build.yml

name: Build and Release

on:
  push:
    branches:
      - prod
    tags:
      - 'v*'
  pull_request:
    branches:
      - prod

# Sets permissions of the GITHUB_TOKEN for GitHub Pages deployment
permissions:
  contents: write
  pages: write
  id-token: write
  packages: write

# Allow only one concurrent deployment
concurrency:
  group: "pages"
  cancel-in-progress: false

jobs:
  version:
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.version.outputs.tag }}
      semver: ${{ steps.version.outputs.semver }}
    steps:
    - name: Resolve release version
      id: version
      run: |
        if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
          TAG="${GITHUB_REF_NAME}"
        else
          TAG="v3.1.${{ github.run_number }}"
        fi
        SEMVER="${TAG#v}"
        echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
        echo "semver=${SEMVER}" >> "$GITHUB_OUTPUT"
        echo "Resolved version tag: ${TAG}"

  web-docker:
    needs: version
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Sync Cargo.toml version to release version
      run: |
        awk -v v='${{ needs.version.outputs.semver }}' '
          BEGIN { done=0 }
          !done && $0 ~ /^version = ".*"/ { print "version = \"" v "\""; done=1; next }
          { print }
        ' Cargo.toml > Cargo.toml.tmp
        mv Cargo.toml.tmp Cargo.toml
    - uses: dtolnay/rust-toolchain@stable
    - uses: Swatinem/rust-cache@v2
    - run: cargo install dioxus-cli --version 0.7.3 --locked
    - name: Build web app
      run: dx bundle --platform web --release
    - name: Prepare web assets
      run: |
        mkdir -p dist
        cp -r target/dx/rustysound/release/web/public/* dist/
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
    - name: Log in to GitHub Container Registry
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Extract metadata
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ghcr.io/${{ github.repository_owner }}/rustysound
        tags: |
          type=ref,event=branch
          type=ref,event=pr
          type=sha,prefix=sha-
          type=raw,value=latest
    - name: Build and push Docker image
      uses: docker/build-push-action@v5
      with:
        context: .
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}

  web-pages:
    needs: version
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
    - uses: actions/checkout@v4
    - name: Sync Cargo.toml version to release version
      run: |
        awk -v v='${{ needs.version.outputs.semver }}' '
          BEGIN { done=0 }
          !done && $0 ~ /^version = ".*"/ { print "version = \"" v "\""; done=1; next }
          { print }
        ' Cargo.toml > Cargo.toml.tmp
        mv Cargo.toml.tmp Cargo.toml
    - uses: dtolnay/rust-toolchain@stable
    - uses: Swatinem/rust-cache@v2
    - run: cargo install dioxus-cli --version 0.7.3 --locked
    - name: Build web app
      run: dx bundle --platform web --release
    - name: Prepare web assets for GitHub Pages
      run: |
        mkdir -p gh-pages
        cp -r target/dx/rustysound/release/web/public/* gh-pages/
        touch gh-pages/.nojekyll
    - name: Setup Pages
      uses: actions/configure-pages@v4
    - name: Upload artifact
      uses: actions/upload-pages-artifact@v3
      with:
        path: gh-pages/
    - name: Deploy to GitHub Pages
      id: deployment
      uses: actions/deploy-pages@v4

  apple-bundles:
    needs: version
    runs-on: macos-latest
    steps:
    - uses: actions/checkout@v4
    - name: Sync Cargo.toml version to release version
      run: |
        awk -v v='${{ needs.version.outputs.semver }}' '
          BEGIN { done=0 }
          !done && $0 ~ /^version = ".*"/ { print "version = \"" v "\""; done=1; next }
          { print }
        ' Cargo.toml > Cargo.toml.tmp
        mv Cargo.toml.tmp Cargo.toml
    - uses: dtolnay/rust-toolchain@stable
    - uses: Swatinem/rust-cache@v2
    - run: cargo install dioxus-cli --version 0.7.3 --locked
    - name: Build macOS + iOS bundles
      env:
        APP_VERSION: ${{ needs.version.outputs.semver }}
        CREATE_MACOS_DMG: "0"
      run: ./scripts/bundle-apple.sh
    - name: Verify Apple bundle versions
      env:
        EXPECTED_APP_VERSION: ${{ needs.version.outputs.semver }}
      run: |
        set -euo pipefail

