release.yml

name: Release

# Releases are tag-driven: push a tag like `v1.2.3` to build Windows, macOS and
# Linux artifacts and publish them to a DRAFT GitHub release. Merging to `main` alone
# does nothing here — only a `v*` tag triggers a release.
on:
  push:
    tags: ['v*']

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  # Baked into the binary by `option_env!` in `crates/data-exchange/src/google.rs`. Google treats
  # an installed app's secret as non-confidential (RFC 8252 §8.5) — loopback + PKCE is what
  # actually protects the exchange — so shipping it is the design, but it still never lives in
  # the repo. Absent (any local build): the Google Sheets export reports it isn't configured.
  QRATE_GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
  QRATE_GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
  # Sent to the credential endpoint. It ships inside the binary, so it turns away casual scraping
  # and nothing more — see docs/dev/site-oauth-handoff.md. Absent: the endpoint answers 401 and the
  # app carries on with the pair above.
  QRATE_GOOGLE_CONFIG_TOKEN: ${{ secrets.QRATE_GOOGLE_CONFIG_TOKEN }}
  # Public Ed25519 key for the independently signed plugin catalog. Release builds embed it; local
  # builds can set the same variable at compile time or use it at runtime for development.
  QRATE_PLUGIN_CATALOG_PUBLIC_KEY: ${{ vars.QRATE_PLUGIN_CATALOG_PUBLIC_KEY }}

jobs:
  # ---------------------------------------------------------------------------
  # Derive the version from the tag and assert it matches Cargo.toml.
  # ---------------------------------------------------------------------------
  version:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.v.outputs.version }}
      tag: ${{ steps.v.outputs.tag }}
      vi_version: ${{ steps.v.outputs.vi_version }}
    steps:
      - uses: actions/checkout@v7
      - name: Derive and verify version
        id: v
        run: |
          tag="${GITHUB_REF_NAME}"
          version="${tag#v}"
          cargo_version="$(grep -E '^version = ' Cargo.toml | head -1 | sed -E 's/version = "([^"]+)"/\1/')"
          echo "tag=$tag         (version=$version)"
          echo "Cargo.toml workspace version=$cargo_version"
          if [ "$version" != "$cargo_version" ]; then
            echo "::error::Tag $tag does not match Cargo.toml version $cargo_version. Bump Cargo.toml before tagging."
            exit 1
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "tag=$tag" >> "$GITHUB_OUTPUT"
          # NSIS VIProductVersion must be a strict numeric X.X.X.X. Strip any
          # pre-release/build suffix (e.g. -alpha.1, +meta) and pad to 4 parts.
          core="${version%%-*}"; core="${core%%+*}"
          IFS=. read -r a b c d <<< "$core"
          vi_version="${a:-0}.${b:-0}.${c:-0}.${d:-0}"
          echo "vi_version=$vi_version" >> "$GITHUB_OUTPUT"

  # ---------------------------------------------------------------------------
  # macOS: build each arch in parallel (separate runners + caches).
  # ---------------------------------------------------------------------------
  build-macos:
    needs: version
    runs-on: macos-latest
    strategy:
      fail-fast: false
      matrix:
        target: [x86_64-apple-darwin, aarch64-apple-darwin]
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: release-${{ matrix.target }}
          save-if: false

      - name: Build
        run: |
          cargo build --release -p app --target ${{ matrix.target }}
          cargo build --release -p updater --bin qrate-update-helper --target ${{ matrix.target }}

      - name: Upload arch binary
        uses: actions/upload-artifact@v7
        with:
          name: macos-bin-${{ matrix.target }}
          path: |
            target/${{ matrix.target }}/release/app
            target/${{ matrix.target }}/release/qrate-update-helper
          if-no-files-found: error

      # Optional components install one Mac's architecture, not the universal pair the dmg
      # carries, so each leg packs its own. ffmpeg stays Homebrew's on macOS.
      - name: Package optional components
        env:
          QRATE_SKIP_FFMPEG: 1
          QRATE_STRICT_BINARIES: 1
        run: |
          case "${{ matrix.target }}" in
            x86_64-apple-darwin)  pdfium=x64;   pi=darwin-x64;   arch=x86_64 ;;
            aarch64-apple-darwin) pdfium=arm64; pi=darwin-arm64; arch=aarch64 ;;
          esac
          chmod +x scripts/fetch-binaries.sh scripts/fetch-agent-runtime.sh scripts/package-component.sh
          mkdir -p components/pdfium components-dist
          QRATE_PDFIUM_ARCH="$pdfium" ./scripts/fetch-binaries.sh components/pdfium
          ./scripts/fetch-agent-runtime.sh components "$pi"
          ./scripts/package-component.sh pdfium components/pdfium macos "$arch" components-dist
          ./scripts/package-component.sh agent components/agent macos "$arch" components-dist

