release.yml

name: Release

on:
  release:
    types: [created]

permissions:
  contents: write

env:
  GO_VERSION: "1.24"
  NODE_VERSION: "20"
  RUST_VERSION: "stable"
  BINARY_NAME: blue
  EMBEDDED_DISABLE_MERMAID: "1"

jobs:
  build-web:
    name: Build Web Frontend
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
          cache-dependency-path: web/package-lock.json

      - name: Install & Build
        working-directory: web
        run: |
          npm ci
          npm run build
          VITE_MODULE_UI=1 VITE_MODULE_NAME=zimaos-blue VITE_OUT_DIR=dist-module npm run build

      - name: Upload dist artifact
        uses: actions/upload-artifact@v4
        with:
          name: web-dist
          path: web/dist/
          retention-days: 1

      - name: Upload module dist artifact
        uses: actions/upload-artifact@v4
        with:
          name: web-dist-module
          path: web/dist-module/
          retention-days: 1

  build-web-embedded:
    name: Build Embedded Web Frontend
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
          cache-dependency-path: web/package-lock.json

      - name: Install & Build Embedded Dist
        working-directory: web
        run: |
          npm ci
          VITE_EMBED_DISABLE_MERMAID="${{ env.EMBEDDED_DISABLE_MERMAID }}" npm run build

      - name: Upload embedded dist artifact
        uses: actions/upload-artifact@v4
        with:
          name: web-dist-embedded
          path: web/dist/
          retention-days: 1

  build:
    name: Build ${{ matrix.goos }}/${{ matrix.goarch }}
    needs: [build-web, build-web-embedded]
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - goos: darwin
            goarch: arm64
            runner: macos-14
          - goos: darwin
            goarch: amd64
            runner: macos-15
          - goos: linux
            goarch: amd64
            runner: ubuntu-latest
          - goos: linux
            goarch: arm64
            runner: ubuntu-latest
            cross: true

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: server/go.sum

      - name: Download web dist
        if: matrix.goos != 'darwin'
        uses: actions/download-artifact@v4
        with:
          name: web-dist
          path: server/internal/web/dist/

      - name: Download embedded web dist
        if: matrix.goos == 'darwin'
        uses: actions/download-artifact@v4
        with:
          name: web-dist-embedded
          path: server/internal/web/dist/

      - name: Download module web dist
        if: matrix.goos == 'linux' && matrix.goarch == 'amd64'
        uses: actions/download-artifact@v4
        with:
          name: web-dist-module
          path: web/dist-module/

      - name: Trim dist
        shell: bash
        working-directory: server
        run: |
          rm -f internal/web/dist/stats.html
          find internal/web/dist -name "*.gz" -delete 2>/dev/null || true
          find internal/web/dist -name "*.br" -delete 2>/dev/null || true

      # macOS: install Apple certificate into temporary keychain for codesigning
      - name: Install Apple Certificate
        if: matrix.goos == 'darwin'
        shell: bash
        env:
          CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE }}
          CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
        run: bash .github/scripts/install-apple-certificate.sh

      # Linux arm64 cross-compile needs aarch64 C toolchain for CGO (sqlite3)
      - name: Install cross-compiler (linux/arm64)
        if: matrix.cross
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq gcc-aarch64-linux-gnu g++-aarch64-linux-gnu

      - name: Install squashfs tools (linux/amd64)
        if: matrix.goos == 'linux' && matrix.goarch == 'amd64'
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq squashfs-tools

      # Build espeak-ng static library (Linux needs it for TTS)
      - name: Build espeak-ng
        if: matrix.goos != 'darwin'
        shell: bash
        run: |
          cd third_party/espeak-ng
          mkdir -p build && cd build
          if [[ "${{ matrix.cross }}" == "true" ]]; then
            cmake .. -DBUILD_SHARED_LIBS=OFF \
              -DUSE_LIBPCAUDIO=OFF \
              -DCMAKE_C_COMPILER=aarch64-linux-gnu-gcc \
              -DCMAKE_CXX_COMPILER=aarch64-linux-gnu-g++ \
              -DCMAKE_SYSTEM_NAME=Linux \
              -DCMAKE_SYSTEM_PROCESSOR=aarch64
            make -j$(nproc)
          else
            cmake .. -DBUILD_SHARED_LIBS=OFF -DUSE_LIBPCAUDIO=OFF
            make -j$(nproc)
          fi

