release.yml

name: Release

on:
  pull_request:
    branches: [main]
    types: [closed]

permissions:
  contents: write
  id-token: write
  actions: read

jobs:
  release:
    if: github.event.pull_request.merged == true && github.event.pull_request.head.ref == 'dev'
    runs-on: windows-latest

    steps:
      - uses: actions/checkout@v4

      - name: Get version
        id: version
        shell: pwsh
        run: |
          $version = ([xml](Get-Content src/PlanViewer.App/PlanViewer.App.csproj)).Project.PropertyGroup.Version | Where-Object { $_ }
          echo "VERSION=$version" >> $env:GITHUB_OUTPUT

      - name: Check if release already exists
        id: check
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          if gh release view "v${{ steps.version.outputs.VERSION }}" > /dev/null 2>&1; then
            echo "EXISTS=true" >> $GITHUB_OUTPUT
          else
            echo "EXISTS=false" >> $GITHUB_OUTPUT
          fi

      - name: Create release
        if: steps.check.outputs.EXISTS == 'false'
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "v${{ steps.version.outputs.VERSION }}" --title "v${{ steps.version.outputs.VERSION }}" --generate-notes --target main

      - name: Setup .NET 8.0
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: 8.0.x

      - name: Build and test
        run: |
          dotnet restore
          dotnet build -c Release
          dotnet test tests/PlanViewer.Core.Tests/PlanViewer.Core.Tests.csproj -c Release --no-build --verbosity normal

      - name: Publish App (all platforms)
        run: |
          dotnet publish src/PlanViewer.App/PlanViewer.App.csproj -c Release -r win-x64 --self-contained -o publish/win-x64
          dotnet publish src/PlanViewer.App/PlanViewer.App.csproj -c Release -r linux-x64 --self-contained -o publish/linux-x64
          dotnet publish src/PlanViewer.App/PlanViewer.App.csproj -c Release -r osx-x64 --self-contained -o publish/osx-x64
          dotnet publish src/PlanViewer.App/PlanViewer.App.csproj -c Release -r osx-arm64 --self-contained -o publish/osx-arm64

      # ── SignPath code signing (Windows only, skipped if secret not configured) ──
      - name: Check if signing is configured
        id: signing
        shell: bash
        run: |
          if [ -n "${{ secrets.SIGNPATH_API_TOKEN }}" ]; then
            echo "ENABLED=true" >> $GITHUB_OUTPUT
          else
            echo "ENABLED=false" >> $GITHUB_OUTPUT
            echo "::warning::SIGNPATH_API_TOKEN not configured — releasing unsigned binaries"
          fi

      - name: Upload Windows build for signing
        if: steps.signing.outputs.ENABLED == 'true'
        id: upload-unsigned
        uses: actions/upload-artifact@v4
        with:
          name: App-unsigned
          path: publish/win-x64/

      - name: Sign Windows build
        if: steps.signing.outputs.ENABLED == 'true'
        uses: signpath/github-action-submit-signing-request@v1
        with:
          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
          organization-id: '7969f8b6-d946-4a74-9bac-a55856d8b8e0'
          project-slug: 'PerformanceStudio'
          signing-policy-slug: 'release-signing'
          artifact-configuration-slug: 'App'
          github-artifact-id: '${{ steps.upload-unsigned.outputs.artifact-id }}'
          wait-for-completion: true
          output-artifact-directory: 'signed/win-x64'

      - name: Replace unsigned Windows build with signed
        if: steps.signing.outputs.ENABLED == 'true'
        shell: pwsh
        run: |
          Remove-Item -Recurse -Force publish/win-x64
          Copy-Item -Recurse signed/win-x64 publish/win-x64

      # ── Velopack (uses signed Windows binaries) ───────────────────────
      - name: Create Velopack release (Windows)
        shell: pwsh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.version.outputs.VERSION }}
        run: |
          dotnet tool install -g vpk
          New-Item -ItemType Directory -Force -Path releases/velopack