      - uses: actions/upload-artifact@v7
        with:
          name: components-macos-${{ matrix.target }}
          path: components-dist/*
          if-no-files-found: error

  # ---------------------------------------------------------------------------
  # macOS: lipo the two arch binaries -> universal .app -> .dmg
  # ---------------------------------------------------------------------------
  bundle-macos:
    needs: [version, build-macos]
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v7
      - name: Download arch binaries
        uses: actions/download-artifact@v8
        with:
          pattern: macos-bin-*
          path: macos-bins

      - name: Merge into universal binary
        run: |
          lipo -create \
            macos-bins/macos-bin-x86_64-apple-darwin/app \
            macos-bins/macos-bin-aarch64-apple-darwin/app \
            -output universal-app
          lipo -info universal-app
          lipo -create \
            macos-bins/macos-bin-x86_64-apple-darwin/qrate-update-helper \
            macos-bins/macos-bin-aarch64-apple-darwin/qrate-update-helper \
            -output qrate-update-helper
          lipo -info qrate-update-helper

      # `bundle-mac.sh` picks the sidecars up from beside the binary it is given, so they have to
      # land next to `universal-app`. PDFium's universal build, not a per-arch one: a single-arch
      # dylib inside a universal .app would fail to load on the other half of the Macs it runs on.
      #
      # ffmpeg is deliberately not bundled here. `brew install ffmpeg` is the normal way to get it
      # on a Mac, the media tier finds it on PATH, and carrying our own would add ~50 MB to the dmg
      # for users who mostly already have it.
      - name: Fetch preview binaries
        env:
          QRATE_PDFIUM_ARCH: univ
          QRATE_SKIP_FFMPEG: 1
          QRATE_STRICT_BINARIES: 1
        run: |
          chmod +x scripts/fetch-binaries.sh
          ./scripts/fetch-binaries.sh .
          lipo -info libpdfium.dylib || true

      - name: Fetch embedded Pi agent
        run: |
          chmod +x scripts/fetch-agent-runtime.sh
          ./scripts/fetch-agent-runtime.sh . darwin-universal

      # Full first, then base: both write dist/qrate.app, so each is checked before the next.
      # Base leaves PDFium and Pi out for qrate to install on first use.
      - name: Bundle .app and .dmg, full and base
        run: |
          chmod +x scripts/bundle-mac.sh
          ver="${{ needs.version.outputs.version }}"
          scripts/bundle-mac.sh universal-app "$ver" full
          for part in MacOS/libpdfium.dylib Resources/agent/pi; do
            [ -e "dist/qrate.app/Contents/$part" ] ||
              { echo "::error::the full dmg is missing $part"; exit 1; }
          done
          scripts/bundle-mac.sh universal-app "$ver" base
          for part in MacOS/libpdfium.dylib MacOS/ffmpeg Resources/agent; do
            [ ! -e "dist/qrate.app/Contents/$part" ] ||
              { echo "::error::the base dmg carries $part"; exit 1; }
          done

      - uses: actions/upload-artifact@v7
        with:
          name: macos-dmg
          path: dist/*.dmg
          if-no-files-found: error

  # ---------------------------------------------------------------------------
  # Windows: icon-embedded .exe -> portable .zip + NSIS installer
  # ---------------------------------------------------------------------------
  build-windows:
    needs: version
    runs-on: windows-latest
    # rust-lld ships with Rust and accepts the MSVC linker interface, avoiding the slower link.exe
    # without another installation step.
    env:
      RUSTFLAGS: -C linker=rust-lld
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: release
          save-if: false

      - name: Build
        run: |
          cargo build --release -p app
          cargo build --release -p updater --bin qrate-update-helper

