_VERSION"
          node - "$VERSION" "$TAURI_VERSION" <<'NODE'
          const fs = require('fs');
          const version = process.argv[2];
          const tauriVersion = process.argv[3];

          const packageJson = JSON.parse(fs.readFileSync('package.json', 'utf8'));
          packageJson.version = version;
          fs.writeFileSync('package.json', `${JSON.stringify(packageJson, null, 2)}\n`);

          const tauriConfig = JSON.parse(fs.readFileSync('src-tauri/tauri.conf.json', 'utf8'));
          tauriConfig.version = tauriVersion;
          fs.writeFileSync('src-tauri/tauri.conf.json', `${JSON.stringify(tauriConfig, null, 2)}\n`);
          NODE
          sed -i.bak -E "0,/^version = \".*\"/s//version = \"$VERSION\"/" src-tauri/Cargo.toml
          rm -f src-tauri/Cargo.toml.bak
          cargo metadata --manifest-path src-tauri/Cargo.toml --format-version 1 --no-deps >/dev/null

      - name: Set Tauri signing key
        shell: bash
        env:
          RAW_TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          RAW_TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          set -euo pipefail
          # Tauri CLI 期望：tauri signer generate / tauri signer encode 输出的单行 base64（无换行、无空格）
          if [ -z "${RAW_TAURI_SIGNING_PRIVATE_KEY:-}" ]; then
            echo "❌ TAURI_SIGNING_PRIVATE_KEY Secret 为空" >&2
            exit 1
          fi
          CLEAN_KEY=$(printf '%s' "$RAW_TAURI_SIGNING_PRIVATE_KEY" | tr -d ' \r\n')
          if ! echo -n "$CLEAN_KEY" | base64 --decode >/dev/null 2>&1; then
            echo "❌ TAURI_SIGNING_PRIVATE_KEY 不是有效的 base64（请使用 tauri signer generate 的 private 字段或 tauri signer encode 输出）" >&2
            exit 1
          fi
          {
            printf 'TAURI_SIGNING_PRIVATE_KEY=%s\n' "$CLEAN_KEY"
            if [ -n "${RAW_TAURI_SIGNING_PRIVATE_KEY_PASSWORD:-}" ]; then
              printf 'TAURI_SIGNING_PRIVATE_KEY_PASSWORD=%s\n' "$RAW_TAURI_SIGNING_PRIVATE_KEY_PASSWORD"
            fi
          } >> "$GITHUB_ENV"
          echo "✅ Tauri signing key configured（已去除空白并通过 base64 校验）"

      - name: Build Tauri App (macOS)
        if: runner.os == 'macOS'
        run: pnpm tauri build --target universal-apple-darwin

      - name: Build Tauri App (Windows)
        if: runner.os == 'Windows'
        run: pnpm tauri build --bundles msi

      - name: Build Tauri App (Linux)
        if: runner.os == 'Linux'
        run: pnpm tauri build

      - name: Prepare macOS Assets
        if: runner.os == 'macOS'
        shell: bash
        run: |
          set -euxo pipefail
          mkdir -p release-assets
          VERSION="${GITHUB_REF_NAME}"  # e.g., v3.5.0
          echo "Looking for updater artifact (.tar.gz) and .app for zip..."
          TAR_GZ=""; APP_PATH=""
          for path in \
            "src-tauri/target/universal-apple-darwin/release/bundle/macos" \
            "src-tauri/target/aarch64-apple-darwin/release/bundle/macos" \
            "src-tauri/target/x86_64-apple-darwin/release/bundle/macos" \
            "src-tauri/target/release/bundle/macos"; do
            if [ -d "$path" ]; then
              [ -z "$TAR_GZ" ] && TAR_GZ=$(find "$path" -maxdepth 1 -name "*.tar.gz" -type f | head -1 || true)
              [ -z "$APP_PATH" ] && APP_PATH=$(find "$path" -maxdepth 1 -name "*.app" -type d | head -1 || true)
            fi
          done
          if [ -z "$TAR_GZ" ]; then
            echo "No macOS .tar.gz updater artifact found" >&2
            exit 1
          fi
          # 重命名 tar.gz 为统一格式
          NEW_TAR_GZ="CC-Switch-${VERSION}-macOS.tar.gz"
          cp "$TAR_GZ" "release-assets/$NEW_TAR_GZ"
          [ -f "$TAR_GZ.sig" ] && cp "$TAR_GZ.sig" "release-assets/$NEW_TAR_GZ.sig" || echo ".sig for macOS not found yet"
          echo "macOS updater artifact copied: $NEW_TAR_GZ"
          if [ -n "$APP_PATH" ]; then
            APP_DIR=$(dirname "$APP_PATH"); APP_NAME=$(basename "$APP_PATH")
            NEW_ZIP="CC-Switch-${VERSION}-macOS.zip"
            cd "$APP_DIR"
            ditto -c -k --sequesterRsrc --keepParent "$APP_NAME" "$NEW_ZIP"
            mv "$NEW_ZIP" "$GITHUB_WORKSPACE/release-assets/"
            echo "macOS zip ready: $NEW_ZIP"
          else
            echo "No .app found to zip (optional)" >&2
          fi

