release.yml

# Release workflow - builds and publishes when a version tag is pushed
# Usage: git tag v0.1.0 && git push --tags
#
# This workflow builds for all platforms, signs Windows artifacts via SignPath
# (production certificate from SignPath Foundation), and creates a GitHub release.
#
# Required secrets:
#   SIGNPATH_API_TOKEN        - API token from SignPath.io (submitter permissions)
#   SIGNPATH_ORGANIZATION_ID  - Organization ID from SignPath.io dashboard

name: Release

on:
  push:
    tags:
      - 'v*'

env:
  CARGO_TERM_COLOR: always

jobs:
  build-windows:
    name: Build Windows
    runs-on: windows-latest
    outputs:
      artifact-id: ${{ steps.upload-unsigned-windows.outputs.artifact-id }}
    
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust (MSRV from rust-toolchain.toml)
        uses: dtolnay/rust-toolchain@1.92.0

      - name: Build release
        run: cargo build --release

      - name: Create portable release archive
        shell: pwsh
        run: |
          mkdir release
          copy target\release\ferrite.exe release\
          mkdir release\portable
          # Add a readme inside portable folder so it gets included in the zip
          # (zip files don't include empty directories)
          $portableReadme = @(
            "This folder stores your Ferrite settings and session data."
            ""
            "You can safely delete this file - it's just here to ensure"
            "the portable folder is included in the zip archive."
          ) -join "`r`n"
          Set-Content -Path release\portable\README.txt -Value $portableReadme -NoNewline
          $readme = @(
            "Ferrite - Portable Edition"
            "==========================="
            ""
            "This is the portable version of Ferrite. All your settings,"
            "sessions, and data will be stored in the 'portable' folder"
            "next to ferrite.exe."
            ""
            "To use:"
            "1. Extract this folder anywhere (USB drive, local folder, etc.)"
            "2. Run ferrite.exe"
            "3. Your configuration will be saved in the 'portable' subfolder"
            ""
            "This version does not modify your system - perfect for USB drives"
            "or trying Ferrite without installation."
            ""
            "For a traditional Windows installation, use the .msi installer instead."
            ""
            "Website: https://getferrite.dev"
          ) -join "`r`n"
          Set-Content -Path release\README.txt -Value $readme -NoNewline
          Compress-Archive -Path release\* -DestinationPath ferrite-portable-windows-x64.zip

      - name: Install cargo-wix
        run: cargo install cargo-wix

      - name: Build MSI installer
        run: cargo wix --nocapture

      - name: Copy MSI to workspace root
        run: copy target\wix\*.msi .\ferrite-windows-x64.msi

      - name: Build PortableApps.com installer
        shell: pwsh
        run: |
          # Extract version from tag (strip leading 'v')
          $version = "${{ github.ref_name }}".TrimStart('v')
          Write-Output "Building PAF installer for version $version"

          # Generate PAF icons from the existing 256px source icon
          pip install --quiet Pillow
          python -c @"
          from PIL import Image
          src = 'assets/icons/icon_256.png'
          dst = 'portable/FerriteMDPortable/App/AppInfo'
          img = Image.open(src).convert('RGBA')
          for size, name in [(16,'appicon_16.png'),(32,'appicon_32.png'),(128,'appicon_128.png')]:
              img.resize((size,size), Image.Resampling.LANCZOS).save(f'{dst}/{name}','PNG')
          sizes = [(16,16),(32,32),(48,48),(256,256)]
          imgs = [img.resize(s, Image.Resampling.LANCZOS) for s in sizes]
          imgs[0].save(f'{dst}/appicon.ico', format='ICO', sizes=sizes, append_images=imgs[1:])
          "@

          # Update appinfo.ini version fields to match the release tag
          $appinfo = Get-Content portable/FerriteMDPortable/App/AppInfo/appinfo.ini -Raw
          $appinfo = $appinfo -replace 'PackageVersion=.*', "PackageVersion=$version.0"
          $appinfo = $appinfo -replace 'DisplayVersion=.*', "DisplayVersion=$version"
          Set-Content -Path portable/FerriteMDPortable/App/AppInfo/appinfo.ini -Value $appinfo -NoNewline

          # Copy the release binary into the PAF structure
          New-Item -ItemType Directory -Force -Path portable\FerriteMDPortable\App\Ferrite | Out-Null
          Copy-Item target\release\ferrite.exe portable\FerriteMDPortable\App\Ferrite\ferrite.exe

          # Compile the .paf.exe installer with NSIS
          choco install nsis -y --no-progress
          $nsisExe = "C:\Program Files (x86)\NSIS\makensis.exe"
          & $nsisExe /DAPPVERSION=$version portable\installer.nsi
          Copy-Item "portable\FerriteMDPortable_${version}_English.paf.exe" .\ferrite-portableapps.paf.exe