      - name: Install NSIS
        run: choco install nsis -y --no-progress

      # The MSI is the enterprise-deployable counterpart to the NSIS installer — see
      # scripts/installer.wxs for why GPO/SCCM/Intune push installs need one. windows-latest ships
      # the .NET SDK, so the WiX CLI installs as a dotnet global tool; no matrix leg for this, since
      # both installers package the one binary already built above and a second leg would just
      # recompile it for nothing.
      #
      # Pinned to 5.0.2: v6 introduced FireGiant's Open Source Maintenance Fee and v7 enforces it by
      # blocking every command behind an unaccepted EULA, which just hangs here. v5 is the newest
      # version still free of that.
      - name: Install WiX
        run: |
          dotnet tool install --global wix --version 5.0.2
          wix extension add -g WixToolset.UI.wixext/5.0.2

      # PDFium and ffmpeg are loaded at runtime from beside the executable. Windows has no package
      # manager we can rely on, so both ship with the app — without them a released build shows a
      # type icon for every PDF and video. This is what makes the installer large (ffmpeg is most
      # of it). Strict release mode fails this job if either sidecar is missing.
      - name: Fetch preview binaries
        env:
          QRATE_STRICT_BINARIES: 1
          # For the ffmpeg component only; nothing is added beside qrate.exe.
          QRATE_FFMPEG_LICENSE: components/ffmpeg/LICENSE.txt
        shell: bash
        run: |
          mkdir -p dist/portable
          chmod +x scripts/fetch-binaries.sh
          ./scripts/fetch-binaries.sh dist/portable

      - name: Fetch embedded Pi agent
        shell: pwsh
        run: ./scripts/fetch-agent-runtime.ps1 -Destination dist/portable

      # The optional components are packed from the same pinned files the full bundle ships. This
      # reads the staging folder before the next step deletes it and changes nothing inside it.
      - name: Package optional components
        shell: bash
        run: |
          chmod +x scripts/package-component.sh
          mkdir -p components/pdfium components/ffmpeg components-dist
          cp dist/portable/pdfium.dll components/pdfium/
          cp dist/portable/ffmpeg.exe components/ffmpeg/
          ./scripts/package-component.sh pdfium components/pdfium windows x86_64 components-dist
          ./scripts/package-component.sh ffmpeg components/ffmpeg windows x86_64 components-dist
          ./scripts/package-component.sh agent dist/portable/agent windows x86_64 components-dist

      - name: Package zip + NSIS + MSI installers
        shell: pwsh
        run: |
          $ver = "${{ needs.version.outputs.version }}"
          $vi = "${{ needs.version.outputs.vi_version }}"
          Copy-Item target/release/app.exe dist/portable/qrate.exe
          Copy-Item target/release/qrate-update-helper.exe dist/portable/qrate-update-helper.exe
          @{ schema = 1; kind = "windows-portable"; packaged_version = $ver } |
            ConvertTo-Json | Set-Content -Encoding utf8 dist/portable/qrate-install.json
          # Zip the staging folder's *contents*, so the sidecars sit beside qrate.exe on extract —
          # which is exactly where the preview tiers look for them.
          Compress-Archive -Path dist/portable/* `
            -DestinationPath "dist/qrate-$ver-x86_64.zip" -Force

          @{ schema = 1; kind = "windows-msi"; packaged_version = $ver } |
            ConvertTo-Json | Set-Content -Encoding utf8 dist/portable/qrate-install-msi.json

          $nsis = "C:\Program Files (x86)\NSIS\makensis.exe"
          & $nsis `
            "/DVERSION=$ver" `
            "/DVIVERSION=$vi" `
            "/DSRCEXE=$PWD\dist\portable\qrate.exe" `
            "/DSRCDIR=$PWD\dist\portable" `
            "/DICONFILE=$PWD\assets\icons\app-icon.ico" `
            "/DOUTFILE=$PWD\dist\qrate-$ver-setup.exe" `
            scripts\installer.nsi
          if ($LASTEXITCODE -ne 0) { throw "makensis failed ($LASTEXITCODE)" }
          # The small installer: no PDFium, ffmpeg or Pi, which qrate installs on first use.
          & $nsis `
            "/DVERSION=$ver" `
            "/DVIVERSION=$vi" `
            "/DFLAVOR=base" `
            "/DSRCEXE=$PWD\dist\portable\qrate.exe" `
            "/DSRCDIR=$PWD\dist\portable" `
            "/DICONFILE=$PWD\assets\icons\app-icon.ico" `
            "/DOUTFILE=$PWD\dist\qrate-$ver-base-setup.exe" `
            scripts\installer.nsi
          if ($LASTEXITCODE -ne 0) { throw "makensis (base) failed ($LASTEXITCODE)" }

