build.yml

name: Build Release

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: write

jobs:
  build:
    runs-on: windows-latest

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable

      - name: Install WebView2
        shell: pwsh
        run: |
          $installer = "$env:TEMP\MicrosoftEdgeWebview2Setup.exe"
          Invoke-WebRequest "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile $installer
          Start-Process $installer -ArgumentList "/silent /install" -Wait

      - name: Install frontend deps
        run: npm ci

      - name: Validate updater signing key early
        env:
          TAURI_PRIVATE_KEY_FILE: ${{ secrets.TAURI_PRIVATE_KEY_FILE }}
        shell: pwsh
        run: |
          if ([string]::IsNullOrWhiteSpace($env:TAURI_PRIVATE_KEY_FILE)) {
            throw "TAURI_PRIVATE_KEY_FILE secret is empty."
          }

          $normalized = ($env:TAURI_PRIVATE_KEY_FILE -replace '\s', '')

          try {
            $decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($normalized))
          } catch {
            throw "TAURI_PRIVATE_KEY_FILE is not valid base64 after whitespace normalization."
          }

          if (-not $decoded.StartsWith("untrusted comment: rsign encrypted secret key")) {
            throw "Decoded updater key has unexpected header."
          }

          "TAURI_SIGNING_PRIVATE_KEY=$normalized" >> $env:GITHUB_ENV

      - name: Build Tauri app
        env:
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: npm run tauri build

      - name: Read version from tauri.conf.json
        id: version
        shell: pwsh
        run: |
          $json = Get-Content "src-tauri/tauri.conf.json" | ConvertFrom-Json
          $ver = $json.version
          $tag = "v$ver"

          Write-Output "version=$ver" >> $env:GITHUB_OUTPUT
          Write-Output "tag=$tag" >> $env:GITHUB_OUTPUT

          $existing = git tag -l "$tag"
          if ($existing) {
            Write-Output "exists=true" >> $env:GITHUB_OUTPUT
          } else {
            Write-Output "exists=false" >> $env:GITHUB_OUTPUT
          }

      - name: Build release notes
        id: release_notes
        shell: pwsh
        run: |
          $outputPath = Join-Path $env:RUNNER_TEMP "release-notes.md"
          $version = "${{ steps.version.outputs.version }}"
          $tag = "${{ steps.version.outputs.tag }}"
          $changelogUrl = "https://github.com/${{ github.repository }}/commits/$tag"
          $versionNotesPath = ".github/releases/$tag.md"
          $fallbackNotesPath = ".github/releases/_template.md"

          if (Test-Path $versionNotesPath) {
            $content = Get-Content $versionNotesPath -Raw
          } elseif (Test-Path $fallbackNotesPath) {
            $content = Get-Content $fallbackNotesPath -Raw
          } else {
            $content = @(
              "# Gaming Rumble {{tag}}",
              "",
              "## Resumo",
              "",
              "- Atualizacao publicada com binarios para Windows gerados automaticamente pelo CI.",
              "",
              "## Instaladores",
              "",
              "- **NSIS Installer (`.exe`)**: instalador padrao recomendado para a maioria dos usuarios.",
              "- **MSI Installer (`.msi`)**: opcao voltada para instalacao corporativa.",
              "",
              "## Changelog",
              "",
              "- **Changelog completo**: {{changelog_url}}"
            ) -join [Environment]::NewLine
          }

          $content = $content.Replace("{{version}}", $version)
          $content = $content.Replace("{{tag}}", $tag)
          $content = $content.Replace("{{changelog_url}}", $changelogUrl)

          Set-Content -Path $outputPath -Value $content -Encoding utf8
          Write-Output "path=$outputPath" >> $env:GITHUB_OUTPUT

      - name: Generate updater manifest
        id: updater_manifest
        shell: pwsh
        run: |
          $tag = "${{ steps.version.outputs.tag }}"
          $version = "${{ steps.version.outputs.version }}"
          $repo = "${{ github.repository }}"

          $nsisExe = Get-ChildItem "src-tauri/target/release/bundle/nsis/*.exe" | Select-Object -First 1
          $nsisSig = Get-ChildItem "src-tauri/target/release/bundle/nsis/*.exe.sig" | Select-Object -First 1

          if (-not $nsisExe) { throw "NSIS installer not found for updater manifest." }
          if (-not $nsisSig) { throw "NSIS signature not found for updater manifest." }

          $signature = (Get-Content $nsisSig.FullName -Raw).Trim()
          $notes = Get-Content "${{ steps.release_notes.outputs.path }}" -Raw
          $pubDate = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
          $downloadUrl = "https://github.com/$repo/releases/download/$tag/$($nsisExe.Name)"

          $manifest = @{
            version = $version
            notes = $notes
            pub_date = $pubDate
            platforms = @{
              "windows-x86_64" = @{
                signature = $signature
                url = $downloadUrl
              }
            }
          } | ConvertTo-Json -Depth 10

          $manifestPath = Join-Path $env:RUNNER_TEMP "latest.json"
          Set-Content -Path $manifestPath -Value $manifest -Encoding utf8
          Write-Output "path=$manifestPath" >> $env:GITHUB_OUTPUT

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: Gaming-Rumble-Windows
          path: |
            src-tauri/target/release/bundle/msi/*.msi
            src-tauri/target/release/bundle/nsis/*.exe
            src-tauri/target/release/bundle/msi/*.sig
            src-tauri/target/release/bundle/nsis/*.sig
            ${{ steps.updater_manifest.outputs.path }}
          if-no-files-found: ignore

      - name: Create tag
        if: steps.version.outputs.exists == 'false'
        shell: pwsh
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag ${{ steps.version.outputs.tag }}
          git push origin ${{ steps.version.outputs.tag }}

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.version.outputs.tag }}
          name: Gaming Rumble ${{ steps.version.outputs.tag }}
          body_path: ${{ steps.release_notes.outputs.path }}
          generate_release_notes: false
          files: |
            src-tauri/target/release/bundle/msi/*.msi
            src-tauri/target/release/bundle/nsis/*.exe
            src-tauri/target/release/bundle/msi/*.sig
            src-tauri/target/release/bundle/nsis/*.sig
            ${{ steps.updater_manifest.outputs.path }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}