release.yml

name: release

# Disparos:
#   - push de un tag con prefijo "v" (v0.1.0, v1.0.0, v0.2.0-beta.3):
#     compila + publica la release oficial en GitHub.
#   - workflow_dispatch desde la UI de Actions: compila sin publicar
#     release (a menos que se pase un tag explícito), útil para iterar
#     sobre el pipeline Windows sin contaminar la lista de releases.
#
# Permisos requeridos: contents: write para publicar la release.

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version a inyectar (ej. 0.1.0-alpha.3). Si vacío, usa 0.0.0-dev.'
        required: false
        default: ''
      publish_release:
        description: 'Crear release en GitHub al final (necesita "version" no vacía).'
        type: boolean
        default: false
      enable_tmate:
        description: 'Abrir SSH tmate al runner si Windows falla (debug interactivo, ~30 min de uptime).'
        type: boolean
        default: false

permissions:
  contents: write

env:
  # Las acciones @v4 corren sobre Node.js 20, que GitHub marca deprecated.
  # Forzamos Node 24 desde ya para evitar el warning hasta que las acciones
  # publiquen versiones nativas en Node 24.
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'

jobs:
  # =======================================================================
  # Linux .deb
  # =======================================================================
  build-linux:
    name: build-linux-deb
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0.x'

      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Derivar version (tag push o workflow_dispatch input)
        id: ver
        run: |
          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
            VER="${{ github.event.inputs.version }}"
            if [[ -z "$VER" ]]; then VER="0.0.0-dev"; fi
            TAG="v$VER"
          else
            TAG="${GITHUB_REF_NAME}"
            VER="${TAG#v}"
          fi
          echo "version=$VER" >> "$GITHUB_OUTPUT"
          echo "tag=$TAG"     >> "$GITHUB_OUTPUT"
          echo "Building version: $VER (tag: $TAG)"

      - name: dotnet publish (linux-x64, self-contained)
        run: |
          dotnet publish src/EnterpriseChat.Server/EnterpriseChat.Server.csproj \
            -c Release \
            -r linux-x64 \
            --self-contained true \
            -p:PublishSingleFile=true \
            -p:PublishTrimmed=false \
            -p:Version=${{ steps.ver.outputs.version }} \
            -o publish/linux-x64

      - name: Construir .deb
        run: |
          set -euo pipefail
          VER="${{ steps.ver.outputs.version }}"
          PKG=pkg-deb

          mkdir -p "$PKG/DEBIAN" "$PKG/opt/enterprisechat" "$PKG/etc/systemd/system"
          cp -r publish/linux-x64/. "$PKG/opt/enterprisechat/"
          cp src/EnterpriseChat.Server/scripts/enterprisechat.service \
             "$PKG/etc/systemd/system/enterprisechat.service"

          cat > "$PKG/DEBIAN/control" <<EOF
          Package: enterprisechat
          Version: $VER
          Section: net
          Priority: optional
          Architecture: amd64
          Maintainer: EnterpriseChat <soporte@enterprisechat.es>
          Depends: libicu70 | libicu72 | libicu74, libssl3 | libssl1.1
          Description: EnterpriseChat self-hosted corporate chat server
           ASP.NET Core + SignalR + SQLite. Runs as systemd unit on port 5080.
          EOF

          cat > "$PKG/DEBIAN/postinst" <<'EOF'
          #!/bin/bash
          set -e
          INSTALL_DIR=/opt/enterprisechat
          SERVICE_USER=enterprisechat
          if ! id "$SERVICE_USER" >/dev/null 2>&1; then
              useradd --system --create-home --home-dir "$INSTALL_DIR" \
                      --shell /usr/sbin/nologin "$SERVICE_USER"
          fi
          mkdir -p "$INSTALL_DIR/data" "$INSTALL_DIR/logs" "$INSTALL_DIR/certs"
          chown -R "$SERVICE_USER:$SERVICE_USER" "$INSTALL_DIR"
          chmod 0750 "$INSTALL_DIR/certs"
          chmod 0755 "$INSTALL_DIR/EnterpriseChat.Server" || true
          systemctl daemon-reload || true
          EOF

          cat > "$PKG/DEBIAN/prerm" <<'EOF'
          #!/bin/bash
          set -e
          if systemctl is-active --quiet enterprisechat.service 2>/dev/null; then
              systemctl stop enterprisechat.service || true
          fi
          if systemctl is-enabled --quiet enterprisechat.service 2>/dev/null; then
              systemctl disable enterprisechat.service || true
          fi
          EOF

          chmod 0755 "$PKG/DEBIAN/postinst" "$PKG/DEBIAN/prerm"
          chmod 0644 "$PKG/DEBIAN/control"

          dpkg-deb --build --root-owner-group "$PKG" "enterprisechat_amd64.deb"
          sha256sum enterprisechat_amd64.deb > enterprisechat_amd64.deb.sha256