          $hasPdfium = if (Test-Path dist/portable/pdfium.dll) { 1 } else { 0 }
          $hasFfmpeg = if (Test-Path dist/portable/ffmpeg.exe) { 1 } else { 0 }
          bash scripts/license-to-rtf.sh LICENSE.md dist/license.rtf
          wix build scripts\installer.wxs -ext WixToolset.UI.wixext `
            -d "Version=$vi" `
            -d "LicenseRtf=$PWD\dist\license.rtf" `
            -d "SrcExe=$PWD\dist\portable\qrate.exe" `
            -d "SrcDir=$PWD\dist\portable" `
            -d "IconFile=$PWD\assets\icons\app-icon.ico" `
            -d "HasPdfium=$hasPdfium" `
            -d "HasFfmpeg=$hasFfmpeg" `
            -o "dist\qrate-$ver-x86_64.msi"
          if ($LASTEXITCODE -ne 0) { throw "wix build failed ($LASTEXITCODE)" }
          Remove-Item -Recurse -Force dist/portable

      - name: Package unsigned Microsoft Store MSIX
        if: ${{ vars.QRATE_STORE_APPLICATION_ID != '' && vars.QRATE_STORE_IDENTITY_NAME != '' && vars.QRATE_STORE_IDENTITY_PUBLISHER != '' && vars.QRATE_STORE_PUBLISHER_DISPLAY_NAME != '' }}
        shell: pwsh
        env:
          QRATE_STORE_IDENTITY_NAME: ${{ vars.QRATE_STORE_IDENTITY_NAME }}
          QRATE_STORE_IDENTITY_PUBLISHER: ${{ vars.QRATE_STORE_IDENTITY_PUBLISHER }}
          QRATE_STORE_PUBLISHER_DISPLAY_NAME: ${{ vars.QRATE_STORE_PUBLISHER_DISPLAY_NAME }}
        run: |
          $ver = "${{ needs.version.outputs.version }}"
          ./scripts/package-store-msix.ps1 `
            -SourceExe target/release/app.exe `
            -OutputPath "dist/qrate-$ver-x64.msix" `
            -QrateVersion $ver `
            -IdentityName $env:QRATE_STORE_IDENTITY_NAME `
            -IdentityPublisher $env:QRATE_STORE_IDENTITY_PUBLISHER `
            -PublisherDisplayName $env:QRATE_STORE_PUBLISHER_DISPLAY_NAME

      # 7-Zip reads NSIS installers, which is the only way to see what one carries without running it.
      - name: Check what each installer carries
        shell: bash
        run: |
          ver="${{ needs.version.outputs.version }}"
          7z l "dist/qrate-$ver-setup.exe" > full.txt
          7z l "dist/qrate-$ver-base-setup.exe" > base.txt
          for part in pdfium.dll ffmpeg.exe pi.exe; do
            grep -q "$part" full.txt || { echo "::error::the full installer is missing $part"; exit 1; }
            ! grep -q "$part" base.txt || { echo "::error::the base installer carries $part"; exit 1; }
          done
          rm full.txt base.txt

      - name: Report what shipped
        shell: bash
        run: ls -lh dist/

      - uses: actions/upload-artifact@v7
        with:
          name: windows-build
          path: |
            dist/*.zip
            dist/*-setup.exe
            dist/*.msi
          if-no-files-found: error

      - uses: actions/upload-artifact@v7
        with:
          name: components-windows
          path: components-dist/*
          if-no-files-found: error

      - uses: actions/upload-artifact@v7
        if: ${{ vars.QRATE_STORE_APPLICATION_ID != '' && vars.QRATE_STORE_IDENTITY_NAME != '' && vars.QRATE_STORE_IDENTITY_PUBLISHER != '' && vars.QRATE_STORE_PUBLISHER_DISPLAY_NAME != '' }}
        with:
          name: windows-store-msix
          path: dist/*.msix
          if-no-files-found: error

