release.yml

name: Build and Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version tag (e.g., v0.1.0)'
        required: true
        default: 'v0.1.0'

jobs:
  create-release:
    permissions:
      contents: write
    runs-on: ubuntu-latest
    outputs:
      release_id: ${{ steps.create-release.outputs.result }}
      version: ${{ steps.get-version.outputs.version }}

    steps:
      - uses: actions/checkout@v6

      - name: Get version
        id: get-version
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "version=${{ github.event.inputs.version }}" >> $GITHUB_OUTPUT
          else
            echo "version=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
          fi

      - name: Create release
        id: create-release
        uses: actions/github-script@v8
        with:
          script: |
            const version = '${{ steps.get-version.outputs.version }}';
            const { data } = await github.rest.repos.createRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              tag_name: version,
              name: `Open Frame Studio ${version}`,
              body: `## Open Frame Studio ${version}\n\nParametric window frame design software for the construction industry.\n\n### Downloads\n- **Windows (System)**: Download the \`*_x64-setup.exe\` installer (requires admin)\n- **Windows (User)**: Download the \`*_x64_user-setup.exe\` installer (no admin required)\n- **macOS**: Download the \`.dmg\` file (universal — supports Intel and Apple Silicon)\n- **Linux**: Download the \`.deb\` package or \`.AppImage\`\n\n### Features\n- Parametric window frame design with grid editor\n- IFC / DXF / PDF / glTF export\n- Profile database (wood, PVC, aluminum)\n- Production lists & cost calculation\n- Blender/Bonsai integration\n- Multi-language (NL / EN / DE)`,
              draft: true,
              prerelease: false
            });
            return data.id;

  build:
    needs: create-release
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: 'ubuntu-22.04'
            args: ''
            target: 'linux'
          - platform: 'macos-latest'
            args: '--target universal-apple-darwin'
            target: 'macos'
          - platform: 'windows-latest'
            args: ''
            target: 'windows-system'
          - platform: 'windows-latest'
            args: ''
            target: 'windows-user'

    runs-on: ${{ matrix.platform }}

    steps:
      - uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 20

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable

      - name: Install Rust targets (macOS universal)
        if: matrix.target == 'macos'
        run: rustup target add aarch64-apple-darwin x86_64-apple-darwin

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: '. -> target'

      - name: Install dependencies (Ubuntu only)
        if: matrix.target == 'linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      - name: Install frontend dependencies
        working-directory: ui
        run: npm install

      - name: Build frontend
        working-directory: ui
        run: npm run build

      - name: Set user install mode
        if: matrix.target == 'windows-user'
        shell: pwsh
        run: |
          $conf = Get-Content src-tauri/tauri.conf.json -Raw | ConvertFrom-Json
          if (-not $conf.bundle.PSObject.Properties['windows']) {
            $conf.bundle | Add-Member -NotePropertyName 'windows' -NotePropertyValue @{}
          }
          if (-not $conf.bundle.windows.PSObject.Properties['nsis']) {
            $conf.bundle.windows | Add-Member -NotePropertyName 'nsis' -NotePropertyValue @{}
          }
          $conf.bundle.windows.nsis.installMode = "currentUser"
          $conf | ConvertTo-Json -Depth 10 | Set-Content src-tauri/tauri.conf.json

      - name: Clear beforeBuildCommand (frontend already built)
        shell: node {0}
        run: |
          const fs = require('fs');
          const conf = JSON.parse(fs.readFileSync('src-tauri/tauri.conf.json', 'utf8'));
          conf.build.beforeBuildCommand = '';
          conf.build.beforeDevCommand = '';
          fs.writeFileSync('src-tauri/tauri.conf.json', JSON.stringify(conf, null, 2));
          console.log('Cleared beforeBuildCommand and beforeDevCommand');

      - name: Build Tauri app
        if: matrix.target != 'windows-user'
        uses: tauri-apps/tauri-action@action-v0.6.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          projectPath: src-tauri
          args: ${{ matrix.args }}
          releaseId: ${{ needs.create-release.outputs.release_id }}

      - name: Build Tauri app (user installer)
        if: matrix.target == 'windows-user'
        uses: tauri-apps/tauri-action@action-v0.6.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          projectPath: src-tauri
          args: ${{ matrix.args }}

      - name: Authenticode sign Windows exe and installer
        if: contains(matrix.target, 'windows')
        uses: azure/trusted-signing-action@v1
        with:
          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
          endpoint: ${{ secrets.AZURE_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERTIFICATE_PROFILE_NAME }}
          cache-dependencies: false
          files-folder: ${{ github.workspace }}/target/release/bundle/nsis
          files-folder-filter: exe
          files-folder-depth: 1
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Sign main executable
        if: contains(matrix.target, 'windows')
        uses: azure/trusted-signing-action@v1
        with:
          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
          endpoint: ${{ secrets.AZURE_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_TRUSTED_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERTIFICATE_PROFILE_NAME }}
          cache-dependencies: false
          files-folder: ${{ github.workspace }}/target/release
          files-folder-filter: exe
          files-folder-depth: 1
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Re-upload signed system installer
        if: matrix.target == 'windows-system'
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          $VERSION = "${{ needs.create-release.outputs.version }}"
          $NSIS_DIR = "target/release/bundle/nsis"
          $EXE = Get-ChildItem "$NSIS_DIR/*-setup.exe" | Select-Object -First 1
          if ($EXE) {
            Write-Host "Re-uploading signed installer: $($EXE.Name)"
            gh release upload $VERSION "$($EXE.FullName)" --clobber --repo "${{ github.repository }}"
          }

      - name: Upload user installer to release
        if: matrix.target == 'windows-user'
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          $VERSION = "${{ needs.create-release.outputs.version }}"
          $NSIS_DIR = "target/release/bundle/nsis"
          $EXE = Get-ChildItem "$NSIS_DIR/*-setup.exe" | Select-Object -First 1
          $NEW_NAME = $EXE.Name -replace '_x64-setup\.exe$', '_x64_user-setup.exe'
          $NEW_PATH = Join-Path $EXE.DirectoryName $NEW_NAME
          Rename-Item $EXE.FullName $NEW_PATH
          gh release upload $VERSION "$NEW_PATH" --clobber --repo "${{ github.repository }}"
          Write-Host "Uploaded user installer: $NEW_NAME"

  publish-release:
    permissions:
      contents: write
    runs-on: ubuntu-latest
    needs: [create-release, build]

    steps:
      - name: Publish release
        uses: actions/github-script@v8
        env:
          release_id: ${{ needs.create-release.outputs.release_id }}
        with:
          script: |
            github.rest.repos.updateRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              release_id: process.env.release_id,
              draft: false,
              prerelease: false
            });