release.yml

# 推送 vX.Y.Z 标签后：验证版本与全仓库，再构建双架构 macOS 更新产物。
name: Release

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release-check:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.6

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Check release version
        run: bun run check:release-version -- "${GITHUB_REF_NAME}"

      - name: Verify changelog sync
        run: |
          bun run sync:changelog
          git diff --exit-code apps/desktop/src/data/app-changelog.md

      - name: Install Linux build dependencies (Tauri)
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            build-essential \
            curl \
            libssl-dev \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            patchelf

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Build companions
        run: bun run build:companions

      - name: Verify workspace
        run: bun run verify

  github-release:
    needs: release-check
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      release_id: ${{ steps.create_release.outputs.id }}
    steps:
      - name: Create draft GitHub Release
        id: create_release
        uses: softprops/action-gh-release@v3.0.3
        with:
          draft: true
          generate_release_notes: true

  publish-tauri:
    needs: github-release
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: macos-latest
            args: --target aarch64-apple-darwin
            bun_target: bun-darwin-arm64
          - platform: macos-latest
            args: --target x86_64-apple-darwin
            bun_target: bun-darwin-x64
    runs-on: ${{ matrix.platform }}
    timeout-minutes: 45
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.6

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Check release version
        run: bun run check:release-version -- "${GITHUB_REF_NAME}"

      - name: Require updater signing secret
        shell: bash
        env:
          KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
        run: |
          if [ -z "$KEY" ]; then
            echo '::error::未配置 TAURI_SIGNING_PRIVATE_KEY。请阅读 docs/桌面应用-Release与自动更新.md。'
            exit 1
          fi

      - name: Install Rust targets
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-apple-darwin,x86_64-apple-darwin

      - name: Build and upload to draft Release
        uses: tauri-apps/tauri-action@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          CHATTAKE_BUN_TARGET: ${{ matrix.bun_target }}
        with:
          projectPath: apps/desktop
          tauriScript: bun run tauri
          releaseId: ${{ needs.github-release.outputs.release_id }}
          uploadUpdaterJson: true
          args: ${{ matrix.args }}

  finalize-release:
    needs: [github-release, publish-tauri]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Stabilize updater download URLs
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          mkdir -p "${RUNNER_TEMP}/chattake-updater"
          gh release download "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" --pattern latest.json --dir "${RUNNER_TEMP}/chattake-updater"
          gh release view "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" --json assets > "${RUNNER_TEMP}/chattake-updater/assets.json"
          node scripts/stabilize-updater-json.mjs "${RUNNER_TEMP}/chattake-updater/latest.json" "${RUNNER_TEMP}/chattake-updater/assets.json"
          gh release upload "${GITHUB_REF_NAME}" --repo "${GITHUB_REPOSITORY}" "${RUNNER_TEMP}/chattake-updater/latest.json" --clobber

      - name: Publish complete Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_ID: ${{ needs.github-release.outputs.release_id }}
        run: gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" -F draft=false -f make_latest=true