release.yml

# 可选，将显示在 GitHub 存储库的“操作”选项卡中的工作流名称
name: Release CI

# 指定此工作流的触发器
on:
  push:
    # 匹配特定标签 (refs/tags)
    tags:
      - "v*" # 推送事件匹配 v*, 例如 v1.0，v20.15.10 等来触发工作流
  workflow_dispatch:

jobs:
  create-release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set output
        id: vars
        run: echo "tag=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT

      # 安装 Node.js
      - name: Setup node
        uses: actions/setup-node@v4
        with:
          node-version: 20

      # 发布 Release，使用自定义名称
      - name: Generate changelog
        id: create_release
        run: npx changelogithub --draft --name ${{ steps.vars.outputs.tag }}
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}

  # 编译 Tauri
  build-app:
    needs: create-release
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: "macos-latest"
            target: "aarch64-apple-darwin"
          - platform: "macos-latest"
            target: "x86_64-apple-darwin"

          - platform: "windows-latest"
            target: "x86_64-pc-windows-msvc"
          - platform: "windows-latest"
            target: "aarch64-pc-windows-msvc"

    runs-on: ${{ matrix.platform }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Setup node
        uses: actions/setup-node@v4
        with:
          node-version: 20
      - uses: pnpm/action-setup@v3
        with:
          version: latest

      # pnpm store 缓存 - 避免每次重新下载包
      - name: Get pnpm store directory
        id: pnpm-cache
        shell: bash
        run: echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT

      - name: Setup pnpm cache
        uses: actions/cache@v4
        with:
          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      # 安装 Rust（带 target）
      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      # Rust 缓存 - 关键修复：指向 src-tauri/target
      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: "src-tauri -> target"
          cache-on-failure: true

      # 安装依赖, 前端打包
      - name: Install app dependencies and build web
        run: pnpm install --frozen-lockfile
        env:
          VITE_AI_DOMAIN: ${{ secrets.VITE_AI_DOMAIN }}
          VITE_AI_MODEL: ${{ secrets.VITE_AI_MODEL }}
          VITE_PLATFORM_NAME: ${{ secrets.VITE_PLATFORM_NAME }}
          ECO_FEATURE_AI_CHAT: ${{ secrets.ECO_FEATURE_AI_CHAT }}

      # 执行构建，以及推送 github release
      - name: Build the app
        uses: tauri-apps/tauri-action@v0
        env:
          CI: false
          PLATFORM: ${{ matrix.platform }}
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
          VITE_AI_DOMAIN: ${{ secrets.VITE_AI_DOMAIN }}
          VITE_AI_MODEL: ${{ secrets.VITE_AI_MODEL }}
          VITE_PLATFORM_NAME: ${{ secrets.VITE_PLATFORM_NAME }}
          ECO_FEATURE_AI_CHAT: ${{ secrets.ECO_FEATURE_AI_CHAT }}
        with:
          tagName: ${{ github.ref_name }}
          releaseName: WeCut ${{ needs.create-release.outputs.APP_VERSION }}
          releaseBody: ""
          releaseDraft: true
          prerelease: false
          args: --target ${{ matrix.target }}

      # macOS: 对构建产物重新进行 adhoc 深度签名，修复 Gatekeeper "文件已损坏" 问题
      # 并将重签名后的 DMG 重新上传到 GitHub Release，替换 tauri-action 上传的旧版本
      - name: Re-sign and repackage DMG (macOS only)
        if: matrix.platform == 'macos-latest'
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail

          # 找到 tauri 输出目录中的 DMG 文件（路径在项目根目录的 target/ 下）
          DMG_DIR="target/${{ matrix.target }}/release/bundle/dmg"
          if [ ! -d "$DMG_DIR" ]; then
            echo "DMG directory not found: $DMG_DIR, skipping re-sign step"
            exit 0
          fi

          DMG_PATH=$(find "$DMG_DIR" -name "*.dmg" 2>/dev/null | head -1)
          if [ -z "$DMG_PATH" ]; then
            echo "No DMG found in $DMG_DIR, skipping re-sign step"
            exit 0
          fi

          echo "Found DMG: $DMG_PATH"
          DMG_NAME=$(basename "$DMG_PATH")
          WORK_DIR=$(mktemp -d)

          # 挂载原始 DMG
          MOUNT_POINT="$WORK_DIR/mount"
          mkdir -p "$MOUNT_POINT"
          hdiutil attach "$DMG_PATH" -mountpoint "$MOUNT_POINT" -nobrowse -quiet

          # 找到 .app
          APP_PATH=$(find "$MOUNT_POINT" -name "*.app" -maxdepth 1 | head -1)
          echo "Found app: $APP_PATH"

          # 复制 .app 到临时目录
          APP_COPY="$WORK_DIR/$(basename "$APP_PATH")"
          cp -R "$APP_PATH" "$APP_COPY"

          # 卸载原始 DMG
          hdiutil detach "$MOUNT_POINT" -quiet

          # 移除隔离属性和旧签名，进行深度 adhoc 重签名
          xattr -cr "$APP_COPY"
          codesign --deep --force --sign - "$APP_COPY"

          echo "Re-signed app:"
          codesign -dv "$APP_COPY" 2>&1 || true

          # 重新打包为 DMG
          NEW_DMG="$WORK_DIR/$DMG_NAME"
          hdiutil create -volname "WeCut" -srcfolder "$APP_COPY" \
            -ov -format UDZO "$NEW_DMG"

          echo "New DMG created: $NEW_DMG"

          # 删除 Release 中旧的同名 DMG 资产，再上传新的
          TAG="${{ github.ref_name }}"
          ASSET_ID=$(gh release view "$TAG" --repo ${{ github.repository }} --json assets \
            --jq ".assets[] | select(.name == \"$DMG_NAME\") | .id" 2>/dev/null || echo "")

          if [ -n "$ASSET_ID" ]; then
            echo "Deleting old release asset: $ASSET_ID"
            gh release delete-asset "$TAG" "$DMG_NAME" --repo ${{ github.repository }} --yes 2>/dev/null || true
          fi

          echo "Uploading re-signed DMG to release: $TAG"
          gh release upload "$TAG" "$NEW_DMG#$DMG_NAME" \
            --repo ${{ github.repository }} --clobber

          echo "Done: $DMG_NAME uploaded successfully"

          # 清理
          rm -rf "$WORK_DIR"