publish-stable.yml

name: publish-stable

on:
  push:
    branches: [ stable ]
  workflow_dispatch:

jobs:
  publish-tauri:
    permissions:
      contents: write
      # id-token: write   # <-- uncomment if you later adopt OIDC code-signing
    env:
      RUSTC_WRAPPER: sccache
      SCCACHE_GHA_ENABLED: ${{ vars.SSCCACHE_GHA_ENABLED }}
      SCCACHE_CACHE_SIZE: ${{ vars.SSCCACHE_SIZE }}
      # Flatpak is enabled in CI.
      OPENVCS_ENABLE_FLATPAK: ${{ vars.ENABLE_FLATPAK }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: ubuntu-24.04
            args: ''
          - platform: windows-latest
            args: ''

    runs-on: ${{ matrix.platform }}

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          lfs: true
          fetch-depth: 0

      - name: Compute version tag
        id: version
        shell: bash
        run: |
          set -euo pipefail
          VERSION="$(grep -m1 '^version *= *\"' Backend/Cargo.toml | sed -E 's/^version *= *\"([^\"]+)\".*/\1/')"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "tag=openvcs-v$VERSION" >> "$GITHUB_OUTPUT"

      # ---------- Frontend (Node + Vite) ----------
      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: '24'
          cache: 'npm'
          cache-dependency-path: Frontend/package-lock.json

      - name: Install frontend deps
        working-directory: Frontend
        run: npm ci

      - name: Build frontend
        working-directory: Frontend
        env:
          VITE_SENTRY_ENVIRONMENT: stable
          VITE_SENTRY_RELEASE: ${{ steps.version.outputs.tag }}
          SENTRY_AUTH_TOKEN: ${{ matrix.platform == 'ubuntu-24.04' && secrets.SENTRY_AUTH_TOKEN || '' }}
          SENTRY_ORG: ${{ matrix.platform == 'ubuntu-24.04' && secrets.SENTRY_ORG || '' }}
          SENTRY_PROJECT: ${{ matrix.platform == 'ubuntu-24.04' && secrets.SENTRY_PROJECT || '' }}
        run: npm run build

      # ---------- Rust toolchain & deps ----------
      - name: Install Rust (stable)
        uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # stable
        with:
          components: rustfmt, clippy

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Install Linux build deps (Ubuntu)
        if: matrix.platform == 'ubuntu-24.04'
        shell: bash
        run: |
          set -euxo pipefail
          sudo apt-get update
          sudo apt-get install -y libappindicator3-dev librsvg2-dev patchelf
          # Prefer WebKitGTK 4.1; fall back to 4.0 if 4.1 isn't available
          sudo apt-get install -y libwebkit2gtk-4.1-dev || sudo apt-get install -y libwebkit2gtk-4.0-dev

      # ---------- Flatpak (Linux only; artifact) ----------
      - name: Install Flatpak tooling
        if: matrix.platform == 'ubuntu-24.04' && env.OPENVCS_ENABLE_FLATPAK == '1' && hashFiles('packaging/flatpak/io.github.jordonbc.OpenVCS.yml') != ''
        shell: bash
        run: |
          set -euxo pipefail
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends flatpak flatpak-builder appstream elfutils
          flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
          flatpak install --user -y flathub org.gnome.Platform//49 org.gnome.Sdk//49
          # Cargo/rustc must come from the Flatpak SDK environment (not the host toolchain).
          # Try common branches to avoid coupling this workflow to the host runner image.
          flatpak install --user -y flathub org.freedesktop.Sdk.Extension.rust-stable//25.08 \
            || flatpak install --user -y flathub org.freedesktop.Sdk.Extension.rust-stable//24.08 \
            || flatpak install --user -y flathub org.freedesktop.Sdk.Extension.rust-stable

      - name: Verify Flatpak manifest exists
        if: matrix.platform == 'ubuntu-24.04' && env.OPENVCS_ENABLE_FLATPAK == '1' && hashFiles('packaging/flatpak/io.github.jordonbc.OpenVCS.yml') != ''
        shell: bash
        run: |
          set -euxo pipefail
          ls -la packaging/flatpak
          test -f packaging/flatpak/io.github.jordonbc.OpenVCS.yml

      - name: Build Flatpak bundle
        if: matrix.platform == 'ubuntu-24.04' && env.OPENVCS_ENABLE_FLATPAK == '1' && hashFiles('packaging/flatpak/io.github.jordonbc.OpenVCS.yml') != ''
        shell: bash
        run: |
          set -euxo pipefail
          # Stable production builds should report the plain package version (not git metadata).
          export OPENVCS_OFFICIAL_RELEASE='1'
          flatpak-builder --user --force-clean --repo=repo build-flatpak packaging/flatpak/io.github.jordonbc.OpenVCS.yml
          flatpak build-bundle repo OpenVCS.flatpak io.github.jordonbc.OpenVCS

      - name: Upload Flatpak bundle (artifact)
        if: matrix.platform == 'ubuntu-24.04' && env.OPENVCS_ENABLE_FLATPAK == '1' && hashFiles('packaging/flatpak/io.github.jordonbc.OpenVCS.yml') != ''
        uses: actions/upload-artifact@v7
        with:
          name: OpenVCS-flatpak-stable
          path: OpenVCS.flatpak

      # ---------- Cargo caching ----------
      - name: Rust cache
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          cache-on-failure: true

      - name: Cargo fmt (check)
        run: cargo fmt --all -- --check

      - name: Cargo clippy
        run: cargo clippy --all-targets -- -D warnings

      - name: Write channel Tauri config override
        env:
          OPENVCS_UPDATE_CHANNEL: stable
        run: node scripts/write-tauri-channel-config.js "${{ runner.temp }}/tauri.channel.conf.json"

      # ---------- Build & publish with Tauri action ----------
      - name: Build and create GitHub Release (draft)
        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # action-v0.6.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # We already built the Frontend; tell Backend/Tauri to skip any beforeBuildCommand
          FRONTEND_SKIP_BUILD: '1'
          OPENVCS_UPDATE_CHANNEL: stable
          OPENVCS_SENTRY_DSN: ${{ secrets.OPENVCS_SENTRY_DSN }}
          OPENVCS_SENTRY_ENVIRONMENT: stable
          # Stable production builds should report the plain package version (not git metadata).
          OPENVCS_OFFICIAL_RELEASE: '1'
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_PRIVATE_KEY_PASSWORD }}
        with:
          # Point the action at your Tauri project (Backend/)
          projectPath: Backend
          # If your Tauri config expects distDir to already exist, ensure Frontend build outputs there
          # Alternatively, if Backend/tauri.conf.json points to "../Frontend/dist", no change needed.

          tagName: ${{ steps.version.outputs.tag }}
          releaseName: OpenVCS v${{ steps.version.outputs.version }}
          releaseBody: 'See the assets to download this version and install.'
          releaseDraft: true
          prerelease: false
          args: ${{ format('{0} --config {1}/tauri.channel.conf.json', matrix.args || '', runner.temp) }}
          includeDebug: false   # default; set true if you want debug archives too
          # bundles: ''           # e.g. 'deb,appimage,msi,nsis' if you want to restrict output

      - name: Upload Flatpak bundle to GitHub Release
        if: matrix.platform == 'ubuntu-24.04' && env.OPENVCS_ENABLE_FLATPAK == '1' && hashFiles('packaging/flatpak/io.github.jordonbc.OpenVCS.yml') != ''
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release upload "${{ steps.version.outputs.tag }}" OpenVCS.flatpak --clobber