release.yml

name: Release

# After CI is green on the version commit: create GitHub Release tag vX.Y.Z.
# This workflow then validates, pushes Docker :version+:latest, and attaches
# Linux/Windows Tauri installers (cargo tauri build + softprops upload).

on:
  release:
    types: [created]

permissions:
  contents: write
  packages: write

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
  CARGO_TERM_COLOR: always

jobs:
  validate:
    name: Validate Tag
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.extract.outputs.version }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.release.tag_name }}

      - name: Validate release tag matches Cargo.toml
        id: extract
        run: |
          TAG="${{ github.event.release.tag_name }}"
          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Invalid tag format: $TAG (expected vX.Y.Z)"
            exit 1
          fi
          VERSION="${TAG#v}"
          ROOT_VERSION="$(awk '/^\[workspace.package\]/{p=1;next} p&&/^version = /{gsub(/"/,"",$3); print $3; exit}' Cargo.toml)"
          DESKTOP_VERSION="$(awk '/^version = /{gsub(/"/,"",$3); print $3; exit}' demo-tauri/src/Cargo.toml)"
          TAURI_VERSION="$(python3 -c "import json; print(json.load(open('demo-tauri/src/tauri.conf.json'))['version'])")"
          if [ "$VERSION" != "$ROOT_VERSION" ]; then
            echo "Tag $VERSION != workspace Cargo.toml $ROOT_VERSION"
            exit 1
          fi
          if [ "$VERSION" != "$DESKTOP_VERSION" ]; then
            echo "Tag $VERSION != demo-tauri Cargo.toml $DESKTOP_VERSION"
            exit 1
          fi
          if [ "$VERSION" != "$TAURI_VERSION" ]; then
            echo "Tag $VERSION != tauri.conf.json $TAURI_VERSION"
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "OK: tag $TAG matches $VERSION"

  docker:
    name: Docker :version + :latest
    needs: validate
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.release.tag_name }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Set up Make
        run: sudo apt-get install -y make

      - name: Build Docker image
        run: make docker-build APP_VERSION=${{ needs.validate.outputs.version }}

      - name: Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Push :version and :latest to Docker Hub
        run: make docker-push-release-hub APP_VERSION=${{ needs.validate.outputs.version }}

      - name: Log in to GHCR (personal)
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME }}
          password: ${{ secrets.GHCR_PAT }}

      - name: Push to personal GHCR
        run: make docker-push-release-ghcr-personal APP_VERSION=${{ needs.validate.outputs.version }}

      - name: Log in to GHCR (Interchouette / ITC)
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME_ITC }}
          password: ${{ secrets.GHCR_PAT_ITC }}

      - name: Push to ghcr.io/interchouette and interchouette-itc
        run: make docker-push-release-ghcr-itc APP_VERSION=${{ needs.validate.outputs.version }}

      - name: Redeploy Render
        env:
          RENDER_DEPLOY_HOOK_URL: ${{ secrets.RENDER_DEPLOY_HOOK_URL }}
        run: |
          if [ -z "${RENDER_DEPLOY_HOOK_URL}" ]; then
            echo "RENDER_DEPLOY_HOOK_URL secret not set; skipping Render redeploy"
            exit 0
          fi
          hook="$(printf '%s' "$RENDER_DEPLOY_HOOK_URL" | tr -d '\r\n')"
          http_code="$(curl -sS -o /tmp/render-hook.json -w '%{http_code}' --get "$hook")"
          echo "render_hook_http=${http_code}"
          cat /tmp/render-hook.json
          echo
          case "$http_code" in
            200|202) ;;
            *) exit 1 ;;
          esac

  desktop:
    name: Tauri ${{ matrix.platform }}
    needs: validate
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: ubuntu-22.04
            bundles: deb,appimage
          - platform: windows-latest
            bundles: nsis
    runs-on: ${{ matrix.platform }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.release.tag_name }}

      - name: Install Linux WebKit deps
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            patchelf \
            libfuse2

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown

      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: |
            demo-tauri/src -> target
            demo-leptos -> target

      - name: Install trunk
        run: cargo install --locked trunk --version 0.21.14

      - name: Install tauri-cli
        run: cargo install --locked tauri-cli --version '^2'

      - name: Build Tauri bundles
        working-directory: demo-tauri/src
        run: cargo tauri build --bundles ${{ matrix.bundles }}

      - name: Stage release assets
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p release-assets
          V="${{ needs.validate.outputs.version }}"
          if [ "${{ matrix.platform }}" = "ubuntu-22.04" ]; then
            mapfile -t DEBS < <(find demo-tauri/src/target/release/bundle/deb -type f -name '*.deb' 2>/dev/null | sort)
            mapfile -t APPS < <(find demo-tauri/src/target/release/bundle/appimage -type f -name '*.AppImage' 2>/dev/null | sort)
            test "${#DEBS[@]}" -ge 1 || { echo "missing .deb"; exit 1; }
            test "${#APPS[@]}" -ge 1 || { echo "missing AppImage"; exit 1; }
            cp "${DEBS[0]}" "release-assets/rangular-demo-${V}-linux-amd64.deb"
            cp "${APPS[0]}" "release-assets/rangular-demo-${V}-linux-x86_64.AppImage"
            chmod +x "release-assets/rangular-demo-${V}-linux-x86_64.AppImage"
          else
            mapfile -t EXES < <(find demo-tauri/src/target/release/bundle/nsis -type f -name '*.exe' 2>/dev/null | sort)
            test "${#EXES[@]}" -ge 1 || { echo "missing NSIS .exe"; exit 1; }
            cp "${EXES[0]}" "release-assets/rangular-demo-${V}-windows-x64-setup.exe"
          fi
          ls -la release-assets

      - name: Upload assets to GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: release-assets/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}