release.yml

# Zaparoo Frontend
# Copyright (c) 2026 Wizzo Pty Ltd and the Zaparoo Project contributors.
# SPDX-License-Identifier: LicenseRef-PolyForm-Noncommercial-1.0.0

name: Build release ZIP

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag/version to build (e.g. v1.0.4)'
        required: true
        type: string
      menu_tag:
        description: 'Menu_MiSTer release tag to bundle (defaults to latest)'
        required: false
        type: string
      upload:
        description: 'Upload to GitHub release'
        required: false
        type: boolean
        default: false

permissions:
  contents: write
  packages: read
  id-token: write
  attestations: write

concurrency:
  group: release-${{ inputs.tag || github.ref_name }}
  cancel-in-progress: false

env:
  BUILD_TAG: ${{ inputs.tag || github.ref_name }}

jobs:
  ensure-toolchain:
    uses: ./.github/workflows/toolchain-build.yml
    permissions:
      contents: read
      packages: write

  build-release-zip:
    name: Build MiSTer release ZIP
    runs-on: ubuntu-latest
    timeout-minutes: 90
    needs: ensure-toolchain
    if: ${{ !cancelled() && needs.ensure-toolchain.result == 'success' }}
    permissions:
      contents: write
      packages: read
    outputs:
      archive-name: ${{ steps.archive.outputs.name }}
      should-upload: ${{ steps.upload-policy.outputs.should-upload }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/{0}', inputs.tag) || github.ref }}

      - name: Verify tag is on main
        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.upload == 'true')
        run: |
          git fetch origin main
          git merge-base --is-ancestor "$(git rev-parse HEAD)" origin/main

      - name: Set upload policy
        id: upload-policy
        env:
          DISPATCH_UPLOAD: ${{ inputs.upload || false }}
        run: |
          if [ "${{ github.event_name }}" = "push" ] || [ "$DISPATCH_UPLOAD" = "true" ]; then
            echo "should-upload=true" >> "$GITHUB_OUTPUT"
          else
            echo "should-upload=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Resolve Main_MiSTer release tag
        id: main-mister
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          tag=$(gh api repos/ZaparooProject/Main_MiSTer/releases/latest --jq '.tag_name')
          if [ -z "$tag" ] || [ "$tag" = "null" ]; then
            echo "Could not resolve latest Main_MiSTer release" >&2
            exit 1
          fi
          echo "tag=$tag" >> "$GITHUB_OUTPUT"

      - name: Resolve Menu_MiSTer release tag
        id: menu-mister
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MENU_TAG_INPUT: ${{ inputs.menu_tag }}
        run: |
          tag="$MENU_TAG_INPUT"
          if [ -z "$tag" ]; then
            tag=$(gh api repos/ZaparooProject/Menu_MiSTer/releases/latest --jq '.tag_name')
          fi
          if [ -z "$tag" ] || [ "$tag" = "null" ]; then
            echo "Could not resolve Menu_MiSTer release" >&2
            exit 1
          fi
          echo "tag=$tag" >> "$GITHUB_OUTPUT"

      - name: Install host build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            build-essential \
            ca-certificates \
            cmake \
            git \
            libdbus-1-3 \
            libegl-dev \
            libfontconfig1 \
            libgl-dev \
            libglib2.0-0t64 \
            libxcb-cursor0 \
            libxcb-icccm4 \
            libxcb-image0 \
            libxcb-keysyms1 \
            libxcb-randr0 \
            libxcb-render-util0 \
            libxcb-shape0 \
            libxcb-sync1 \
            libxcb-xfixes0 \
            libxcb-xkb1 \
            libxkbcommon-dev \
            libxkbcommon-x11-0 \
            ninja-build \
            pkg-config \
            python3-pip \
            rsync \
            zip
          python3 -m pip install --user --break-system-packages 'aqtinstall==3.3.0'
          python3 -m aqt install-qt linux desktop 6.10.3 linux_gcc_64 \
            --archives icu qtbase qtdeclarative qtsvg qttools \
            -m qtshadertools \
            -O "$RUNNER_TOOL_CACHE/qt"
          {
            echo "$RUNNER_TOOL_CACHE/qt/6.10.3/gcc_64/bin"
            echo "$HOME/.cargo/bin"
          } >> "$GITHUB_PATH"
          {
            echo "CMAKE_PREFIX_PATH=$RUNNER_TOOL_CACHE/qt/6.10.3/gcc_64/lib/cmake"
            echo "LD_LIBRARY_PATH=$RUNNER_TOOL_CACHE/qt/6.10.3/gcc_64/lib:${LD_LIBRARY_PATH:-}"
          } >> "$GITHUB_ENV"

      - name: Install Rust and just
        run: |
          rustup toolchain install 1.96.0 \
            --profile minimal \
            --component rustfmt \
            --component clippy \
            --target armv7-unknown-linux-gnueabihf
          cargo install --locked --version 1.50.0 just

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 # v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build release ZIP
        run: ./scripts/package-mister-release.sh "$BUILD_TAG"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MAIN_MISTER_TAG: ${{ steps.main-mister.outputs.tag }}
          MENU_MISTER_TAG: ${{ steps.menu-mister.outputs.tag }}

      - name: Record archive name
        id: archive
        run: echo "name=zaparoo-frontend-${BUILD_TAG}.zip" >> "$GITHUB_OUTPUT"

      - name: Upload ZIP artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ steps.archive.outputs.name }}
          path: output/release/${{ steps.archive.outputs.name }}
          if-no-files-found: error
          retention-days: 30

      - name: Create draft release
        if: steps.upload-policy.outputs.should-upload == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          if gh release view "$BUILD_TAG" --repo "$GITHUB_REPOSITORY" > /dev/null 2>&1; then
            echo "Release $BUILD_TAG already exists"
            exit 0
          fi

          version="${BUILD_TAG#v}"
          prerelease=()
          if [[ "$version" == *-* ]]; then
            prerelease=(--prerelease)
          fi

          gh release create "$BUILD_TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --title "$BUILD_TAG" \
            --draft \
            "${prerelease[@]}" \
            --notes ""

      - name: Upload release ZIP
        if: steps.upload-policy.outputs.should-upload == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload "$BUILD_TAG" \
            "output/release/${{ steps.archive.outputs.name }}" \
            --repo "$GITHUB_REPOSITORY" \
            --clobber

  attest:
    name: Attest release ZIP
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: build-release-zip
    if: ${{ !cancelled() && needs.build-release-zip.result == 'success' && needs.build-release-zip.outputs.should-upload == 'true' }}
    permissions:
      contents: read
      id-token: write
      attestations: write
    steps:
      - name: Download release ZIP artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ needs.build-release-zip.outputs.archive-name }}
          path: _release

      - name: Attest build provenance
        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4
        with:
          subject-path: _release/${{ needs.build-release-zip.outputs.archive-name }}