      - name: Prepare Windows Assets
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          New-Item -ItemType Directory -Force -Path release-assets | Out-Null
          $VERSION = $env:GITHUB_REF_NAME  # e.g., v3.5.0
          # 仅打包 MSI 安装器 + .sig（用于 Updater）
          $msi = Get-ChildItem -Path 'src-tauri/target/release/bundle/msi' -Recurse -Include *.msi -ErrorAction SilentlyContinue | Select-Object -First 1
          if ($null -eq $msi) {
            # 兜底：全局搜索 .msi
            $msi = Get-ChildItem -Path 'src-tauri/target/release/bundle' -Recurse -Include *.msi -ErrorAction SilentlyContinue | Select-Object -First 1
          }
          if ($null -ne $msi) {
            $dest = "CC-Switch-$VERSION-Windows.msi"
            Copy-Item $msi.FullName (Join-Path release-assets $dest)
            Write-Host "Installer copied: $dest"
            $sigPath = "$($msi.FullName).sig"
            if (Test-Path $sigPath) {
              Copy-Item $sigPath (Join-Path release-assets ("$dest.sig"))
              Write-Host "Signature copied: $dest.sig"
            } else {
              Write-Warning "Signature not found for $($msi.Name)"
            }
          } else {
            Write-Warning 'No Windows MSI installer found'
          }
          # 绿色版（portable）：仅可执行文件打 zip（不参与 Updater）
          $exeCandidates = @(
            'src-tauri/target/release/cc-switch.exe',
            'src-tauri/target/x86_64-pc-windows-msvc/release/cc-switch.exe'
          )
          $exePath = $exeCandidates | Where-Object { Test-Path $_ } | Select-Object -First 1
          if ($null -ne $exePath) {
            $portableDir = 'release-assets/CC-Switch-Portable'
            New-Item -ItemType Directory -Force -Path $portableDir | Out-Null
            Copy-Item $exePath $portableDir
            $portableIniPath = Join-Path $portableDir 'portable.ini'
            $portableContent = @(
              '# CC Switch portable build marker',
              'portable=true'
            )
            $portableContent | Set-Content -Path $portableIniPath -Encoding UTF8
            $portableZip = "release-assets/CC-Switch-$VERSION-Windows-Portable.zip"
            Compress-Archive -Path "$portableDir/*" -DestinationPath $portableZip -Force
            Remove-Item -Recurse -Force $portableDir
            Write-Host "Windows portable zip created: CC-Switch-$VERSION-Windows-Portable.zip"
          } else {
            Write-Warning 'Portable exe not found'
          }

      - name: Prepare Linux Assets
        if: runner.os == 'Linux'
        shell: bash
        run: |
          set -euxo pipefail
          mkdir -p release-assets
          VERSION="${GITHUB_REF_NAME}"  # e.g., v3.5.0
          # Updater artifact: AppImage（含对应 .sig）
          APPIMAGE=$(find src-tauri/target/release/bundle -name "*.AppImage" | head -1 || true)
          if [ -n "$APPIMAGE" ]; then
            NEW_APPIMAGE="CC-Switch-${VERSION}-Linux.AppImage"
            cp "$APPIMAGE" "release-assets/$NEW_APPIMAGE"
            [ -f "$APPIMAGE.sig" ] && cp "$APPIMAGE.sig" "release-assets/$NEW_APPIMAGE.sig" || echo ".sig for AppImage not found"
            echo "AppImage copied: $NEW_APPIMAGE"
          else
            echo "No AppImage found under target/release/bundle" >&2
          fi
          # 额外上传 .deb（用于手动安装，不参与 Updater）
          DEB=$(find src-tauri/target/release/bundle -name "*.deb" | head -1 || true)
          if [ -n "$DEB" ]; then
            NEW_DEB="CC-Switch-${VERSION}-Linux.deb"
            cp "$DEB" "release-assets/$NEW_DEB"
            echo "Deb package copied: $NEW_DEB"
          else
            echo "No .deb found (optional)"
          fi

      - name: List prepared assets
        shell: bash
        run: |
          ls -la release-assets || true

      - name: Collect Signatures
        shell: bash
        run: |
          set -euo pipefail
          echo "Collected signatures (if any alongside artifacts):"
          ls -la release-assets/*.sig || echo "No signatures found"

      - name: Validate release notes
        shell: bash
        run: |
          set -euo pipefail
          test -f "docs/release-note-${GITHUB_REF_NAME}-zh.md"