          # Download previous release for delta generation
          vpk download github --repoUrl https://github.com/${{ github.repository }} --channel win -o releases/velopack --token $env:GH_TOKEN

          # Pack Windows release (now signed)
          vpk pack -u PerformanceStudio -v $env:VERSION -p publish/win-x64 -e PlanViewer.App.exe -o releases/velopack --channel win

      # ── Package and upload ────────────────────────────────────────────
      - name: Package and upload
        shell: pwsh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.version.outputs.VERSION }}
        run: |
          New-Item -ItemType Directory -Force -Path releases

          # Package Windows (signed) and Linux as flat zips
          foreach ($rid in @('win-x64', 'linux-x64')) {
            if (Test-Path 'README.md') { Copy-Item 'README.md' "publish/$rid/" }
            if (Test-Path 'LICENSE') { Copy-Item 'LICENSE' "publish/$rid/" }
            Compress-Archive -Path "publish/$rid/*" -DestinationPath "releases/PerformanceStudio-$rid.zip" -Force
          }

          # Package macOS as proper .app bundles
          foreach ($rid in @('osx-x64', 'osx-arm64')) {
            $appName = "PerformanceStudio.app"
            $bundleDir = "publish/$rid-bundle/$appName"

            # Create .app bundle structure
            New-Item -ItemType Directory -Force -Path "$bundleDir/Contents/MacOS"
            New-Item -ItemType Directory -Force -Path "$bundleDir/Contents/Resources"

            # Copy all published files into Contents/MacOS
            Copy-Item -Path "publish/$rid/*" -Destination "$bundleDir/Contents/MacOS/" -Recurse

            # Move Info.plist to Contents/ (it was copied to MacOS/ with the publish output)
            if (Test-Path "$bundleDir/Contents/MacOS/Info.plist") {
              Move-Item -Path "$bundleDir/Contents/MacOS/Info.plist" -Destination "$bundleDir/Contents/Info.plist" -Force
            }

            # Update version in Info.plist to match csproj
            $plist = Get-Content "$bundleDir/Contents/Info.plist" -Raw
            $plist = $plist -replace '(<key>CFBundleVersion</key>\s*<string>)[^<]*(</string>)', "`${1}$env:VERSION`${2}"
            $plist = $plist -replace '(<key>CFBundleShortVersionString</key>\s*<string>)[^<]*(</string>)', "`${1}$env:VERSION`${2}"
            Set-Content -Path "$bundleDir/Contents/Info.plist" -Value $plist -NoNewline

            # Move icon to Contents/Resources
            if (Test-Path "$bundleDir/Contents/MacOS/EDD.icns") {
              Move-Item -Path "$bundleDir/Contents/MacOS/EDD.icns" -Destination "$bundleDir/Contents/Resources/EDD.icns" -Force
            }

            # Add README and LICENSE alongside the .app bundle
            $wrapperDir = "publish/$rid-bundle"
            if (Test-Path 'README.md') { Copy-Item 'README.md' "$wrapperDir/" }
            if (Test-Path 'LICENSE') { Copy-Item 'LICENSE' "$wrapperDir/" }

            Compress-Archive -Path "$wrapperDir/*" -DestinationPath "releases/PerformanceStudio-$rid.zip" -Force
          }

          # Checksums (zips only, Velopack has its own checksums)
          $checksums = Get-ChildItem releases/*.zip | ForEach-Object {
            $hash = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
            "$hash  $($_.Name)"
          }
          $checksums | Out-File -FilePath releases/SHA256SUMS.txt -Encoding utf8
          Write-Host "Checksums:"
          $checksums | ForEach-Object { Write-Host $_ }

          # Upload zips + checksums
          gh release upload "v$env:VERSION" releases/*.zip releases/SHA256SUMS.txt --clobber

          # Upload Velopack artifacts
          vpk upload github --repoUrl https://github.com/${{ github.repository }} --channel win -o releases/velopack --releaseName "v$env:VERSION" --tag "v$env:VERSION" --merge --token $env:GH_TOKEN