        IPA_PATH="$(find dist/apple/ios -maxdepth 1 -type f -name '*-unsigned.ipa' | head -n 1)"
        APP_PATH="$(find dist/apple/macos -maxdepth 1 -type d -name '*.app' | head -n 1)"

        if [[ -z "${IPA_PATH}" ]]; then
          echo "Unsigned IPA not found under dist/apple/ios." >&2
          exit 1
        fi

        if [[ -z "${APP_PATH}" ]]; then
          echo "macOS app bundle not found under dist/apple/macos." >&2
          exit 1
        fi

        export IPA_PATH APP_PATH EXPECTED_APP_VERSION
        python3 - <<'PY'
        import os
        import plistlib
        import re
        import zipfile


        def normalize(version: str) -> str:
            normalized = re.split(r"[-+]", version, maxsplit=1)[0]
            if not re.fullmatch(r"\d+(?:\.\d+){0,2}", normalized):
                raise SystemExit(f"Unsupported Apple bundle version: {version}")
            parts = normalized.split(".")
            parts.extend(["0"] * (3 - len(parts)))
            return ".".join(parts[:3])


        expected = normalize(os.environ["EXPECTED_APP_VERSION"])
        ipa_path = os.environ["IPA_PATH"]
        app_path = os.environ["APP_PATH"]

        with zipfile.ZipFile(ipa_path) as zf:
            info_member = next(
                (name for name in zf.namelist() if re.match(r"^Payload/[^/]+\.app/Info\.plist$", name)),
                None,
            )
            if info_member is None:
                raise SystemExit("IPA Info.plist not found")
            ipa_info = plistlib.loads(zf.read(info_member))

        with open(os.path.join(app_path, "Contents", "Info.plist"), "rb") as fh:
            mac_info = plistlib.load(fh)

        for label, info in (("IPA", ipa_info), ("macOS", mac_info)):
            short = str(info.get("CFBundleShortVersionString", ""))
            build = str(info.get("CFBundleVersion", ""))
            print(f"{label}: CFBundleShortVersionString={short} CFBundleVersion={build}")
            if short != expected or build != expected:
                raise SystemExit(
                    f"{label} bundle version mismatch: expected {expected}, got short={short}, build={build}"
                )
        PY
    - name: Sign macOS app (ad-hoc or notarized)
      env:
        MACOS_CERT_P12_BASE64: ${{ secrets.MACOS_CERT_P12_BASE64 }}
        MACOS_CERT_PASSWORD: ${{ secrets.MACOS_CERT_PASSWORD }}
        MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
        APPLE_ID: ${{ secrets.APPLE_ID }}
        APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
        APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        KEYCHAIN_PASSWORD: ${{ github.run_id }}-${{ github.run_attempt }}
      run: |
        set -euo pipefail

        APP_PATH="$(find dist/apple/macos -maxdepth 1 -type d -name '*.app' | head -n 1)"
        APP_NAME="$(basename "$APP_PATH" .app)"
        DMG_PATH="dist/apple/macos/${APP_NAME}.dmg"
        CERT_PATH="$RUNNER_TEMP/macos-signing-cert.p12"
        KEYCHAIN_PATH="$RUNNER_TEMP/macos-signing.keychain-db"
        DO_NOTARIZE=0
        if [[ -n "${MACOS_CERT_P12_BASE64}" && -n "${MACOS_CERT_PASSWORD}" && -n "${MACOS_SIGNING_IDENTITY}" && -n "${APPLE_ID}" && -n "${APPLE_APP_SPECIFIC_PASSWORD}" && -n "${APPLE_TEAM_ID}" ]]; then
          DO_NOTARIZE=1
        fi

        if [[ "$DO_NOTARIZE" -eq 1 ]]; then
          echo "Signing and notarizing macOS app..."
          printf '%s' "$MACOS_CERT_P12_BASE64" | base64 --decode > "$CERT_PATH" 2>/dev/null || printf '%s' "$MACOS_CERT_P12_BASE64" | base64 -D > "$CERT_PATH"

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$CERT_PATH" -P "$MACOS_CERT_PASSWORD" -A -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security list-keychains -d user -s "$KEYCHAIN_PATH"

          codesign --force --deep --options runtime --timestamp --sign "$MACOS_SIGNING_IDENTITY" "$APP_PATH"
          codesign --verify --deep --strict "$APP_PATH"