      # macOS uses launcher architecture (bluecli + launcher), others use direct go build
      - name: Build binary (macOS)
        if: matrix.goos == 'darwin'
        working-directory: server
        shell: bash
        env:
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: "1"
          ZIMAOS_TRIAL_LICENSE: ${{ secrets.ZIMAOS_TRIAL_LICENSE }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          export VERSION="${GITHUB_REF_NAME}"
          export GIT_COMMIT="$(git rev-parse --short HEAD)"
          export BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          make build

      - name: Build binary (non-macOS)
        if: matrix.goos != 'darwin'
        working-directory: server
        shell: bash
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: "1"
          ZIMAOS_TRIAL_LICENSE: ${{ secrets.ZIMAOS_TRIAL_LICENSE }}
        run: |
          if [[ "${{ matrix.cross }}" == "true" ]]; then
            export CC=aarch64-linux-gnu-gcc
          fi

          VERSION="${GITHUB_REF_NAME}"
          GIT_COMMIT="$(git rev-parse --short HEAD)"
          BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"

          LDFLAGS="-s -w"
          LDFLAGS="${LDFLAGS} -X main.version=${VERSION}"
          LDFLAGS="${LDFLAGS} -X main.gitCommit=${GIT_COMMIT}"
          LDFLAGS="${LDFLAGS} -X main.buildTime=${BUILD_TIME}"
          LDFLAGS="${LDFLAGS} -X github.com/IceWhaleTech/ZimaOS-Blue/server/internal/providerpool.trialLicense=${ZIMAOS_TRIAL_LICENSE}"

          mkdir -p bin
          go build -tags 'fts5 espeak kokoro' -ldflags "${LDFLAGS}" -o "bin/${BINARY_NAME}" ./cmd/blue

      - name: Build ZimaOS raw artifact
        if: matrix.goos == 'linux' && matrix.goarch == 'amd64'
        working-directory: server
        shell: bash
        run: |
          bash ../scripts/build_zimaos_raw.sh \
            --binary "$PWD/bin/${BINARY_NAME}" \
            --output "$PWD/bin/zimaos-blue.raw" \
            --dist-dir "$GITHUB_WORKSPACE/web/dist-module" \
            --module-name zimaos-blue \
            --command-name blue \
            --version "${GITHUB_REF_NAME}"

      # Pack dist into binary (Linux only — macOS launcher handles this)
      - name: Pack dist into binary
        if: matrix.goos != 'darwin'
        working-directory: server
        shell: bash
        run: |
          BINARY="bin/${BINARY_NAME}"

          RUNNER_TMP="${{ runner.temp }}"
          DIST_TAR="${RUNNER_TMP}/zimaos-dist.tar.gz"
          tar czf "${DIST_TAR}" -C internal/web/dist .

          if [[ "$(uname)" == "Darwin" ]]; then
            OFFSET=$(stat -f%z "${BINARY}")
          else
            OFFSET=$(stat -c%s "${BINARY}" 2>/dev/null || wc -c < "${BINARY}" | tr -d ' ')
          fi

          export PACK_DIST_TAR="${DIST_TAR}"
          export PACK_BINARY="${BINARY}"
          export PACK_OFFSET="${OFFSET}"

          python3 -c "
          import struct, os
          with open(os.environ['PACK_DIST_TAR'], 'rb') as f:
              dist = f.read()
          with open(os.environ['PACK_BINARY'], 'ab') as f:
              f.write(dist)
              f.write(struct.pack('<Q', int(os.environ['PACK_OFFSET'])))
          "
          rm -f "${DIST_TAR}"

      # Notarize macOS binary
      - name: Notarize macOS binary
        if: matrix.goos == 'darwin'
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        working-directory: server/bin
        run: |
          # Sign the final launcher binary too
          codesign --force --options runtime \
            --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" \
            --entitlements ../../tauri-app/src-tauri/entitlements.plist \
            --timestamp blue

          # Notarize
          zip blue.zip blue
          xcrun notarytool submit blue.zip \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_APP_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait
          rm blue.zip

      - name: Cleanup keychain
        if: matrix.goos == 'darwin' && always()
        run: |
          security delete-keychain "$RUNNER_TEMP/build.keychain" 2>/dev/null || true