      - uses: actions/upload-artifact@v4
        with:
          name: linux-amd64
          path: |
            enterprisechat_amd64.deb
            enterprisechat_amd64.deb.sha256

  # =======================================================================
  # Windows .exe (Inno Setup)
  # =======================================================================
  build-windows:
    name: build-windows-installer
    runs-on: windows-2022
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0.x'

      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Derivar version (tag push o workflow_dispatch input)
        id: ver
        shell: pwsh
        run: |
          if ($env:GITHUB_EVENT_NAME -eq 'workflow_dispatch') {
            $ver = '${{ github.event.inputs.version }}'
            if ([string]::IsNullOrWhiteSpace($ver)) { $ver = '0.0.0-dev' }
            $tag = "v$ver"
          } else {
            $tag = $env:GITHUB_REF_NAME
            $ver = $tag.TrimStart('v')
          }
          "version=$ver" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
          "tag=$tag"     | Out-File -FilePath $env:GITHUB_OUTPUT -Append
          Write-Host "Building version: $ver (tag: $tag)"

      - name: Instalar Inno Setup
        shell: pwsh
        run: choco install innosetup --no-progress -y

      - name: Construir installer
        id: build
        shell: pwsh
        working-directory: installer/windows
        run: ./build-server-windows.ps1 -Version ${{ steps.ver.outputs.version }}

      # Si la build de Windows ha fallado y el operario marcó la casilla
      # enable_tmate en workflow_dispatch, abrir una sesión SSH al runner
      # via tmate para inspeccionar el estado del sistema en vivo. El
      # runner sube los logs al output del job y muestra el comando ssh
      # a copiar. Cierre automático a los ~30 minutos.
      - name: Tmate debug session (on failure if requested)
        if: failure() && github.event_name == 'workflow_dispatch' && inputs.enable_tmate
        uses: mxschmitt/action-tmate@v3
        timeout-minutes: 30
        with:
          limit-access-to-actor: true

      # Subir artefactos parciales aunque la build haya fallado. Útil para
      # bajar el publish output incompleto, los logs de ISCC o el .iss
      # temporal y reproducir el fallo en local.
      - name: Upload Windows debug artifacts (always)
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: windows-debug-${{ github.run_id }}
          if-no-files-found: ignore
          retention-days: 7
          path: |
            installer/windows/build/**
            src/EnterpriseChat.Server/bin/publish/win-x64/**
            src/EnterpriseChat.TrayMonitor/bin/publish/win-x64/**

      # Firma Authenticode opcional. Solo se activa si el secret
      # WINDOWS_SIGNING_CERT_PFX_BASE64 está configurado en el repo.
      - name: Firmar exe (si hay cert)
        if: env.HAS_CERT == '1'
        shell: pwsh
        env:
          HAS_CERT: ${{ secrets.WINDOWS_SIGNING_CERT_PFX_BASE64 != '' && '1' || '0' }}
          CERT_B64:  ${{ secrets.WINDOWS_SIGNING_CERT_PFX_BASE64 }}
          CERT_PASS: ${{ secrets.WINDOWS_SIGNING_CERT_PASSWORD }}
        run: |
          $bytes = [Convert]::FromBase64String($env:CERT_B64)
          $pfx   = Join-Path $env:RUNNER_TEMP 'codesign.pfx'
          [IO.File]::WriteAllBytes($pfx, $bytes)
          $exe = (Get-ChildItem installer/windows/build/*.exe | Select-Object -First 1).FullName
          & signtool.exe sign /f $pfx /p $env:CERT_PASS /fd SHA256 `
            /tr http://timestamp.digicert.com /td SHA256 $exe
          $sha = (Get-FileHash -Algorithm SHA256 $exe).Hash.ToLower()
          Set-Content -Path "$exe.sha256" -Value "$sha  $(Split-Path -Leaf $exe)" -Encoding ASCII

      - name: Renombrar asset a nombre canónico
        shell: pwsh
        working-directory: installer/windows/build
        run: |
          $src = Get-ChildItem . -Filter "enterprisechat-server-win-x64-${{ steps.ver.outputs.version }}.exe" | Select-Object -First 1
          if (-not $src) { throw 'installer .exe not found' }
          Copy-Item $src.FullName "enterprisechat-server-win-x64.exe"
          # Re-hash con el nombre canónico para que install.ps1 lo encuentre.
          $sha = (Get-FileHash -Algorithm SHA256 "enterprisechat-server-win-x64.exe").Hash.ToLower()
          Set-Content -Path "enterprisechat-server-win-x64.exe.sha256" `
                      -Value "$sha  enterprisechat-server-win-x64.exe" `
                      -Encoding ASCII