      # Upload Windows artifacts together for SignPath signing
      - name: Upload unsigned Windows artifacts for signing
        id: upload-unsigned-windows
        uses: actions/upload-artifact@v4
        with:
          name: unsigned-windows-artifacts
          path: |
            ferrite-portable-windows-x64.zip
            ferrite-windows-x64.msi
            ferrite-portableapps.paf.exe

  # Sign Windows artifacts with SignPath (OSS code signing)
  sign-windows:
    name: Sign Windows Artifacts
    needs: [build-windows]
    runs-on: ubuntu-latest
    permissions:
      id-token: write   # Required for SignPath trusted build verification (OIDC)
      actions: read      # Required for SignPath to read job details
      contents: read     # Required for SignPath to download artifacts
    
    steps:
      - name: Submit to SignPath
        id: signpath
        uses: signpath/github-action-submit-signing-request@v2
        with:
          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
          organization-id: '${{ secrets.SIGNPATH_ORGANIZATION_ID }}'
          project-slug: 'Ferrite'
          signing-policy-slug: 'release-signing'
          github-artifact-id: '${{ needs.build-windows.outputs.artifact-id }}'
          wait-for-completion: true
          output-artifact-directory: 'signed'

      - name: List signed artifacts
        run: ls -la signed/

      - name: Upload signed portable zip
        uses: actions/upload-artifact@v4
        with:
          name: ferrite-portable-windows-x64
          path: signed/ferrite-portable-windows-x64.zip

      - name: Upload signed MSI
        uses: actions/upload-artifact@v4
        with:
          name: ferrite-windows-msi
          path: signed/ferrite-windows-x64.msi

      - name: Upload signed PortableApps installer
        uses: actions/upload-artifact@v4
        with:
          name: ferrite-portableapps
          path: signed/ferrite-portableapps.paf.exe

  build-linux:
    name: Build Linux
    runs-on: ubuntu-22.04  # Use 22.04 for wider glibc compatibility
    
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev libxcb-shape0-dev libxcb-xfixes0-dev libfontconfig1-dev

      - name: Install Rust (MSRV from rust-toolchain.toml)
        uses: dtolnay/rust-toolchain@1.92.0

      - name: Install cargo-deb and cargo-generate-rpm
        run: |
          cargo install cargo-deb
          cargo install cargo-generate-rpm

      - name: Build release
        run: cargo build --release

      - name: Create release archive
        run: |
          mkdir release
          cp target/release/ferrite release/
          tar -czvf ferrite-linux-x64.tar.gz -C release .

      - name: Build .deb package (Debian/Ubuntu)
        run: cargo deb --no-build

      - name: Build .rpm package (Fedora/RHEL)
        run: cargo generate-rpm

      - name: Copy packages to workspace root
        run: |
          cp target/debian/*.deb ./ferrite-editor_amd64.deb
          cp target/generate-rpm/*.rpm ./ferrite-editor.x86_64.rpm

      - name: Upload tar.gz artifact
        uses: actions/upload-artifact@v4
        with:
          name: ferrite-linux-x64
          path: ferrite-linux-x64.tar.gz

      - name: Upload .deb artifact
        uses: actions/upload-artifact@v4
        with:
          name: ferrite-linux-deb
          path: ferrite-editor_amd64.deb

      - name: Upload .rpm artifact
        uses: actions/upload-artifact@v4
        with:
          name: ferrite-linux-rpm
          path: ferrite-editor.x86_64.rpm

  build-macos-arm64:
    name: Build macOS (Apple Silicon)
    runs-on: macos-latest  # macos-latest is ARM64 (Apple Silicon)
    
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust (MSRV from rust-toolchain.toml)
        uses: dtolnay/rust-toolchain@1.92.0

      - name: Install cargo-bundle
        run: cargo install cargo-bundle

      - name: Generate macOS .icns icon
        run: |
          if [ -d "assets/icons/macos/app.iconset" ]; then
            iconutil -c icns assets/icons/macos/app.iconset -o assets/icons/macos/Ferrite.icns
            echo "Generated Ferrite.icns"
          else
            echo "Warning: app.iconset not found, skipping .icns generation"
          fi

      - name: Build release bundle
        run: cargo bundle --release

      - name: Create release archive
        run: |
          mkdir release
          cp -R target/release/bundle/osx/Ferrite.app release/
          tar -czvf ferrite-macos-arm64.tar.gz -C release .

