ci.yml

name: CI
on:
  push:
  workflow_dispatch:

concurrency:
  group: '${{ github.workflow }} @ ${{ github.head_ref || github.ref }}'

permissions:
  contents: read

env:
  # Point electron's and electron-builder's download caches at predictable,
  # workspace-relative paths so actions/cache can hit them consistently
  # across runner OSes. Without this we'd be chasing platform-default cache
  # locations (~/Library/Caches on macOS, %LOCALAPPDATA% on Windows) with
  # per-OS path expressions.
  ELECTRON_CACHE: ${{ github.workspace }}/.cache/electron
  ELECTRON_BUILDER_CACHE: ${{ github.workspace }}/.cache/electron-builder

jobs:
  ci:
    strategy:
      # Don't cancel sibling matrix cells when one fails; let each one
      # finish so we get artifacts and full failure signal from every OS.
      fail-fast: false
      matrix:
        os:
          - macos-latest
          - windows-latest
    runs-on: ${{ matrix.os }}
    defaults:
      run:
        shell: bash
    env:
      # Organization-specific identifiers. The electron-builder wrapper reads these and injects them
      # as CLI overrides (--c.appx.*, --c.msi.upgradeCode); electron-builder.yaml's ${env.X}
      # interpolation only works for filename fields, not these config fields. Kept in repo Variables
      # so a fork supplies its own values — if one is unset the wrapper omits that override and
      # electron-builder uses its default, so a fork never builds under our published identity.
      APPX_IDENTITY_NAME: ${{ vars.APPX_IDENTITY_NAME }}
      APPX_PUBLISHER: ${{ vars.APPX_PUBLISHER }}
      APPX_PUBLISHER_DISPLAY_NAME: ${{ vars.APPX_PUBLISHER_DISPLAY_NAME }}
      MSI_UPGRADE_CODE: ${{ vars.MSI_UPGRADE_CODE }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          cache: 'npm'
          node-version-file: '.nvmrc'
      - name: Cache electron prebuilt binary
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: .cache/electron
          key: ${{ runner.os }}-electron-${{ hashFiles('package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-electron-
      - name: Cache electron-builder tools
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: .cache/electron-builder
          key: ${{ runner.os }}-electron-builder-${{ hashFiles('package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-electron-builder-
      - name: Debug info
        run: |
          cat <<EOF
          Node version: $(node --version)
          NPM version: $(npm --version)
          GitHub ref: ${{ github.ref }}
          GitHub head ref: ${{ github.head_ref }}
          Working directory: $(pwd)
          EOF
      - name: Install NPM dependencies
        run: npm ci
      - name: Cache media library assets
        # Keyed on the installed scratch-gui's package.json (after npm ci has
        # placed it under node_modules), not on the project's package-lock.json.
        # The asset set is determined entirely by the scratch-gui version;
        # unrelated dep bumps shouldn't bust this cache.
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: static/fetched
          key: media-${{ hashFiles('node_modules/@scratch/scratch-gui/package.json') }}
          restore-keys: |
            media-
      - name: Test
        run: npm run test
      # Each platform builds one representative installer on PR-time CI so non-developer
      # teammates can grab and try the latest from any PR. The full multi-arch matrix
      # only runs on release-candidate dispatch where the artifacts actually ship.
      - name: Build macOS DMG
        if: matrix.os == 'macos-latest'
        timeout-minutes: 30
        env:
          # TODO: fix whatever is causing excessive memory usage during build
          NODE_OPTIONS: --max-old-space-size=4096
        run: npm run distDev -- --target=dmg
      - name: Build Windows NSIS x64
        if: matrix.os == 'windows-latest'
        timeout-minutes: 30
        env:
          NODE_OPTIONS: --max-old-space-size=4096
        run: npm run distDev -- --target=nsis-x64
      - name: Upload macOS artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: matrix.os == 'macos-latest'
        with:
          name: macOS-unsigned
          path: dist/Scratch*.dmg
          compression-level: 0
      - name: Upload Windows NSIS x64
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: matrix.os == 'windows-latest'
        with:
          name: Windows-NSIS-x64
          path: "dist/Scratch *x64 Setup.exe"
          compression-level: 0