      - uses: actions/upload-artifact@v4
        with:
          name: windows-x64
          path: |
            installer/windows/build/enterprisechat-server-win-x64.exe
            installer/windows/build/enterprisechat-server-win-x64.exe.sha256

  # =======================================================================
  # Publicar GitHub Release con todos los assets
  # =======================================================================
  release:
    name: github-release
    needs: [build-linux, build-windows]
    runs-on: ubuntu-22.04
    # Solo publica release oficial si:
    #   - El disparo es push de tag v* (modo "production").
    #   - O es workflow_dispatch con publish_release=true Y version no vacía.
    # En cualquier otro caso (workflow_dispatch sin publish_release, smoke
    # del pipeline) los jobs build-* corren igual, pero este job se salta
    # y los artefactos quedan disponibles 90 días en Actions sin
    # contaminar la página /releases.
    if: |
      startsWith(github.ref, 'refs/tags/v') ||
      (github.event_name == 'workflow_dispatch' &&
       inputs.publish_release == true &&
       inputs.version != '')
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          name: linux-amd64
          path: artifacts/

      - uses: actions/download-artifact@v4
        with:
          name: windows-x64
          path: artifacts/

      - name: Listar artefactos
        run: ls -la artifacts/

      - name: Generar body de la release (user-friendly)
        id: body
        run: |
          TAG="${GITHUB_REF_NAME}"
          VER="${TAG#v}"
          DEB_SHA="$(awk '{print $1}' artifacts/enterprisechat_amd64.deb.sha256 2>/dev/null || echo 'pendiente')"
          EXE_SHA="$(awk '{print $1}' artifacts/enterprisechat-server-win-x64.exe.sha256 2>/dev/null || echo 'pendiente')"

          cat > release-body.md <<EOF
          # EnterpriseChat $VER

          Chat empresarial autoalojado. Servidor .NET 8 + SignalR + SQLite.
          Sin Docker, sin nube, sin cuenta. Una línea y tienes el servicio
          corriendo en :5080.

          ---

          ## 🐧 Linux (Debian, Ubuntu, AlmaLinux, RockyLinux)

          \`\`\`bash
          curl -fsSL https://enterprisechat.es/install.sh | sudo bash
          \`\`\`

          El instalador detecta tu distro, descarga el paquete correcto,
          verifica el SHA-256, lo instala y arranca el servicio. Al
          terminar imprime la URL admin y la contraseña inicial.

          ## 🪟 Windows Server (2019 / 2022)

          PowerShell **como administrador**:

          \`\`\`powershell
          irm https://enterprisechat.es/install.ps1 | iex
          \`\`\`

          Descarga el instalador firmado, verifica el SHA-256, lo ejecuta
          en modo silencioso y registra el servicio Windows
          \`EnterpriseChat\`. Pantalla final con URL admin + contraseña.

          ---

          ## Tras instalar

          1. Abre \`http://<ip-del-servidor>:5080/\`.
          2. Usuario \`admin\` + contraseña que te imprimió el instalador.
          3. Cámbiala en el primer login.

          Para conectar empleados, reparte el cliente Windows desde la
          web (próximamente) o accede al panel web del propio servidor.

          ---

          ## Verificación de integridad

          | Archivo | SHA-256 |
          |---|---|
          | \`enterprisechat_amd64.deb\` | \`$DEB_SHA\` |
          | \`enterprisechat-server-win-x64.exe\` | \`$EXE_SHA\` |

          Cada artefacto trae su \`.sha256\` adjunto. Los scripts oficiales
          de instalación validan ese hash automáticamente.

          ---

          📖 [Documentación](https://enterprisechat.es)  ·
          ❓ [Soporte](https://enterprisechat.es/contacto)  ·
          🐛 [Issues](https://github.com/${{ github.repository }}/issues)
          EOF

      - name: Publicar release
        uses: softprops/action-gh-release@v2
        with:
          name: EnterpriseChat ${{ github.ref_name }}
          draft: false
          prerelease: ${{ contains(github.ref_name, '-') }}
          body_path: release-body.md
          fail_on_unmatched_files: false
          files: |
            artifacts/enterprisechat_amd64.deb
            artifacts/enterprisechat_amd64.deb.sha256
            artifacts/enterprisechat-server-win-x64.exe
            artifacts/enterprisechat-server-win-x64.exe.sha256