ci-main.yml

name: CI

on:
  push:
    branches:
      - main
      - dev-*
    tags:
      - v*

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - { platform: macos-26, arch: arm64, os: macos }
          - { platform: macos-26-intel, arch: x64, os: macos }
          - { platform: ubuntu-24.04, arch: x64, os: linux }
          - { platform: ubuntu-24.04-arm, arch: arm64, os: linux }
          - { platform: ubuntu-22.04, arch: arm32, os: linux }
          - { platform: windows-2022, arch: x64, os: windows }
    runs-on: ${{ matrix.platform }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Setup MINGW64
        if: matrix.os == 'windows'
        uses: msys2/setup-msys2@v2
        with:
          msystem: mingw64
          install: >-
            mingw-w64-x86_64-gcc
      - name: Setup go compiler
        uses: actions/setup-go@v6
        with:
          go-version: '1.26'
      - name: Setup zig
        if: matrix.os == 'linux' && matrix.arch == 'arm32'
        uses: mlugg/setup-zig@v2
      - name: Install Neo Web
        run: go run mage.go InstallNeoWeb
      - name: Install Neo Launcher
        if: matrix.os != 'linux'
        run: go run mage.go InstallNeoLauncher
      - name: Test without Docker
        if: matrix.os == 'macos' || matrix.os == 'windows' || (matrix.os == 'linux' && matrix.arch == 'arm64')
        run: go run mage.go test
      - name: Test with Docker
        if: matrix.os == 'linux' && matrix.arch == 'x64'
        env:
          ENABLE_DOCKER_TESTS: 'true'
        run: go run mage.go test
      - name: Set up Docker Buildx
        if: matrix.os == 'linux' && matrix.arch != 'arm32'
        uses: docker/setup-buildx-action@v4
      - name: Build Docker Image
        if: matrix.os == 'linux' && matrix.arch != 'arm32'
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./scripts/Ubuntu18.04.Dockerfile
          tags: ubuntu18-build-env:latest
          load: true
          cache-from: type=gha,scope=ubuntu18-build-env-${{ matrix.arch }}
          cache-to: type=gha,mode=max,scope=ubuntu18-build-env-${{ matrix.arch }}
      - name: Run Container
        if: matrix.os == 'linux' && matrix.arch != 'arm32'
        run: docker run --rm -v ./tmp:/app/tmp -v ./packages:/app/packages ubuntu18-build-env
      - name: Build
        if: matrix.os != 'linux'
        run: go run mage.go machbase-neo
      - name: Build arm32
        if: matrix.arch == 'arm32'
        run: go run mage.go buildx machbase-neo linux arm packagex linux arm
      - name: Codecov
        if: matrix.os == 'linux' && matrix.arch == 'x64'
        uses: codecov/codecov-action@v5
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
      - name: Codesign and notarize macos app
        if: matrix.os == 'macos'
        uses: toitlang/action-macos-sign-notarize@v1.3.0
        with:
          certificate: ${{ secrets.CODESIGN_DARWIN_CERTIFICATE }}
          certificate-password: ${{ secrets.CODESIGN_DARWIN_PASS }}
          username: ${{ secrets.CODESIGN_DARWIN_APPLE_ID_USERNAME }}
          password: ${{ secrets.CODESIGN_DARWIN_APPLE_ID_PASS }}
          apple-team-id: ${{ secrets.CODESIGN_DARWIN_APPLE_TEAM_ID }}
          app-path: |-
            ./tmp/machbase-neo
      - name: Codesign windows app
        if: matrix.os == 'windows-no-sign'
        shell: pwsh
        env:
          CODESIGN_WIN_CERTIFICATE: ${{ secrets.CODESIGN_WIN_CERTIFICATE }}
          CODESIGN_WIN_PASS: ${{ secrets.CODESIGN_WIN_PASS }}
        run: |
          $pfxPath = Join-Path $env:RUNNER_TEMP 'codesign.pfx'
          try {
            $certificateBase64 = $env:CODESIGN_WIN_CERTIFICATE `
              -replace '-----BEGIN CERTIFICATE-----', '' `
              -replace '-----END CERTIFICATE-----', '' `
              -replace '\s', ''

            [System.IO.File]::WriteAllBytes(
              $pfxPath,
              [System.Convert]::FromBase64String($certificateBase64)
            )

            $signtool = Get-ChildItem 'C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe' |
              Sort-Object FullName -Descending |
              Select-Object -First 1 -ExpandProperty FullName

            if (-not $signtool) {
              throw 'signtool.exe not found'
            }

            & $signtool sign `
              /f $pfxPath `
              /p $env:CODESIGN_WIN_PASS `
              /tr http://timestamp.digicert.com `
              /td sha256 `
              /fd sha256 `
              './tmp/machbase-neo.exe'

            if ($LASTEXITCODE -ne 0) {
              throw "signtool.exe failed with exit code $LASTEXITCODE"
            }
          }
          finally {
            if (Test-Path $pfxPath) {
              Remove-Item $pfxPath -Force
            }
          }
      - name: Package
        if: matrix.os != 'linux'
        run: go run mage.go package
      - name: Upload Artifact
        if: startsWith(github.ref, 'refs/tags/v') != true
        uses: actions/upload-artifact@v6
        with:
          name: machbase-neo-snapshot-${{ matrix.os }}-${{ matrix.arch }}
          retention-days: 5
          path: packages/machbase-neo-v*.zip
      - name: Release files
        if: startsWith(github.ref, 'refs/tags/v')
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.GIT_PASS }}
          file: packages/machbase-neo-v*.zip
          repo_name: machbase/neo-server
          prerelease: true
          tag: ${{ github.ref }}
          overwrite: true
          file_glob: true