release.yml

name: Release

on:
  push:
    tags:
      - v*
  workflow_dispatch:
env:
  BINARY_NAME: plumeimpactor
  BINARY_NAME_CLI: plumesign
  BUNDLE_NAME: Impactor

jobs:
  build-linux:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: true
      matrix:
        include:
          - os: ubuntu-24.04
            arch: x86_64
          - os: ubuntu-24.04-arm
            arch: aarch64
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - name: Use Wild linker
        uses: davidlattimore/wild-action@latest
      - uses: snok/install-poetry@v1
      - uses: actions/setup-python@v6
        with:
          python-version: "3.14"

      - name: Install and cache apt pkgs
        uses: awalsh128/cache-apt-pkgs-action@latest
        with:
          packages: flatpak flatpak-builder libglib2.0-dev libsecret-1-dev libgtk-3-dev libpng-dev libjpeg-dev libgl1-mesa-dev libglu1-mesa-dev libxkbcommon-dev libexpat1-dev libtiff-dev libxdo-dev libappindicator3-dev
          version: 1.0

      - name: Build binaries
        run: |
          make linux PROFILE=release APPIMAGE=1

      - name: Upload binaries
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-linux-${{ matrix.arch }}
          path: dist/*

  build-windows:
    runs-on: ${{ matrix.runner }}
    strategy:
      matrix:
        include:
          - target: x86_64-pc-windows-gnu
            arch: x86_64
            runner: ubuntu-24.04
          - target: i686-pc-windows-gnu
            arch: x86
            runner: ubuntu-24.04
          - target: aarch64-pc-windows-msvc
            arch: arm64
            runner: windows-11-arm
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install mingw-w64 (x86_64/x86)
        if: matrix.arch == 'x86_64' || matrix.arch == 'x86'
        run: |
          sudo apt-get update
          sudo apt-get install -y mingw-w64 nasm

      - name: Build binaries (Linux cross-compile)
        if: matrix.arch != 'arm64'
        run: |
          cargo build --bins --workspace --release --target ${{ matrix.target }}
          mkdir -p dist
          cp target/${{ matrix.target }}/release/plumeimpactor.exe dist/Impactor-windows-${{ matrix.arch }}-portable.exe
          cp target/${{ matrix.target }}/release/plumesign.exe dist/plumesign-windows-${{ matrix.arch }}.exe

      - name: Build binaries (Windows ARM64 native)
        if: matrix.arch == 'arm64'
        shell: pwsh
        run: |
          cargo build --bins --workspace --release --target ${{ matrix.target }}
          New-Item -ItemType Directory -Force -Path dist
          Copy-Item "target/${{ matrix.target }}/release/plumeimpactor.exe" "dist/Impactor-windows-${{ matrix.arch }}-portable.exe"
          Copy-Item "target/${{ matrix.target }}/release/plumesign.exe" "dist/plumesign-windows-${{ matrix.arch }}.exe"

      - name: Upload Bundles
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-windows-${{ matrix.arch }}
          path: dist/*.exe

  build-windows-installer:
    runs-on: windows-latest
    needs: [build-windows]
    strategy:
      matrix:
        arch: [x86_64, x86, arm64]
    steps:
      - uses: actions/checkout@v4

      - name: Download Windows Artifacts
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-windows-${{ matrix.arch }}
          path: dist

      - name: Install NSIS
        run: choco install nsis.portable

      - name: Build NSIS Installer
        run: |
          mkdir dist\nsis
          copy package\windows\* dist\nsis\
          copy dist\Impactor-windows-${{ matrix.arch }}-portable.exe dist\nsis\plumeimpactor.exe
          makensis dist\nsis\installer.nsi
          move dist\nsis\installer.exe dist\Impactor-windows-${{ matrix.arch }}-setup.exe

      - name: Upload Installer
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-windows-installer-${{ matrix.arch }}
          path: dist/Impactor-windows-${{ matrix.arch }}-setup.exe

  build-macos-slices:
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        include:
          - target: aarch64-apple-darwin
            arch: arm
            suffix: arm64
            osxcross_prefix: arm64-apple-darwin21.4
          - target: x86_64-apple-darwin
            arch: intel
            suffix: x86_64
            osxcross_prefix: x86_64-apple-darwin21.4
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - name: Setup osxcross
        uses: Timmmm/setup-osxcross@v3
        with:
          osx-version: "12.3"

      - name: Build binaries (${{ matrix.arch }})
        run: |
          target_env=$(echo "${{ matrix.target }}" | tr '-' '_')
          target_env_upper=$(echo "${target_env}" | tr '[:lower:]' '[:upper:]')
          prefix="${{ matrix.osxcross_prefix }}"
          osxcross_bin="$(dirname "$(command -v "${prefix}-clang")")"
          osxcross_root="$(cd "${osxcross_bin}/.." && pwd)"
          sdk_dir="${osxcross_root}/SDK"
          if [ -d "${sdk_dir}" ]; then
            sdkroot="$(ls -d "${sdk_dir}"/MacOSX*.sdk 2>/dev/null | sort -V | tail -n1)"
            if [ -n "${sdkroot}" ]; then
              export SDKROOT="${sdkroot}"
            fi
          fi
          export MACOSX_DEPLOYMENT_TARGET="11.0"
          ld_path=""
          for name in "${prefix}-ld" "${prefix}-ld64" "ld64" "ld"; do
            if [ -x "${osxcross_bin}/${name}" ]; then
              ld_path="${osxcross_bin}/${name}"
              break
            fi
          done
          export "CC_${target_env}=${osxcross_bin}/${prefix}-clang"
          export "CXX_${target_env}=${osxcross_bin}/${prefix}-clang++"
          export "AR_${target_env}=${osxcross_bin}/${prefix}-ar"
          export "RANLIB_${target_env}=${osxcross_bin}/${prefix}-ranlib"
          export "CARGO_TARGET_${target_env_upper}_LINKER=${osxcross_bin}/${prefix}-clang"
          if [ -n "${ld_path}" ]; then
            export "CFLAGS_${target_env}=-fuse-ld=${ld_path}"
            export "CXXFLAGS_${target_env}=-fuse-ld=${ld_path}"
            export "LDFLAGS_${target_env}=-fuse-ld=${ld_path}"
            export RUSTFLAGS="${RUSTFLAGS:+$RUSTFLAGS }-C link-arg=-fuse-ld=${ld_path}"
          fi
          cargo build --bins --workspace --release --target ${{ matrix.target }}
          mkdir -p dist
          cp target/${{ matrix.target }}/release/plumeimpactor dist/plumeimpactor-macos-${{ matrix.suffix }}
          cp target/${{ matrix.target }}/release/plumesign dist/plumesign-macos-${{ matrix.suffix }}