          APP_ZIP="$RUNNER_TEMP/${APP_NAME}-notarize.zip"
          ditto -c -k --keepParent "$APP_PATH" "$APP_ZIP"
          xcrun notarytool submit "$APP_ZIP" \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait
          xcrun stapler staple "$APP_PATH"
        else
          echo "Notarization secrets are missing. Using ad-hoc signing."
          codesign --force --deep --sign - "$APP_PATH"
          codesign --verify --deep "$APP_PATH"
        fi

        DMG_STAGE_DIR="$(mktemp -d)"
        cp -R "$APP_PATH" "$DMG_STAGE_DIR/"
        cat > "$DMG_STAGE_DIR/INSTALL.txt" <<EOF
        RustySound macOS Install Instructions
        =====================================

        1. Drag ${APP_NAME}.app to Applications.
        2. Open ${APP_NAME}.app from Applications.
        3. If blocked by macOS, go to:
           System Settings > Privacy & Security > Open Anyway

        Terminal fallback:
        xattr -dr com.apple.quarantine /Applications/${APP_NAME}.app
        open /Applications/${APP_NAME}.app
        EOF

        rm -f dist/apple/macos/*.dmg
        for attempt in 1 2 3; do
          hdiutil detach "/Volumes/$APP_NAME" -force >/dev/null 2>&1 || true
          if hdiutil create -volname "$APP_NAME" -srcfolder "$DMG_STAGE_DIR" -ov -format UDZO "$DMG_PATH"; then
            break
          fi
          if [[ "$attempt" -eq 3 ]]; then
            echo "hdiutil create failed after 3 attempts."
            exit 1
          fi
          echo "hdiutil create failed (attempt $attempt/3); retrying..."
          sleep $((attempt * 2))
        done
        rm -rf "$DMG_STAGE_DIR"

        if [[ "$DO_NOTARIZE" -eq 1 ]]; then
          xcrun notarytool submit "$DMG_PATH" \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait
          xcrun stapler staple "$DMG_PATH"
        fi
    - name: Prepare Apple artifacts
      run: |
        mkdir -p artifacts
        APP_PATH="$(find dist/apple/macos -maxdepth 1 -type d -name '*.app' | head -n 1)"
        APP_NAME="$(basename "$APP_PATH" .app)"
        ditto -c -k --sequesterRsrc --keepParent "$APP_PATH" "artifacts/${APP_NAME}-macos.zip"
        cp dist/apple/macos/*.dmg artifacts/
        cp dist/apple/ios/*-unsigned.ipa artifacts/
        cat > artifacts/MACOS-UNSIGNED-INSTALL.txt <<'EOF'
        This build is not notarized by Apple.
        If macOS blocks it, use one of these options:

        1) Right-click the app in Finder and choose "Open", then confirm.
        2) Or remove quarantine from Terminal:

        xattr -dr com.apple.quarantine /Applications/Rustysound.app
        open /Applications/Rustysound.app

        For public distribution, configure signing + notarization secrets in GitHub Actions.
        EOF
    - name: Upload Apple bundle artifacts
      uses: actions/upload-artifact@v4
      with:
        name: apple-bundles
        path: artifacts/*

  windows-bundles:
    needs: version
    runs-on: windows-latest
    steps:
    - uses: actions/checkout@v4
    - name: Sync Cargo.toml version to release version
      shell: bash
      run: |
        awk -v v='${{ needs.version.outputs.semver }}' '
          BEGIN { done=0 }
          !done && $0 ~ /^version = ".*"/ { print "version = \"" v "\""; done=1; next }
          { print }
        ' Cargo.toml > Cargo.toml.tmp
        mv Cargo.toml.tmp Cargo.toml
    - uses: dtolnay/rust-toolchain@stable
    - uses: Swatinem/rust-cache@v2
    - name: Install Dioxus CLI
      run: cargo install dioxus-cli --version 0.7.3 --locked
    - name: Install Windows bundler tooling
      run: choco install nsis -y
    - name: Build Windows NSIS bundle
      run: dx bundle --windows --release --package-types nsis --out-dir dist/windows
    - name: Upload Windows bundle artifacts
      uses: actions/upload-artifact@v4
      with:
        name: windows-bundles
        path: |
          dist/windows/*.exe

