release.yml

name: Release

# Auto-bump + tag + image Docker + page GitHub Releases.
# L’assistant Windows et le Flatpak Linux sont dans images.yml (déclenché après
# chaque Release réussie, plus un filet quotidien).
# Si la version Cargo.toml est déjà publiée, GitHub incrémente le patch automatiquement.
# Les pushes faits avec GITHUB_TOKEN ne re-déclenchent pas de workflow (pas de boucle).
on:
  push:
    branches: [main]
    tags:
      - "v*"
  workflow_dispatch:

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write
  packages: write

jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      should_release: ${{ steps.meta.outputs.should_release }}
      version: ${{ steps.meta.outputs.version }}
      tag: ${{ steps.meta.outputs.tag }}
      sha: ${{ steps.meta.outputs.sha }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          fetch-tags: true

      - id: meta
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail

          read_cargo_version() {
            awk '/^\[workspace.package\]/{f=1} f && $1=="version"{gsub(/"/,"",$3); print $3; exit}' Cargo.toml
          }

          bump_patch() {
            local v="$1" major minor patch
            IFS=. read -r major minor patch <<< "$v"
            echo "${major}.${minor}.$((patch + 1))"
          }

          apply_version() {
            local old="$1" new="$2"
            sed -i "s/^version = \"${old}\"/version = \"${new}\"/" Cargo.toml
            sed -i "0,/\"version\": \"${old}\"/s//\"version\": \"${new}\"/" apps/web/package.json
            # Uniquement les crates du workspace. Un `sed` global réécrit aussi
            # les dépendances qui ont le même numéro (ex. syn 2.0.119).
            awk -v old="$old" -v new="$new" '
              /^name = "devforge/ { hit = 1 }
              hit && $0 == "version = \"" old "\"" {
                sub(old, new)
                hit = 0
              }
              { print }
            ' Cargo.lock > Cargo.lock.tmp
            mv Cargo.lock.tmp Cargo.lock
          }

          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
            VERSION="${GITHUB_REF_NAME#v}"
          else
            VERSION=$(read_cargo_version)
            if [[ -z "$VERSION" ]]; then
              echo "Impossible de lire la version"
              exit 1
            fi

            # GitHub gère les versions : release déjà là, ou tag figé alors que
            # HEAD a avancé (job web KO → pas de GitHub Release) → bump patch.
            NEED_BUMP=false
            if gh release view "v${VERSION}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
              NEED_BUMP=true
              echo "Release v${VERSION} déjà sur GitHub"
            elif git rev-parse "refs/tags/v${VERSION}" >/dev/null 2>&1; then
              TAG_SHA="$(git rev-list -n 1 "v${VERSION}")"
              HEAD_SHA="$(git rev-parse HEAD)"
              if [[ "$TAG_SHA" != "$HEAD_SHA" ]]; then
                NEED_BUMP=true
                echo "Tag v${VERSION} existe sans release GitHub, HEAD a avancé"
              fi
            fi

            if [[ "$NEED_BUMP" == "true" ]]; then
              OLD="$VERSION"
              VERSION=$(bump_patch "$OLD")
              echo "Auto-bump GitHub: ${OLD} → ${VERSION}"
              apply_version "$OLD" "$VERSION"

              git config user.name "github-actions[bot]"
              git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
              git add Cargo.toml Cargo.lock apps/web/package.json
              git commit -m "chore: bump version ${OLD} → ${VERSION}"
              git push origin "HEAD:${GITHUB_REF_NAME}"
            else
              echo "Version ${VERSION} pas encore publiée — release directe"
            fi
          fi

          TAG="v${VERSION}"
          SHOULD=true
          if gh release view "${TAG}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
            echo "Release ${TAG} déjà publiée — skip"
            SHOULD=false
          fi

