release.yml

name: Build & Release

# Fires when a version tag is pushed: git tag v1.2.3 && git push --tags
on:
  push:
    tags:
      - "v*"

permissions:
  contents: write   # create release + upload assets

env:
  CARGO_TERM_COLOR: always

jobs:
  # ── Build one binary per target ──────────────────────────────────────────────
  build:
    name: Build (${{ matrix.target }})
    runs-on: windows-latest

    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-pc-windows-msvc
            label: x64
          - target: i686-pc-windows-msvc
            label: x86
          - target: aarch64-pc-windows-msvc
            label: arm64

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust stable + target
        run: |
          rustup update stable
          rustup default stable
          rustup target add ${{ matrix.target }}

      - name: Set version from tag
        shell: pwsh
        run: |
          $ver = "${{ github.ref_name }}".TrimStart("v")
          $lines = Get-Content Cargo.toml
          $done = $false
          $lines = $lines | ForEach-Object {
            if (!$done -and $_ -match '^version\s*=\s*"') {
              $done = $true
              "version = `"$ver`""
            } else { $_ }
          }
          $lines | Set-Content Cargo.toml

      - name: Cache cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-${{ matrix.target }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-${{ matrix.target }}-cargo-

      - name: Build release binary
        run: cargo build --release --target ${{ matrix.target }}

      - name: Stage raw exe (for combined portable bundle)
        shell: pwsh
        run: |
          $lbl = "${{ matrix.label }}"
          New-Item -ItemType Directory -Force -Path "exe\$lbl" | Out-Null
          Copy-Item "target\${{ matrix.target }}\release\HideDesktopApps.exe" "exe\$lbl\HideDesktopApps.exe"

      - name: Upload raw exe artifact
        uses: actions/upload-artifact@v4
        with:
          name: exe-${{ matrix.label }}
          path: exe/${{ matrix.label }}/HideDesktopApps.exe
          retention-days: 1

  # ── Installers (one per arch, needs Inno Setup) ──────────────────────────────
  installer:
    name: Build installer (${{ matrix.label }})
    runs-on: windows-latest
    needs: build

    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-pc-windows-msvc
            label: x64
          - target: i686-pc-windows-msvc
            label: x86
          - target: aarch64-pc-windows-msvc
            label: arm64

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust stable + target
        run: |
          rustup update stable
          rustup default stable
          rustup target add ${{ matrix.target }}

      - name: Set version from tag
        shell: pwsh
        run: |
          $ver = "${{ github.ref_name }}".TrimStart("v")
          $lines = Get-Content Cargo.toml
          $done = $false
          $lines = $lines | ForEach-Object {
            if (!$done -and $_ -match '^version\s*=\s*"') {
              $done = $true
              "version = `"$ver`""
            } else { $_ }
          }
          $lines | Set-Content Cargo.toml

      - name: Cache cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-${{ matrix.target }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-${{ matrix.target }}-cargo-

      - name: Build binary
        run: cargo build --release --target ${{ matrix.target }}

      - name: Install Inno Setup
        run: choco install innosetup --no-progress -y

      - name: Compile installer
        shell: pwsh
        run: |
          $ver = "${{ github.ref_name }}".TrimStart("v")
          New-Item -ItemType Directory -Force -Path installer-output | Out-Null
          & "C:\Program Files (x86)\Inno Setup 6\ISCC.exe" /DAppVersion=$ver /DArch=${{ matrix.label }} assets\installer.iss
          if ($LASTEXITCODE -ne 0) { throw "ISCC failed" }

      - name: SHA-256 for installer
        shell: pwsh
        run: |
          $file = Get-ChildItem installer-output\*.exe | Select-Object -First 1
          $hash = (Get-FileHash $file.FullName -Algorithm SHA256).Hash.ToLower()
          "$hash  $($file.Name)" | Set-Content "$($file.FullName).sha256"

      - name: Upload installer artifacts
        uses: actions/upload-artifact@v4
        with:
          name: installer-${{ matrix.label }}
          path: |
            installer-output\*.exe
            installer-output\*.sha256
          retention-days: 1

  # ── Combined portable folder ZIP (x64 + x86 + arm64) ─────────────────────────
  portable:
    name: Bundle combined portable ZIP
    runs-on: ubuntu-latest
    needs: build

    steps:
      - name: Download x64 exe
        uses: actions/download-artifact@v4
        with:
          name: exe-x64
          path: stage/x64
      - name: Download x86 exe
        uses: actions/download-artifact@v4
        with:
          name: exe-x86
          path: stage/x86
      - name: Download arm64 exe
        uses: actions/download-artifact@v4
        with:
          name: exe-arm64
          path: stage/arm64

      - name: Assemble folder ZIP + SHA-256
        shell: bash
        run: |
          VER="${{ github.ref_name }}"
          # Stable internal folder name (no version) so Scoop's extract_dir is
          # constant across releases. The ZIP file itself stays versioned.
          ROOT="HideDesktopApps"
          mkdir -p "$ROOT/x64" "$ROOT/x86" "$ROOT/arm64"
          cp stage/x64/HideDesktopApps.exe   "$ROOT/x64/"
          cp stage/x86/HideDesktopApps.exe   "$ROOT/x86/"
          cp stage/arm64/HideDesktopApps.exe "$ROOT/arm64/"
          ZIP="HideDesktopApps-$VER-portable.zip"
          zip -r "$ZIP" "$ROOT"
          sha256sum "$ZIP" > "$ZIP.sha256"