      - name: Upload Release Assets
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: cc-switch-web ${{ github.ref_name }}
          prerelease: ${{ contains(github.ref_name, '-') || github.ref_name == 'v0.14.0' }}
          body_path: docs/release-note-${{ github.ref_name }}-zh.md
          files: release-assets/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: List generated bundles (debug)
        if: always()
        shell: bash
        run: |
          echo "Listing bundles in src-tauri/target..."
          find src-tauri/target -maxdepth 4 -type f -name "*.*" 2>/dev/null || true

  build-web-server:
    name: Build Web Server Binary
    runs-on: ubuntu-22.04
    needs: release  # 等待主 release 完成
    strategy:
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            artifact: cc-switch-server-linux-x86_64
          - target: aarch64-unknown-linux-gnu
            artifact: cc-switch-server-linux-aarch64

    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Setup pnpm
        uses: pnpm/action-setup@v2
        with:
          version: 10.12.3

      - name: Install frontend deps
        run: pnpm install --frozen-lockfile

      - name: Set package versions from tag
        shell: bash
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          TAURI_VERSION="$VERSION"
          if [[ "$VERSION" =~ ^([0-9]+\.[0-9]+\.[0-9]+)-rc\.([0-9]+)$ ]]; then
            TAURI_VERSION="${BASH_REMATCH[1]}-${BASH_REMATCH[2]}"
          elif [[ "$VERSION" =~ ^([0-9]+\.[0-9]+\.[0-9]+)-preview\.([0-9]+)$ ]]; then
            TAURI_VERSION="${BASH_REMATCH[1]}-${BASH_REMATCH[2]}"
          fi
          echo "Setting package metadata version to $VERSION"
          echo "Setting Tauri bundle version to $TAURI_VERSION"
          node - "$VERSION" "$TAURI_VERSION" <<'NODE'
          const fs = require('fs');
          const version = process.argv[2];
          const tauriVersion = process.argv[3];

          const packageJson = JSON.parse(fs.readFileSync('package.json', 'utf8'));
          packageJson.version = version;
          fs.writeFileSync('package.json', `${JSON.stringify(packageJson, null, 2)}\n`);

          const tauriConfig = JSON.parse(fs.readFileSync('src-tauri/tauri.conf.json', 'utf8'));
          tauriConfig.version = tauriVersion;
          fs.writeFileSync('src-tauri/tauri.conf.json', `${JSON.stringify(tauriConfig, null, 2)}\n`);
          NODE
          sed -i.bak -E "0,/^version = \".*\"/s//version = \"$VERSION\"/" src-tauri/Cargo.toml
          rm -f src-tauri/Cargo.toml.bak
          cargo metadata --manifest-path src-tauri/Cargo.toml --format-version 1 --no-deps >/dev/null

      - name: Build web assets
        run: pnpm build:web

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install cross
        run: cargo install cross --git https://github.com/cross-rs/cross

      - name: Install build deps (native only)
        if: matrix.target == 'x86_64-unknown-linux-gnu'
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends libssl-dev pkg-config

      - name: Build server binary
        run: |
          if [ "${{ matrix.target }}" = "x86_64-unknown-linux-gnu" ]; then
            cd src-tauri
            cargo build --release --no-default-features --features web-server --example server --target ${{ matrix.target }}
          else
            # cross 从项目根目录运行，确保 dist-web 目录在容器内可访问
            cross build --release --no-default-features --features web-server --example server --target ${{ matrix.target }} --manifest-path src-tauri/Cargo.toml
          fi

      - name: Prepare artifact
        run: |
          mkdir -p release-assets
          cp src-tauri/target/${{ matrix.target }}/release/examples/server release-assets/${{ matrix.artifact }}
          chmod +x release-assets/${{ matrix.artifact }}

