name: Desktop Release

on:
  push:
    tags:
      - 'desktop/v*'

env:
  CARGO_TERM_COLOR: always

jobs:
  release:
    name: Desktop Release
    runs-on: macos-latest
    permissions:
      id-token: write
      contents: write
    env:
      RELEASE_VERSION: '' # set in the "Extract version from tag" step
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1

      - run: corepack enable pnpm

      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          workspaces: desktop/src-tauri
          key: desktop-release-aarch64-apple-darwin

      - name: Extract version from tag
        run: |
          RELEASE_VERSION="${GITHUB_REF#refs/tags/desktop/v}"
          echo "RELEASE_VERSION=${RELEASE_VERSION}" >> "$GITHUB_ENV"
          echo "Release version: ${RELEASE_VERSION}"

      - name: Set version from tag
        working-directory: desktop
        run: node scripts/set-version-from-tag.mjs "$RELEASE_VERSION"

      - name: Regenerate Cargo lockfile
        working-directory: desktop/src-tauri
        run: cargo generate-lockfile

      - name: Validate release secrets
        env:
          SPROUT_RELAY_URL: ${{ secrets.SPROUT_RELAY_URL }}
          SPROUT_UPDATER_PUBLIC_KEY: ${{ secrets.SPROUT_UPDATER_PUBLIC_KEY }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          OSX_CODESIGN_ROLE: ${{ secrets.OSX_CODESIGN_ROLE }}
          CODESIGN_S3_BUCKET: ${{ secrets.CODESIGN_S3_BUCKET }}
        run: |
          missing=()
          for name in \
            SPROUT_RELAY_URL \
            SPROUT_UPDATER_PUBLIC_KEY \
            TAURI_SIGNING_PRIVATE_KEY \
            TAURI_SIGNING_PRIVATE_KEY_PASSWORD \
            OSX_CODESIGN_ROLE \
            CODESIGN_S3_BUCKET; do
            if [ -z "${!name}" ]; then
              missing+=("$name")
            fi
          done
          if [ "${#missing[@]}" -gt 0 ]; then
            echo "::error::Missing required desktop release secrets: ${missing[*]}"
            exit 1
          fi

      - name: Install dependencies
        run: |
          cd desktop && pnpm install --frozen-lockfile
          cd src-tauri && cargo fetch

      - name: Build release config
        working-directory: desktop
        env:
          SPROUT_UPDATER_PUBLIC_KEY: ${{ secrets.SPROUT_UPDATER_PUBLIC_KEY }}
          SPROUT_UPDATER_ENDPOINT: https://github.com/${{ github.repository }}/releases/download/sprout-desktop-latest/latest.json
        run: pnpm run tauri:release:config

      - name: Build Tauri app
        working-directory: desktop
        env:
          SPROUT_RELAY_URL: ${{ secrets.SPROUT_RELAY_URL }}
        run: pnpm tauri build --config src-tauri/tauri.release.conf.json

      - name: Codesign and Notarize
        id: codesign
        uses: block/apple-codesign-action@679535d1ab7c5a7c18e6f9afcba3464512cc3dde # v1.1.0
        with:
          osx-codesign-role: ${{ secrets.OSX_CODESIGN_ROLE }}
          codesign-s3-bucket: ${{ secrets.CODESIGN_S3_BUCKET }}
          unsigned-artifact-path: desktop/src-tauri/target/release/bundle/macos/Sprout.app
          artifact-name: sprout-${{ github.sha }}-${{ github.run_id }}-arm64

      - name: Replace with signed app
        env:
          SIGNED_PATH: ${{ steps.codesign.outputs.signed-artifact-path }}
        run: |
          BUNDLE_DIR="desktop/src-tauri/target/release/bundle/macos"
          rm -rf "${BUNDLE_DIR}/Sprout.app"
          unzip -o "$SIGNED_PATH" -d "${BUNDLE_DIR}"

      - name: Create DMG from signed app
        run: |
          brew install create-dmg
          DMG_DIR="desktop/src-tauri/target/release/bundle/dmg"
          mkdir -p "${DMG_DIR}"
          rm -f "${DMG_DIR}"/*.dmg
          set +e
          create-dmg \
            --volname "Sprout" \
            --window-pos 200 120 \
            --window-size 600 400 \
            --icon-size 128 \
            --icon "Sprout.app" 150 200 \
            --app-drop-link 450 200 \
            --hide-extension "Sprout.app" \
            --no-internet-enable \
            "${DMG_DIR}/Sprout_${RELEASE_VERSION}_aarch64.dmg" \
            "desktop/src-tauri/target/release/bundle/macos/Sprout.app"
          EXIT_CODE=$?
          if [ $EXIT_CODE -ne 0 ] && [ $EXIT_CODE -ne 2 ]; then
            exit $EXIT_CODE
          fi

      - name: Create updater archive from signed app
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          BUNDLE_DIR="desktop/src-tauri/target/release/bundle/macos"
          rm -f "${BUNDLE_DIR}/Sprout.app.tar.gz" "${BUNDLE_DIR}/Sprout.app.tar.gz.sig"
          tar czf "${BUNDLE_DIR}/Sprout.app.tar.gz" -C "${BUNDLE_DIR}" Sprout.app
          cd desktop && pnpm tauri signer sign -k "$TAURI_SIGNING_PRIVATE_KEY" -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "src-tauri/target/release/bundle/macos/Sprout.app.tar.gz"

      - name: Create versioned release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "$GITHUB_REF_NAME" \
            --repo "$GITHUB_REPOSITORY" \
            --title "Sprout Desktop v${RELEASE_VERSION}" \
            --notes "See the assets to download and install this version."

      - name: Publish updater alias
        working-directory: desktop
        env:
          GH_TOKEN: ${{ github.token }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          VERSION: ${{ env.RELEASE_VERSION }}
        run: pnpm run release:updater:publish

      - name: Publish DMG alias
        working-directory: desktop
        env:
          GH_TOKEN: ${{ github.token }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          VERSION: ${{ env.RELEASE_VERSION }}
        run: pnpm run release:dmg:publish