      - name: Upload combined portable artifact
        uses: actions/upload-artifact@v4
        with:
          name: portable-combined
          path: |
            HideDesktopApps-*-portable.zip
            HideDesktopApps-*-portable.zip.sha256
          retention-days: 1

  # ── Publish GitHub Release ───────────────────────────────────────────────────
  release:
    name: Publish release
    runs-on: windows-latest
    needs: [build, installer, portable]

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # Each artifact lands in its own subfolder (artifacts/<name>/...).
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Collect release files
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path dist | Out-Null
          # Copy ONLY the installer + portable artifacts. The raw exe-* artifacts
          # (all named HideDesktopApps.exe) are deliberately left out so they can't
          # collide or leak into the release as stray assets.
          Get-ChildItem artifacts -Directory |
            Where-Object { $_.Name -like 'installer-*' -or $_.Name -like 'portable-*' } |
            ForEach-Object { Get-ChildItem $_.FullName -File | Copy-Item -Destination dist -Force }

          # Consolidate all .sha256 sidecars into a single SHA256SUMS.txt
          $lines = Get-ChildItem dist\*.sha256 | Sort-Object Name | ForEach-Object { Get-Content $_.FullName }
          $lines | Set-Content dist\SHA256SUMS.txt -Encoding utf8NoBOM
          Remove-Item dist\*.sha256 -Force

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          name: "HideDesktopApps ${{ github.ref_name }}"
          body: |
            ## Install

            **Installer (recommended)**
            Download the setup for your architecture and run it:
            `…-x64-setup.exe` (most PCs), `…-x86-setup.exe` (32-bit), or `…-arm64-setup.exe`.

            **Scoop**
            ```
            scoop bucket add HideDesktopApps https://github.com/Londopy/HideDesktopApps
            scoop install HideDesktopApps
            ```

            **WinGet**
            ```
            winget install Londopy.HideDesktopApps
            ```

            **Portable**
            `HideDesktopApps-${{ github.ref_name }}-portable.zip` extracts to a `HideDesktopApps`
            folder with `x64/`, `x86/`, and `arm64/` subfolders — open the one for your PC and
            run `HideDesktopApps.exe`.

            ---
            SHA-256 checksums for all downloads are in `SHA256SUMS.txt`.
          files: |
            dist/*.exe
            dist/*.zip
            dist/SHA256SUMS.txt
          draft: false
          prerelease: ${{ contains(github.ref_name, '-') }}

  # ── Update Scoop manifest hash ────────────────────────────────────────────────
  scoop:
    name: Update Scoop manifest
    runs-on: ubuntu-latest
    needs: release
    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download combined portable checksum
        uses: actions/download-artifact@v4
        with:
          name: portable-combined
          path: dist

      - name: Patch manifest hash + version
        shell: bash
        run: |
          VER="${{ github.ref_name }}"
          VER="${VER#v}"
          SHA=$(cut -d' ' -f1 dist/*-portable.zip.sha256)
          URL="https://github.com/Londopy/HideDesktopApps/releases/download/v$VER/HideDesktopApps-v$VER-portable.zip"

          # Update version, hash, and the concrete top-level url. The url sed skips
          # any line containing '$version' so the autoupdate template stays intact.
          sed -i "s/\"version\": \".*\"/\"version\": \"$VER\"/" scoop/HideDesktopApps.json
          sed -i "s/\"hash\": \".*\"/\"hash\": \"$SHA\"/" scoop/HideDesktopApps.json
          sed -i "/\$version/! s|\"url\": \".*\"|\"url\": \"$URL\"|" scoop/HideDesktopApps.json

      - name: Push updated manifest
        shell: bash
        run: |
          git config user.name  "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git fetch origin main
          git checkout -b scoop-update origin/main
          git add scoop/HideDesktopApps.json
          if git diff --staged --quiet; then
            echo "No manifest changes to commit."
          else
            git commit -m "chore: update Scoop manifest to ${{ github.ref_name }}"
            git push origin scoop-update:main
          fi

  # ── Submit to WinGet (best-effort; requires a WINGET_TOKEN secret) ────────────
  # Set repo secret WINGET_TOKEN to a GitHub PAT (public_repo) to enable. Without
  # it the job no-ops. Skips prerelease tags. Never blocks the release.
  winget:
    name: Update WinGet manifest
    runs-on: windows-latest
    needs: release
    if: ${{ !contains(github.ref_name, '-') }}
    continue-on-error: true

    steps:
      - name: Submit via wingetcreate
        shell: pwsh
        env:
          WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
        run: |
          if (-not $env:WINGET_TOKEN) {
            Write-Host "WINGET_TOKEN secret not set; skipping WinGet submission."
            exit 0
          }
          $ver = "${{ github.ref_name }}".TrimStart("v")
          $url = "https://github.com/Londopy/HideDesktopApps/releases/download/${{ github.ref_name }}/HideDesktopApps-${{ github.ref_name }}-x64-setup.exe"
          $exe = "$env:RUNNER_TEMP\wingetcreate.exe"
          Invoke-WebRequest -Uri https://aka.ms/wingetcreate/latest -OutFile $exe
          & $exe update Londopy.HideDesktopApps --version $ver --urls $url --submit --token $env:WINGET_TOKEN