      - name: Upload to release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          files: release-assets/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  assemble-latest-json:
    name: Assemble latest.json
    runs-on: ubuntu-22.04
    needs: [release, build-web-server]
    permissions:
      contents: write
    steps:
      - name: Prepare GH
        run: |
          gh --version || (type -p curl >/dev/null && sudo apt-get update && sudo apt-get install -y gh || true)
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Download all release assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euxo pipefail
          TAG="${GITHUB_REF_NAME}"
          mkdir -p dl
          gh release download "$TAG" --dir dl --repo "$GITHUB_REPOSITORY"
          ls -la dl || true
      - name: Generate latest.json
        env:
          REPO: ${{ github.repository }}
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          VERSION="${TAG#v}"
          TAURI_VERSION="$VERSION"
          if [[ "$VERSION" =~ ^([0-9]+\.[0-9]+\.[0-9]+)-rc\.([0-9]+)$ ]]; then
            TAURI_VERSION="${BASH_REMATCH[1]}-${BASH_REMATCH[2]}"
          elif [[ "$VERSION" =~ ^([0-9]+\.[0-9]+\.[0-9]+)-preview\.([0-9]+)$ ]]; then
            TAURI_VERSION="${BASH_REMATCH[1]}-${BASH_REMATCH[2]}"
          fi
          PUB_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
          base_url="https://github.com/$REPO/releases/download/$TAG"
          # 初始化空平台映射
          mac_url=""; mac_sig=""
          win_url=""; win_sig=""
          linux_url=""; linux_sig=""
          shopt -s nullglob
          for sig in dl/*.sig; do
            base=${sig%.sig}
            fname=$(basename "$base")
            url="$base_url/$fname"
            sig_content=$(cat "$sig")
            case "$fname" in
              *.tar.gz)
                # 视为 macOS updater artifact
                mac_url="$url"; mac_sig="$sig_content";;
              *.AppImage|*.appimage)
                linux_url="$url"; linux_sig="$sig_content";;
              *.msi|*.exe)
                win_url="$url"; win_sig="$sig_content";;
            esac
          done
          # 构造 JSON（仅包含存在的目标）
          tmp_json=$(mktemp)
          {
            echo '{'
            echo "  \"version\": \"$TAURI_VERSION\",";
            echo "  \"notes\": \"Release $TAG\",";
            echo "  \"pub_date\": \"$PUB_DATE\",";
            echo '  "platforms": {'
            first=1
            if [ -n "$mac_url" ] && [ -n "$mac_sig" ]; then
              # 为兼容 arm64 / x64，重复写入两个键，指向同一 universal 包
              for key in darwin-aarch64 darwin-x86_64; do
                [ $first -eq 0 ] && echo ','
                echo "    \"$key\": {\"signature\": \"$mac_sig\", \"url\": \"$mac_url\"}"
                first=0
              done
            fi
            if [ -n "$win_url" ] && [ -n "$win_sig" ]; then
              [ $first -eq 0 ] && echo ','
              echo "    \"windows-x86_64\": {\"signature\": \"$win_sig\", \"url\": \"$win_url\"}"
              first=0
            fi
            if [ -n "$linux_url" ] && [ -n "$linux_sig" ]; then
              [ $first -eq 0 ] && echo ','
              echo "    \"linux-x86_64\": {\"signature\": \"$linux_sig\", \"url\": \"$linux_url\"}"
              first=0
            fi
            echo '  }'
            echo '}'
          } > "$tmp_json"
          echo "Generated latest.json:" && cat "$tmp_json"
          mv "$tmp_json" latest.json
      - name: Upload latest.json to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euxo pipefail
          gh release upload "$GITHUB_REF_NAME" latest.json --clobber --repo "$GITHUB_REPOSITORY"

  docker-publish:
    name: Build and publish Docker image
    runs-on: ubuntu-22.04
    needs: [release, build-web-server]
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set version and image name
        id: vars
        run: |
          echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
          # Docker 镜像名必须全小写
          OWNER_LC=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
          echo "image_name=ghcr.io/${OWNER_LC}/cc-switch-web" >> "$GITHUB_OUTPUT"

      - name: Set Docker tags
        id: docker-tags
        shell: bash
        run: |
          set -euo pipefail
          IMAGE_NAME="${{ steps.vars.outputs.image_name }}"
          VERSION="${{ steps.vars.outputs.version }}"
          {
            echo "tags<<EOF"
            # 所有 tag 都推送版本标签；稳定版额外推送 latest
            echo "${IMAGE_NAME}:${VERSION}"
            if [[ "${GITHUB_REF_NAME}" != *-* && "${GITHUB_REF_NAME}" != "v0.14.0" ]]; then
              echo "${IMAGE_NAME}:latest"
            fi
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Prepare GH CLI
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euxo pipefail
          gh --version || (type -p curl >/dev/null && sudo apt-get update && sudo apt-get install -y gh)

      - name: Download prebuilt server binaries from release
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euxo pipefail
          mkdir -p release-assets
          gh release download "${GITHUB_REF_NAME}" \
            --repo "${GITHUB_REPOSITORY}" \
            --dir release-assets \
            --pattern "cc-switch-server-linux-*"
          ls -la release-assets
          test -f release-assets/cc-switch-server-linux-x86_64
          test -f release-assets/cc-switch-server-linux-aarch64
          chmod +x release-assets/cc-switch-server-linux-x86_64 release-assets/cc-switch-server-linux-aarch64

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: Dockerfile.release
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.docker-tags.outputs.tags }}
          labels: |
            org.opencontainers.image.source=${{ github.repository }}
            org.opencontainers.image.title=cc-switch-web
            org.opencontainers.image.description=CC Switch web server image
            org.opencontainers.image.version=${{ steps.vars.outputs.version }}
            org.opencontainers.image.revision=${{ github.sha }}