      - name: Create archive
        working-directory: server/bin
        shell: bash
        run: |
          VERSION="${GITHUB_REF_NAME}"
          ARCHIVE="${BINARY_NAME}-${VERSION}-${{ matrix.goos }}-${{ matrix.goarch }}"
          tar czf "${ARCHIVE}.tar.gz" "${BINARY_NAME}"

      - name: Upload build artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.BINARY_NAME }}-${{ matrix.goos }}-${{ matrix.goarch }}
          path: |
            server/bin/blue-*.tar.gz
            server/bin/zimaos-blue.raw
          retention-days: 1

  build-tauri-macos:
    name: Build Tauri macOS (${{ matrix.arch }})
    needs: build-web
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: arm64
            runner: macos-14
            goarch: arm64
          - arch: amd64
            runner: macos-15
            goarch: amd64
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: server/go.sum

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
          cache-dependency-path: tauri-app/package-lock.json

      - uses: dtolnay/rust-toolchain@stable

      - name: Download web dist
        uses: actions/download-artifact@v4
        with:
          name: web-dist
          path: web/dist/

      - name: Copy dist to server embed dir
        run: |
          mkdir -p server/internal/web/dist
          rsync -a web/dist/ server/internal/web/dist/
          rm -f server/internal/web/dist/stats.html
          find server/internal/web/dist -name "*.gz" -delete 2>/dev/null || true
          find server/internal/web/dist -name "*.br" -delete 2>/dev/null || true

      - name: Install Apple Certificate
        shell: bash
        env:
          CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE }}
          CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
        run: bash .github/scripts/install-apple-certificate.sh

      - name: Build Go static library
        working-directory: server
        env:
          CGO_ENABLED: "1"
          ZIMAOS_TRIAL_LICENSE: ${{ secrets.ZIMAOS_TRIAL_LICENSE }}
        run: |
          VERSION="${GITHUB_REF_NAME}"
          GIT_COMMIT="$(git rev-parse --short HEAD)"
          BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"

          GO_LDFLAGS="-s -w"
          GO_LDFLAGS="${GO_LDFLAGS} -X main.version=${VERSION}"
          GO_LDFLAGS="${GO_LDFLAGS} -X main.gitCommit=${GIT_COMMIT}"
          GO_LDFLAGS="${GO_LDFLAGS} -X main.buildTime=${BUILD_TIME}"
          GO_LDFLAGS="${GO_LDFLAGS} -X github.com/IceWhaleTech/ZimaOS-Blue/server/internal/providerpool.trialLicense=${ZIMAOS_TRIAL_LICENSE}"

          mkdir -p ../tauri-app/src-tauri/lib
          go build -buildmode=c-archive \
            -tags 'fts5' \
            -ldflags="${GO_LDFLAGS}" \
            -o ../tauri-app/src-tauri/lib/libblue.a \
            ./cmd/bluelib/

      - name: Build Tauri app
        working-directory: tauri-app
        run: |
          npm install
          npm run build

      - name: Codesign .app
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          APP_DIR="tauri-app/src-tauri/target/release/bundle/macos"
          APP_NAME="ZimaOS Blue"

          # Copy web dist into .app Resources
          RESOURCES_DIR="$APP_DIR/$APP_NAME.app/Contents/Resources/dist"
          mkdir -p "$RESOURCES_DIR"
          rsync -a web/dist/ "$RESOURCES_DIR/"

          codesign --force --options runtime --deep \
            --sign "$APPLE_SIGNING_IDENTITY" \
            --entitlements tauri-app/src-tauri/entitlements.plist \
            --timestamp \
            "$APP_DIR/$APP_NAME.app"
          codesign --verify --verbose=2 "$APP_DIR/$APP_NAME.app"

      - name: Create LZMA DMG
        run: |
          brew install create-dmg
          APP_DIR="tauri-app/src-tauri/target/release/bundle/macos"
          DMG_DIR="tauri-app/src-tauri/target/release/bundle/dmg"
          APP_NAME="ZimaOS Blue"
          VERSION="${GITHUB_REF_NAME}"
          DMG_NAME="ZimaOS-Blue-${VERSION}-macos-${{ matrix.arch }}.dmg"

          mkdir -p "$DMG_DIR"
          create-dmg \
            --volname "$APP_NAME" \
            --window-pos 200 120 \
            --window-size 660 400 \
            --icon-size 100 \
            --icon "$APP_NAME.app" 180 170 \
            --hide-extension "$APP_NAME.app" \
            --app-drop-link 480 170 \
            --format ULMO \
            "$DMG_DIR/$DMG_NAME" \
            "$APP_DIR/$APP_NAME.app"

