release.yml

name: Build & Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: macos-latest
            target: aarch64-apple-darwin
            python-version: "3.12"
          - platform: windows-latest
            target: x86_64-pc-windows-msvc
            python-version: "3.12"

    runs-on: ${{ matrix.platform }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install Python dependencies
        run: |
          pip install --upgrade pip
          pip install -r requirements.txt
          pip install pyinstaller

      - name: Build Python sidecar
        shell: bash
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          echo "__version__ = \"${VERSION}\"" > src/_version.py
          pyinstaller --noconfirm pyinstaller.spec

      - name: Copy sidecar binary (Unix)
        if: runner.os != 'Windows'
        run: |
          mkdir -p src-tauri/binaries
          cp dist/doctorfill-server src-tauri/binaries/doctorfill-server-${{ matrix.target }}
          chmod +x src-tauri/binaries/doctorfill-server-${{ matrix.target }}

      - name: Copy sidecar binary (Windows)
        if: runner.os == 'Windows'
        run: |
          mkdir -p src-tauri/binaries
          cp dist/doctorfill-server.exe src-tauri/binaries/doctorfill-server-${{ matrix.target }}.exe

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: src-tauri -> target

      - name: Install npm dependencies
        run: npm install

      - name: Build Tauri app
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          args: --target ${{ matrix.target }}

      - name: Upload signature artifact (Windows)
        if: runner.os == 'Windows'
        uses: actions/upload-artifact@v4
        with:
          name: sig-windows-x86_64
          path: src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.sig
          if-no-files-found: warn

      - name: Upload installer artifact (Windows)
        if: runner.os == 'Windows'
        uses: actions/upload-artifact@v4
        with:
          name: installer-windows-x86_64
          path: src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*-setup.exe
          if-no-files-found: warn

      - name: Upload signature artifact (macOS)
        if: runner.os == 'macOS'
        uses: actions/upload-artifact@v4
        with:
          name: sig-darwin-aarch64
          path: src-tauri/target/aarch64-apple-darwin/release/bundle/macos/*.tar.gz.sig
          if-no-files-found: warn

      - name: Upload installer artifact (macOS)
        if: runner.os == 'macOS'
        uses: actions/upload-artifact@v4
        with:
          name: installer-darwin-aarch64
          path: src-tauri/target/aarch64-apple-darwin/release/bundle/macos/*.tar.gz
          if-no-files-found: warn

  create-release:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Create GitHub Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ github.ref_name }}
        run: |
          gh release create "$TAG" \
            --title "DoctorFill $TAG" \
            --notes "See the changelog for details." \
            --prerelease

          find artifacts -type f \( -name "*.exe" -o -name "*.tar.gz" -o -name "*.sig" \) -exec gh release upload "$TAG" {} \;

  update-gist:
    needs: create-release
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Build and push latest.json to Gist
        env:
          GIST_TOKEN: ${{ secrets.GIST_TOKEN }}
          TAG: ${{ github.ref_name }}
          REPO: ${{ github.repository }}
          GIST_ID: ${{ secrets.GIST_ID }}
        run: |
          VERSION="${TAG#v}"
          WIN_SIG=$(cat artifacts/sig-windows-x86_64/*.sig 2>/dev/null || echo "")
          MAC_SIG=$(cat artifacts/sig-darwin-aarch64/*.tar.gz.sig 2>/dev/null || echo "")
          WIN_FILE=$(ls artifacts/installer-windows-x86_64/*-setup.exe 2>/dev/null | head -1 | xargs basename 2>/dev/null || echo "")
          MAC_FILE=$(ls artifacts/installer-darwin-aarch64/*.tar.gz 2>/dev/null | head -1 | xargs basename 2>/dev/null || echo "")
          BASE_URL="https://github.com/${REPO}/releases/download/${TAG}"
          WIN_URL="${BASE_URL}/${WIN_FILE}"
          MAC_URL="${BASE_URL}/${MAC_FILE}"
          PUB_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
          jq -n \
            --arg version  "${VERSION}" \
            --arg notes    "See https://github.com/${REPO}/releases/tag/${TAG} for details." \
            --arg pub_date "${PUB_DATE}" \
            --arg win_url  "${WIN_URL}" \
            --arg win_sig  "${WIN_SIG}" \
            --arg mac_url  "${MAC_URL}" \
            --arg mac_sig  "${MAC_SIG}" \
            '{
              version: $version,
              notes: $notes,
              pub_date: $pub_date,
              platforms: {
                "windows-x86_64": {url: $win_url, signature: $win_sig},
                "darwin-aarch64":  {url: $mac_url, signature: $mac_sig},
                "darwin-x86_64":   {url: $mac_url, signature: $mac_sig}
              }
            }' > doctorfill-latest.json
          CONTENT=$(jq -Rs . < doctorfill-latest.json)
          curl -s -X PATCH -H "Authorization: token ${GIST_TOKEN}" -H "Content-Type: application/json" -d "{\"files\":{\"doctorfill-latest.json\":{\"content\":${CONTENT}}}}" "https://api.github.com/gists/${GIST_ID}"
          echo "Gist updated for version ${VERSION}"