          # Le tag git est créé après le push Docker : l’appli le prend pour
          # « version disponible » et lancerait un pull trop tôt sinon.
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
          echo "should_release=${SHOULD}" >> "$GITHUB_OUTPUT"

  docker:
    needs: prepare
    if: needs.prepare.outputs.should_release == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.prepare.outputs.sha }}
          fetch-depth: 0
          fetch-tags: true
      - uses: docker/setup-buildx-action@v3

      - name: Login GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build Docker tags
        run: |
          set -euo pipefail
          VERSION="${{ needs.prepare.outputs.version }}"
          OWNER_LC="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
          HUB_USER="${{ secrets.DOCKERHUB_USERNAME }}"
          TAGS="ghcr.io/${OWNER_LC}/devforge:${VERSION},ghcr.io/${OWNER_LC}/devforge:latest"
          TAGS="${TAGS},${HUB_USER}/devforge:${VERSION},${HUB_USER}/devforge:latest"
          if [[ "$VERSION" =~ ^([0-9]+\.[0-9]+)\. ]]; then
            MINOR="${BASH_REMATCH[1]}"
            TAGS="${TAGS},ghcr.io/${OWNER_LC}/devforge:${MINOR},${HUB_USER}/devforge:${MINOR}"
          fi
          echo "TAGS=${TAGS}" >> "$GITHUB_ENV"

      - uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ env.TAGS }}

      - name: Publier le tag puis la page GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          TAG="${{ needs.prepare.outputs.tag }}"
          if [[ "${GITHUB_REF_TYPE}" != "tag" ]]; then
            git config user.name "github-actions[bot]"
            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
            if ! git rev-parse "refs/tags/${TAG}" >/dev/null 2>&1; then
              git tag -a "${TAG}" -m "DevForge ${TAG}"
              git push origin "refs/tags/${TAG}"
            fi
          fi
          gh release create "$TAG" \
            --repo "${{ github.repository }}" \
            --title "DevForge ${TAG}" \
            --generate-notes

  # APK Android signé, joint à la page GitHub Release créée par le job docker.
  android:
    needs: [prepare, docker]
    if: needs.prepare.outputs.should_release == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.prepare.outputs.sha }}
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"
      - uses: gradle/actions/setup-gradle@v4
      - name: Clé de signature
        env:
          KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
        run: |
          set -euo pipefail
          if [[ -n "${KEYSTORE_B64}" ]]; then
            echo "${KEYSTORE_B64}" | base64 -d > "${RUNNER_TEMP}/release.jks"
            echo "DEVFORGE_KEYSTORE_FILE=${RUNNER_TEMP}/release.jks" >> "$GITHUB_ENV"
            echo "APK_SUFFIX=" >> "$GITHUB_ENV"
          else
            echo "::warning::ANDROID_KEYSTORE_BASE64 absent : APK signé avec la clé debug"
            echo "APK_SUFFIX=-debug-signed" >> "$GITHUB_ENV"
          fi
      - name: Build APK release
        working-directory: apps/android
        env:
          DEVFORGE_VERSION: ${{ needs.prepare.outputs.version }}
          DEVFORGE_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          DEVFORGE_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          DEVFORGE_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: ./gradlew --no-daemon :app:assembleRelease
      - name: Joindre l'APK à la release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          VERSION="${{ needs.prepare.outputs.version }}"
          TAG="${{ needs.prepare.outputs.tag }}"
          SRC=apps/android/app/build/outputs/apk/release/app-release.apk
          cp "$SRC" "DevForge-Android-${VERSION}${APK_SUFFIX}.apk"
          # Nom stable : …/releases/latest/download/DevForge-Android.apk
          cp "$SRC" "DevForge-Android${APK_SUFFIX}.apk"
          gh release upload "$TAG" "DevForge-Android-${VERSION}${APK_SUFFIX}.apk" "DevForge-Android${APK_SUFFIX}.apk" \
            --repo "${{ github.repository }}" --clobber
          rm -f "${RUNNER_TEMP}/release.jks"