name: Release Desktop

on:
  push:
    tags: ['v*.*.*']
  workflow_dispatch:
    inputs:
      draft:
        description: 'Create as draft release'
        required: false
        default: true
        type: boolean

permissions:
  contents: write

concurrency:
  group: release-desktop-${{ github.ref }}
  cancel-in-progress: true

env:
  TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
  TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          # macOS Apple Silicon
          - platform: macos-latest
            rust_target: aarch64-apple-darwin
            tauri_args: '--target aarch64-apple-darwin'
            label: macOS-ARM64

          # macOS Intel
          - platform: macos-latest
            rust_target: x86_64-apple-darwin
            tauri_args: '--target x86_64-apple-darwin'
            label: macOS-x64

          # Linux x64
          - platform: ubuntu-22.04
            rust_target: x86_64-unknown-linux-gnu
            tauri_args: ''
            label: Linux-x64

          # Linux ARM64
          - platform: ubuntu-22.04-arm
            rust_target: aarch64-unknown-linux-gnu
            tauri_args: ''
            label: Linux-ARM64

          # Windows x64
          - platform: windows-latest
            rust_target: x86_64-pc-windows-msvc
            tauri_args: ''
            label: Windows-x64

    runs-on: ${{ matrix.platform }}
    name: Build (${{ matrix.label }})

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # ── System dependencies (Linux) ──────────────────────────
      - name: Install Linux dependencies
        if: contains(matrix.platform, 'ubuntu')
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            build-essential \
            curl \
            wget \
            file \
            libxdo-dev \
            libssl-dev \
            libwebkit2gtk-4.1-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            patchelf

      # ── Bun ──────────────────────────────────────────────────
      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      # ── Node.js (for tauri-action compatibility) ─────────────
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      # ── Rust ─────────────────────────────────────────────────
      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.rust_target }}

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: 'desktop/src-tauri -> target'
          shared-key: ${{ matrix.rust_target }}

      # ── Install dependencies ─────────────────────────────────
      - name: Install root dependencies
        run: bun install

      - name: Install desktop dependencies
        working-directory: desktop
        run: bun install

      # ── Build sidecars ───────────────────────────────────────
      - name: Build sidecars
        working-directory: desktop
        env:
          TAURI_ENV_TARGET_TRIPLE: ${{ matrix.rust_target }}
        run: bun run build:sidecars

      # ── macOS code signing (optional) ────────────────────────
      - name: Import macOS signing certificate
        if: contains(matrix.platform, 'macos') && env.APPLE_CERTIFICATE != ''
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12
          security create-keychain -p actions build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p actions build.keychain
          security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k actions build.keychain
          rm certificate.p12

      # ── Build Tauri app ──────────────────────────────────────
      - name: Build Tauri app
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # macOS signing (leave empty to skip)
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
        with:
          projectPath: desktop
          tauriScript: bunx tauri
          tagName: v__VERSION__
          releaseName: 'Claude Code Haha v__VERSION__'
          releaseBody: |
            ## Claude Code Haha v__VERSION__

            ### Downloads

            | Platform | File |
            |----------|------|
            | macOS (Apple Silicon) | `.dmg` |
            | macOS (Intel) | `.dmg` |
            | Windows | `.exe` (NSIS installer) |
            | Linux | `.deb` / `.AppImage` |

            ### First-time installation

            **macOS**: If you see "app is damaged" or "unidentified developer", run:
            ```bash
            xattr -cr /Applications/Claude\ Code\ Haha.app
            ```

            **Windows**: If SmartScreen blocks the app, click "More info" → "Run anyway".

            ---
            See [Installation Guide](https://github.com/NanmiCoder/cc-haha/blob/main/docs/desktop/04-installation.md) for details.
          releaseDraft: ${{ github.event_name == 'workflow_dispatch' && inputs.draft || false }}
          prerelease: false
          args: ${{ matrix.tauri_args }}

      # ── Cleanup macOS keychain ───────────────────────────────
      - name: Cleanup macOS keychain
        if: contains(matrix.platform, 'macos') && always()
        run: security delete-keychain build.keychain 2>/dev/null || true