          # Remove the default Tauri-generated DMG so only the final hand-named DMG is published.
          find "$DMG_DIR" -name "*.dmg" -type f ! -name "$DMG_NAME" -delete
          ls -lh "$DMG_DIR"

      - name: Sign & Notarize DMG
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          VERSION="${GITHUB_REF_NAME}"
          DMG_DIR="tauri-app/src-tauri/target/release/bundle/dmg"
          DMG_NAME="ZimaOS-Blue-${VERSION}-macos-${{ matrix.arch }}.dmg"
          DMG_FILE="$DMG_DIR/$DMG_NAME"

          if [ ! -f "$DMG_FILE" ]; then
            echo "::error::Expected final DMG not found: $DMG_FILE"
            ls -lh "$DMG_DIR" 2>/dev/null || true
            exit 1
          fi

          codesign --force --sign "$APPLE_SIGNING_IDENTITY" --timestamp "$DMG_FILE"

          xcrun notarytool submit "$DMG_FILE" \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_APP_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait

          xcrun stapler staple "$DMG_FILE"
          MACOS_APP_PATH="tauri-app/src-tauri/target/release/bundle/macos/ZimaOS Blue.app" \
          MACOS_DMG_PATH="$DMG_FILE" \
          bash tauri-app/verify-macos-package.sh

      - name: Cleanup keychain
        if: always()
        run: |
          security delete-keychain "$RUNNER_TEMP/build.keychain" 2>/dev/null || true

      - name: Upload DMG artifact
        uses: actions/upload-artifact@v4
        with:
          name: blue-tauri-macos-${{ matrix.arch }}
          path: tauri-app/src-tauri/target/release/bundle/dmg/ZimaOS-Blue-*-macos-${{ matrix.arch }}.dmg
          retention-days: 1

  release:
    name: Upload Release Assets
    needs: [build, build-tauri-macos]
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: ./artifacts
          pattern: blue-*
          merge-multiple: true

      - name: List artifacts
        run: ls -lhR ./artifacts

      - name: Upload assets to release
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const fs = require('fs');
            const path = require('path');
            const tag = context.payload.release.tag_name;

            const dir = './artifacts';
            const files = fs.readdirSync(dir);
            for (const file of files) {
              const filePath = path.join(dir, file);
              if (!fs.statSync(filePath).isFile()) continue;
              console.log(`Uploading ${file}...`);
              await github.rest.repos.uploadReleaseAsset({
                owner: context.repo.owner,
                repo: context.repo.repo,
                release_id: context.payload.release.id,
                name: file,
                data: fs.readFileSync(filePath)
              });
            }

      - name: Update release body with download links
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const tag = context.payload.release.tag_name;
            const repo = `${context.repo.owner}/${context.repo.repo}`;
            const dl = `https://github.com/${repo}/releases/download/${tag}`;

            const existing = context.payload.release.body || '';

            const downloads = [
              '',
              '---',
              '',
              '## Downloads',
              '',
              '**macOS Desktop App (DMG):**',
              `- [macOS Apple Silicon (arm64)](${dl}/ZimaOS-Blue-${tag}-macos-arm64.dmg)`,
              `- [macOS Intel (amd64)](${dl}/ZimaOS-Blue-${tag}-macos-amd64.dmg)`,
              '',
              '**macOS CLI:**',
              `- [macOS Apple Silicon (arm64)](${dl}/blue-${tag}-darwin-arm64.tar.gz)`,
              `- [macOS Intel (amd64)](${dl}/blue-${tag}-darwin-amd64.tar.gz)`,
              '',
              '**Linux:**',
              `- [Linux x86_64 (amd64)](${dl}/blue-${tag}-linux-amd64.tar.gz)`,
              `- [Linux aarch64 (arm64)](${dl}/blue-${tag}-linux-arm64.tar.gz)`,
              '',
              '**ZimaOS / system extension:**',
              `- [ZimaOS raw module](${dl}/zimaos-blue.raw)`,
            ].join('\n');

            await github.rest.repos.updateRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              release_id: context.payload.release.id,
              body: existing + downloads
            });