  # ---------------------------------------------------------------------------
  # Linux: binary + .desktop + icon in a tarball.
  # Built on the oldest supported runner so the glibc/OpenSSL it links against
  # is old enough for the distros people actually run.
  # ---------------------------------------------------------------------------
  build-linux:
    needs: version
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: release
          save-if: false

      - name: Install system libraries
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            pkg-config libssl-dev libfontconfig-dev libwayland-dev \
            libxkbcommon-x11-dev libx11-xcb-dev libvulkan-dev libasound2-dev

      - name: Build
        run: |
          cargo build --release -p app
          cargo build --release -p updater --bin qrate-update-helper

      - name: Package tarball
        run: |
          chmod +x scripts/fetch-binaries.sh
          ver="${{ needs.version.outputs.version }}"
          stage="qrate-$ver-x86_64-linux"
          mkdir -p "$stage"
          cp target/release/app "$stage/qrate"
          cp target/release/qrate-update-helper "$stage/qrate-update-helper"
          chmod +x "$stage/qrate-update-helper"
          printf '{\n  "schema": 1,\n  "kind": "linux-tar",\n  "packaged_version": "%s"\n}\n' \
            "$ver" > "$stage/qrate-install.json"
          cp assets/icons/app-icon.png "$stage/qrate.png"
          cp assets/linux/qrate-mime.xml "$stage/qrate-mime.xml"
          # PDFium ships in the tarball beside the binary, where the preview tier looks for it.
          # ffmpeg does not: it is one `apt install` away and every distro packages it, so we
          # would be shipping ~50 MB to duplicate something already on most machines.
          QRATE_SKIP_FFMPEG=1 QRATE_STRICT_BINARIES=1 ./scripts/fetch-binaries.sh "$stage"
          chmod +x scripts/fetch-agent-runtime.sh
          ./scripts/fetch-agent-runtime.sh "$stage" linux-x64
          printf '%s\n' '[Desktop Entry]' 'Type=Application' 'Name=qrate' \
            'Exec=qrate %u' 'Icon=qrate' 'Terminal=false' \
            'Categories=Office;Database;' \
            'MimeType=application/x-qrate-project;inode/directory;x-scheme-handler/qrate;' \
            > "$stage/qrate.desktop"
          # Base: the same folder without PDFium and Pi, which qrate installs on first use.
          base="qrate-$ver-base-x86_64-linux"
          cp -R "$stage" "$base"
          rm -rf "$base/libpdfium.so" "$base/agent"
          printf '{\n  "schema": 1,\n  "kind": "linux-tar",\n  "packaged_version": "%s",\n  "flavor": "base"\n}\n' \
            "$ver" > "$base/qrate-install.json"
          mkdir -p dist
          tar -czf "dist/$stage.tar.gz" "$stage"
          tar -czf "dist/$base.tar.gz" "$base"
          for part in libpdfium.so agent/pi; do
            tar -tzf "dist/$stage.tar.gz" | grep -qx "$stage/$part" ||
              { echo "::error::the full tarball is missing $part"; exit 1; }
            ! tar -tzf "dist/$base.tar.gz" | grep -q "^$base/$part" ||
              { echo "::error::the base tarball carries $part"; exit 1; }
          done
          rm -rf "$base"

      - uses: actions/upload-artifact@v7
        with:
          name: linux-build
          path: dist/*.tar.gz
          if-no-files-found: error

      # PDFium and Pi come from the tarball's own folder. ffmpeg is not in the tarball, so this
      # fetches the same pinned build for the component, with its LGPL notice.
      - name: Package optional components
        env:
          QRATE_STRICT_BINARIES: 1
          QRATE_FFMPEG_LICENSE: components/ffmpeg/LICENSE.txt
        run: |
          stage="qrate-${{ needs.version.outputs.version }}-x86_64-linux"
          chmod +x scripts/package-component.sh
          mkdir -p components/pdfium components/ffmpeg components-dist
          ./scripts/fetch-binaries.sh components/raw
          cp "$stage/libpdfium.so" components/pdfium/
          cp components/raw/ffmpeg components/ffmpeg/
          ./scripts/package-component.sh pdfium components/pdfium linux x86_64 components-dist
          ./scripts/package-component.sh ffmpeg components/ffmpeg linux x86_64 components-dist
          ./scripts/package-component.sh agent "$stage/agent" linux x86_64 components-dist

      - uses: actions/upload-artifact@v7
        with:
          name: components-linux
          path: components-dist/*
          if-no-files-found: error