      - name: Create DMG installer
        run: |
          mkdir -p dmg-staging
          cp -R target/release/bundle/osx/Ferrite.app dmg-staging/
          ln -s /Applications dmg-staging/Applications
          hdiutil create -volname "Ferrite" -srcfolder dmg-staging -ov -format UDZO "ferrite-macos-arm64.dmg"

      - name: Upload tar.gz artifact
        uses: actions/upload-artifact@v4
        with:
          name: ferrite-macos-arm64
          path: ferrite-macos-arm64.tar.gz

      - name: Upload DMG artifact
        uses: actions/upload-artifact@v4
        with:
          name: ferrite-macos-arm64-dmg
          path: ferrite-macos-arm64.dmg

  build-macos-intel:
    name: Build macOS (Intel)
    runs-on: macos-14  # Cross-compile to x86_64 from ARM64 runner
    
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust with Intel target (MSRV from rust-toolchain.toml)
        uses: dtolnay/rust-toolchain@1.92.0
        with:
          targets: x86_64-apple-darwin

      - name: Install cargo-bundle
        run: cargo install cargo-bundle

      - name: Build release bundle for Intel
        run: cargo bundle --release --target x86_64-apple-darwin

      - name: Create release archive
        run: |
          mkdir release
          cp -R target/x86_64-apple-darwin/release/bundle/osx/Ferrite.app release/
          tar -czvf ferrite-macos-x64.tar.gz -C release .

      - name: Create DMG installer
        run: |
          mkdir -p dmg-staging
          cp -R target/x86_64-apple-darwin/release/bundle/osx/Ferrite.app dmg-staging/
          ln -s /Applications dmg-staging/Applications
          hdiutil create -volname "Ferrite" -srcfolder dmg-staging -ov -format UDZO "ferrite-macos-x64.dmg"

      - name: Upload tar.gz artifact
        uses: actions/upload-artifact@v4
        with:
          name: ferrite-macos-x64
          path: ferrite-macos-x64.tar.gz

      - name: Upload DMG artifact
        uses: actions/upload-artifact@v4
        with:
          name: ferrite-macos-x64-dmg
          path: ferrite-macos-x64.dmg

  # NOTE: musl static build disabled - GUI apps with font rendering (freetype, fontconfig)
  # and graphics (X11/Wayland) dependencies cannot be easily built as static musl binaries.
  # The glibc build (Ubuntu 22.04) provides good compatibility across Linux distributions.

  # Create GitHub Release with all artifacts
  # Maintainer note: GitHub macOS builds are unsigned — paste the Gatekeeper
  # block from docs/github-release-checklist.md into the release description (#130).
  release:
    name: Create Release
    needs: [sign-windows, build-linux, build-macos-arm64, build-macos-intel]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    
    steps:
      - name: Download signed Windows portable zip
        uses: actions/download-artifact@v4
        with:
          name: ferrite-portable-windows-x64

      - name: Download signed Windows MSI
        uses: actions/download-artifact@v4
        with:
          name: ferrite-windows-msi

      - name: Download Linux artifact
        uses: actions/download-artifact@v4
        with:
          name: ferrite-linux-x64

      - name: Download Linux .deb artifact
        uses: actions/download-artifact@v4
        with:
          name: ferrite-linux-deb

      - name: Download Linux .rpm artifact
        uses: actions/download-artifact@v4
        with:
          name: ferrite-linux-rpm

      - name: Download macOS ARM64 artifact
        uses: actions/download-artifact@v4
        with:
          name: ferrite-macos-arm64

      - name: Download macOS ARM64 DMG
        uses: actions/download-artifact@v4
        with:
          name: ferrite-macos-arm64-dmg

      - name: Download macOS Intel artifact
        uses: actions/download-artifact@v4
        with:
          name: ferrite-macos-x64

      - name: Download macOS Intel DMG
        uses: actions/download-artifact@v4
        with:
          name: ferrite-macos-x64-dmg

      - name: Download signed PortableApps installer
        uses: actions/download-artifact@v4
        with:
          name: ferrite-portableapps

      - name: Rename PortableApps installer with version
        run: |
          VERSION="${{ github.ref_name }}"
          VERSION="${VERSION#v}"
          mv ferrite-portableapps.paf.exe "FerriteMDPortable_${VERSION}_English.paf.exe"

      - name: Create Release
        uses: softprops/action-gh-release@v1
        with:
          name: Ferrite ${{ github.ref_name }}
          draft: false
          prerelease: ${{ contains(github.ref_name, '-') }}
          generate_release_notes: true
          files: |
            ferrite-portable-windows-x64.zip
            ferrite-windows-x64.msi
            ferrite-linux-x64.tar.gz
            ferrite-editor_amd64.deb
            ferrite-editor.x86_64.rpm
            ferrite-macos-arm64.dmg
            ferrite-macos-arm64.tar.gz
            ferrite-macos-x64.dmg
            ferrite-macos-x64.tar.gz
            FerriteMDPortable_*_English.paf.exe