  android-apks:
    needs: version
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Sync Cargo.toml version to release version
      run: |
        awk -v v='${{ needs.version.outputs.semver }}' '
          BEGIN { done=0 }
          !done && $0 ~ /^version = ".*"/ { print "version = \"" v "\""; done=1; next }
          { print }
        ' Cargo.toml > Cargo.toml.tmp
        mv Cargo.toml.tmp Cargo.toml
    - uses: dtolnay/rust-toolchain@stable
    - name: Add Android Rust targets
      run: |
        rustup target add aarch64-linux-android
        rustup target add x86_64-linux-android
    - uses: actions/setup-java@v4
      with:
        distribution: temurin
        java-version: '17'
    - uses: android-actions/setup-android@v3
    - name: Install Android SDK components
      run: |
        yes | sdkmanager --licenses >/dev/null
        sdkmanager \
          "platform-tools" \
          "platforms;android-33" \
          "platforms;android-34" \
          "build-tools;33.0.2" \
          "build-tools;34.0.0" \
          "ndk;26.3.11579264" \
          "cmake;3.22.1"
    - uses: Swatinem/rust-cache@v2
    - name: Install Dioxus CLI
      run: cargo install dioxus-cli --version 0.7.3 --locked
    - name: Build Android release APKs (ARM64 + x86_64)
      run: |
        export ANDROID_AAPT2_FROM_MAVEN_OVERRIDE="$ANDROID_HOME/build-tools/34.0.0/aapt2"
        export GRADLE_OPTS="-Dorg.gradle.project.android.aapt2FromMavenOverride=$ANDROID_AAPT2_FROM_MAVEN_OVERRIDE ${GRADLE_OPTS:-}"
        OUT_DIR="dist/android/aarch64-linux-android" ./scripts/bundle-android.sh --target aarch64-linux-android
        OUT_DIR="dist/android/x86_64-linux-android" ./scripts/bundle-android.sh --target x86_64-linux-android
      env:
        ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
        ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
        ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
        ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
    - name: Collect Android release APKs
      run: |
        mkdir -p artifacts
        find dist/android -type f -name "*.apk" -print -exec cp {} artifacts/ \;
        if ! ls artifacts/*.apk >/dev/null 2>&1; then
          echo "No Android release APKs were collected." >&2
          exit 1
        fi
        ls -lah artifacts/
    - name: Upload Android APK artifacts
      uses: actions/upload-artifact@v4
      with:
        name: android-apks
        path: artifacts/*

  release:
    needs: [version, web-docker, web-pages, apple-bundles, windows-bundles, android-apks]
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/prod' && github.event_name == 'push'
    steps:
    - name: Download all artifacts
      uses: actions/download-artifact@v4
      with:
        path: artifacts/
    - name: List artifacts
      run: find artifacts -type f
    - name: Create Release
      uses: softprops/action-gh-release@v1
      with:
        tag_name: ${{ needs.version.outputs.tag }}
        name: Release ${{ needs.version.outputs.tag }}
        generate_release_notes: true
        draft: false
        prerelease: false
        files: |
          artifacts/**/*.dmg
          artifacts/**/*.ipa
          artifacts/**/*.exe
          artifacts/**/*.apk
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Dispatch package updates
      env:
        DISPATCH_TOKEN: ${{ secrets.CROSS_REPO_DISPATCH_TOKEN }}
        VERSION: ${{ needs.version.outputs.tag }}
        PACKAGES_REPO: ${{ vars.PACKAGES_REPO }}
        LINUX_PACKAGES_REPO: ${{ vars.LINUX_PACKAGES_REPO }}
      run: |
        set -euo pipefail

        if [[ -z "${DISPATCH_TOKEN}" ]]; then
          echo "CROSS_REPO_DISPATCH_TOKEN is not set, skipping package dispatch."
          exit 0
        fi

        PACKAGES_REPO="${PACKAGES_REPO:-${LINUX_PACKAGES_REPO:-AD-Archer/packages}}"
        PAYLOAD="{\"event_type\":\"rustysound-release\",\"client_payload\":{\"version\":\"${VERSION}\",\"source_repo\":\"${GITHUB_REPOSITORY}\",\"source_sha\":\"${GITHUB_SHA}\"}}"

        dispatch_repo() {
          local repo="$1"
          local name="$2"
          if [[ -z "${repo}" ]]; then
            echo "${name} repo not configured; skipping."
            return 0
          fi
          echo "Dispatching to ${name}: ${repo}"
          curl --fail-with-body -X POST \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: Bearer ${DISPATCH_TOKEN}" \
            "https://api.github.com/repos/${repo}/dispatches" \
            -d "${PAYLOAD}"
        }

        dispatch_repo "AD-Archer/homebrew-tap" "Homebrew tap"
        dispatch_repo "AD-Archer/scoop" "Scoop bucket"
        dispatch_repo "${PACKAGES_REPO}" "Packages"