  # ---------------------------------------------------------------------------
  # Collect artifacts, checksum them, publish a DRAFT release.
  # ---------------------------------------------------------------------------
  release:
    needs: [version, bundle-macos, build-windows, build-linux]
    runs-on: ubuntu-latest
    environment: release-signing
    steps:
      # The signing script lives in the repo; only this job needs it, and only this job has the key.
      - uses: actions/checkout@v7

      # Only the final artifacts — not the intermediate per-arch macOS binaries.
      - uses: actions/download-artifact@v8
        with:
          name: macos-dmg
          path: dist
      - uses: actions/download-artifact@v8
        with:
          name: windows-build
          path: dist
      - uses: actions/download-artifact@v8
        with:
          name: linux-build
          path: dist
      - uses: actions/download-artifact@v8
        with:
          pattern: components-*
          path: dist
          merge-multiple: true

      # Every release carries its own copy of the pinned CLIP weights, so visual search keeps a
      # download if Hugging Face stops serving them. If Hugging Face is already gone, an earlier
      # release's copy is checked against the same pins and carried forward.
      - name: Package the CLIP weights
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          chmod +x scripts/fetch-clip-weights.sh scripts/package-component.sh
          if ! ./scripts/fetch-clip-weights.sh clip; then
            echo "::warning::Hugging Face did not serve the pinned CLIP weights; reusing an earlier release's copy"
            rm -rf clip previous
            mkdir -p clip previous
            for tag in $(gh release list --repo "$GITHUB_REPOSITORY" --limit 30 \
                --json tagName,isDraft --jq '.[] | select(.isDraft | not) | .tagName'); do
              if gh release download "$tag" --repo "$GITHUB_REPOSITORY" \
                  --pattern 'component-clip-*.tar' --dir previous --clobber; then
                tar -xf previous/component-clip-*.tar -C clip
                break
              fi
            done
            ./scripts/fetch-clip-weights.sh --verify clip
          fi
          ./scripts/package-component.sh clip clip any any dist
          rm -rf clip previous

      - name: Generate checksums
        run: |
          cd dist
          sha256sum *.dmg *.zip *-setup.exe *.msi *.tar.gz component-*.tar > SHA256SUMS.txt
          cat SHA256SUMS.txt

      - name: Build and sign update manifest
        env:
          QRATE_UPDATE_SIGNING_KEY: ${{ secrets.QRATE_UPDATE_SIGNING_KEY }}
        shell: bash
        run: |
          chmod +x scripts/build-update-manifest.sh
          ./scripts/build-update-manifest.sh dist "${{ needs.version.outputs.tag }}"

      # Signed with the same key; the script checks the signature before writing the file.
      - name: Build and sign components manifest
        env:
          QRATE_UPDATE_SIGNING_KEY: ${{ secrets.QRATE_UPDATE_SIGNING_KEY }}
          # Each id:os:arch the jobs above package. macOS has no ffmpeg component.
          QRATE_COMPONENTS_REQUIRE: >-
            pdfium:windows:x86_64 pdfium:linux:x86_64 pdfium:macos:x86_64 pdfium:macos:aarch64
            ffmpeg:windows:x86_64 ffmpeg:linux:x86_64
            agent:windows:x86_64 agent:linux:x86_64 agent:macos:x86_64 agent:macos:aarch64
            clip:any:any
        shell: bash
        run: |
          chmod +x scripts/build-components-manifest.sh
          ./scripts/build-components-manifest.sh dist "${{ needs.version.outputs.tag }}"

      - name: Publish draft release
        uses: softprops/action-gh-release@v3
        with:
          draft: true
          prerelease: ${{ contains(needs.version.outputs.version, '-') }}
          tag_name: ${{ needs.version.outputs.tag }}
          name: ${{ needs.version.outputs.tag }}
          fail_on_unmatched_files: true
          files: |
            dist/*.dmg
            dist/*.zip
            dist/*-setup.exe
            dist/*.msi
            dist/*.tar.gz
            dist/component-*.tar
            dist/SHA256SUMS.txt
            dist/update-manifest.json
            dist/components.json
          body: |
            ## qrate ${{ needs.version.outputs.tag }}

            ### Downloads
            Choose a download for your platform at https://qrate.dvnl.work/docs/install. Start with
            the **base** download: it leaves out PDF preview, video preview and the
            assistant's runtime, and qrate offers to install each one the first time you need it
            (or under Settings ▸ Components). The **full** download carries the bundled tools for
            machines with limited connectivity. macOS video preview still needs ffmpeg installed
            separately.