      - name: Upload ${{ matrix.arch }} Slice
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-macos-slice-${{ matrix.arch }}
          path: dist/*

  build-macos-universal:
    runs-on: macos-latest
    needs: [build-macos-slices]
    steps:
      - uses: actions/checkout@v4

      - name: Get ARM Slice
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-macos-slice-arm
          path: dist/slices

      - name: Get Intel Slice
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-macos-slice-intel
          path: dist/slices

      - name: Setup Certificates
        uses: apple-actions/import-codesign-certs@v5
        with:
          p12-file-base64: ${{ secrets.DEV_ID_P12_BASE64 }}
          p12-password: ${{ secrets.DEV_ID_P12_PASSWORD }}

      - name: Download CreateDMG
        run: |
          brew install create-dmg

      - name: Create Universal Binary
        run: |
          make macos BIN1=dist/slices/${{ env.BINARY_NAME }}-macos-arm64 BIN2=dist/slices/${{ env.BINARY_NAME }}-macos-x86_64 BUNDLE=1 ARCH=universal
          make macos BIN1=dist/slices/${{ env.BINARY_NAME_CLI }}-macos-arm64 BIN2=dist/slices/${{ env.BINARY_NAME_CLI }}-macos-x86_64 ARCH=universal

      - name: Codesign
        run: |
          mkdir -p dist/dmg
          mv dist/${{ env.BUNDLE_NAME }}.app dist/dmg/
          codesign --deep --force --options runtime \
            --sign "${{ secrets.DEV_ID_IDENTITY_NAME }}" dist/dmg/${{ env.BUNDLE_NAME }}.app

      - name: Create DMG
        run: |
          mkdir -p dist/out
          create-dmg \
            --volname ${{ env.BUNDLE_NAME }} \
            --background "package/macos/background.png" \
            --window-pos 200 120 \
            --window-size 510 350 \
            --icon-size 100 \
            --icon ${{ env.BUNDLE_NAME }}.app 160 155 \
            --hide-extension "${{ env.BUNDLE_NAME }}.app" \
            --app-drop-link 350 155 \
            dist/${{ env.BUNDLE_NAME }}-macos-universal.dmg dist/dmg

      - name: Notarize DMG
        run: |
          xcrun notarytool submit dist/${{ env.BUNDLE_NAME }}-macos-universal.dmg --apple-id "${{ secrets.APPLE_ID_EMAIL }}" --password "${{ secrets.APPLE_ID_PASSWORD }}" --team-id "${{ secrets.APPLE_ID_TEAM }}" --wait
          xcrun stapler staple dist/${{ env.BUNDLE_NAME }}-macos-universal.dmg

      - name: Upload Universal DMG
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-macos-universal
          path: |
            dist/${{ env.BUNDLE_NAME }}-macos-universal.dmg
            dist/${{ env.BINARY_NAME_CLI }}-macos-universal

  release:
    runs-on: ubuntu-24.04
    needs: [build-linux, build-windows-installer, build-macos-universal]
    steps:
      - uses: actions/checkout@v4

      - name: Download Linux x86_64 Artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-linux-x86_64
          path: prepare/

      - name: Download Linux aarch64 Artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-linux-aarch64
          path: prepare/

      - name: Download Windows x86_64 Artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-windows-x86_64
          path: prepare/

      - name: Download Windows x86_64 Installer Artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-windows-installer-x86_64
          path: prepare/

      - name: Download Windows arm64 Artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-windows-arm64
          path: prepare/

      - name: Download Windows arm64 Installer Artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-windows-installer-arm64
          path: prepare/

      - name: Download Windows x86 Artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-windows-x86
          path: prepare/

      - name: Download Windows x86 Installer Artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-windows-installer-x86
          path: prepare/

      - name: Download MacOS Universal Artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-macos-universal
          path: prepare/

      - name: Prepare Uploads
        run: |
          mkdir -p upload
          shopt -s globstar
          mv prepare/**/*.dmg upload/
          mv prepare/**/*.appimage upload/
          mv prepare/**/*.exe upload/
          mv prepare/**/plumesign* upload/

      - name: Extract Version
        id: get_version
        run: |
          VERSION=$(awk '/\[workspace.package\]/,/^$/' Cargo.toml | sed -nE 's/version *= *"([^"]*)".*/\1/p')
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Create Release
        uses: softprops/action-gh-release@v2
        with:
          name: v${{ steps.get_version.outputs.version }}
          tag_name: v${{ steps.get_version.outputs.version }}
          files: |
            upload/*
          generate_release_notes: true
          fail_on_unmatched_files: true
          draft: true
        env:
          GITHUB_TOKEN: ${{ env.GITHUB_TOKEN }}