            - **Windows:** `*-base-setup.exe` (installer, asks for per-user or all-users). Full:
              `*-<version>-setup.exe`, or `*-x86_64.zip` (portable). Also on the
              [Microsoft Store](https://apps.microsoft.com/detail/9NL2FCHXTBMM), which updates it
              for you. Deploying to managed machines? See **Enterprise** below.
            - **macOS:** `*-base-universal.dmg` (Intel + Apple Silicon). Full: `*-<version>-universal.dmg`.
            - **Linux:** `*-base-x86_64-linux.tar.gz` (Wayland + X11; needs a Vulkan driver).
              Full: `*-<version>-x86_64-linux.tar.gz`.

            An installed qrate updates to the same kind of download it came from. Verify your
            download against `SHA256SUMS.txt`. The `component-*` files and `components.json` are
            the parts qrate downloads by itself; you do not need to download them.

            ### Enterprise (Windows)
            `*-x86_64.msi` installs per-machine and is built for Group Policy Software
            Installation, SCCM, and Intune — or a plain silent push:
            ```
            msiexec /i qrate-${{ needs.version.outputs.version }}-x86_64.msi /quiet /norestart
            ```
            Upgrades in place on top of any earlier MSI install; downgrading is blocked.

            ### File previews
            PDF previews need PDFium, which the full downloads carry and the base ones install on
            the first PDF you open.

            Video previews and JPEG 2000/AVIF/HEIC need **ffmpeg**. On Windows and Linux qrate
            installs it on the first video you open (the full Windows download carries it). On
            macOS install it with Homebrew and qrate will find it on your `PATH`:

            ```
            brew install ffmpeg          # macOS
            ```

            A copy already installed on the computer, such as `sudo apt install ffmpeg`, is used
            too. Without ffmpeg those files fall back to a file-type icon; nothing else is affected.

            > [!NOTE]
            > These builds do not have a Windows publisher signature or an Apple Developer ID
            > signature and notarization. This is separate from the signature qrate checks on an update.
            > - **Windows:** SmartScreen may warn "unknown publisher" — click *More info → Run anyway*.
            > - **macOS:** try to open it once, then choose *Open Anyway* under System Settings → Privacy & Security.

  # Store signs the package after certification. Keep the unsigned upload as a workflow artifact,
  # separate from the established GitHub release downloads.
  submit-store:
    needs: [version, build-windows, release]
    if: ${{ !contains(needs.version.outputs.version, '-') && vars.QRATE_STORE_SUBMISSIONS_ENABLED == 'true' && vars.QRATE_STORE_APPLICATION_ID != '' && vars.QRATE_STORE_IDENTITY_NAME != '' && vars.QRATE_STORE_IDENTITY_PUBLISHER != '' && vars.QRATE_STORE_PUBLISHER_DISPLAY_NAME != '' }}
    runs-on: windows-latest
    environment: release-signing
    concurrency:
      group: microsoft-store-${{ vars.QRATE_STORE_APPLICATION_ID }}
      cancel-in-progress: false
    permissions:
      contents: read
    env:
      QRATE_STORE_APPLICATION_ID: ${{ vars.QRATE_STORE_APPLICATION_ID }}
      QRATE_STORE_TENANT_ID: ${{ secrets.QRATE_STORE_TENANT_ID }}
      QRATE_STORE_CLIENT_ID: ${{ secrets.QRATE_STORE_CLIENT_ID }}
      QRATE_STORE_CLIENT_SECRET: ${{ secrets.QRATE_STORE_CLIENT_SECRET }}
    steps:
      - uses: actions/checkout@v7
      - uses: actions/download-artifact@v8
        with:
          name: windows-store-msix
          path: store-package
      - name: Submit stable MSIX to Partner Center
        shell: pwsh
        run: |
          $package = Get-ChildItem store-package/*.msix | Select-Object -First 1
          if (-not $package) { throw 'The Windows Store MSIX artifact is missing.' }
          ./scripts/submit-store-msix.ps1 `
            -PackagePath $package.FullName `
            -QrateVersion "${{ needs.version.outputs.version }}"