release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ============================================
  # Desktop builds (Windows, macOS, Linux)
  # ============================================
  build-desktop:
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: macos-latest
            args: '--target aarch64-apple-darwin'
            arch: aarch64
            os: macos
          - platform: macos-latest
            args: '--target x86_64-apple-darwin'
            arch: x86_64
            os: macos
          - platform: ubuntu-22.04
            args: ''
            arch: x86_64
            os: linux
          - platform: windows-latest
            args: ''
            arch: x86_64
            os: windows

    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: lts/*
          cache: 'npm'

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: './src-tauri -> target'

      - name: Install Linux dependencies
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      - name: Install frontend dependencies
        run: npm ci

      # Build ONLY, do not release yet
      - name: Build desktop app
        uses: tauri-apps/tauri-action@v0
        with:
          # Build only; release is created in publish-release job
          # We purposefully OMIT releaseName, releaseBody, releaseDraft, prerelease
          # to prevent it from creating/updating a release.
          # However, tauri-action default behavior is to upload if tagName is present?
          # Let's try to bypass upload by NOT providing tagName?
          # If tagName is omitted, it defaults to checking package.json version?
          # Let's provide tagName but use a specialized args to NOT upload?
          # Actually, tauri-action documentation says it will upload if GITHUB_TOKEN is present.
          # So we REMOVE GITHUB_TOKEN and tagName to prevent release/upload.
          args: ${{ matrix.args }}
        
      # Manually find and upload artifacts
      - name: Prepare artifacts
        shell: bash
        run: |
          mkdir -p release-artifacts
          BUNDLE_DIR="src-tauri/target/release/bundle"
          if [[ "${{ matrix.os }}" == "macos" ]]; then
            BUNDLE_DIR="src-tauri/target/${{ matrix.arch }}-apple-darwin/release/bundle"
          fi
          
          # Find and copy build assets to a flat directory
          if [[ "${{ matrix.os }}" == "windows" ]]; then
            if [[ -d "$BUNDLE_DIR/nsis" ]]; then
              find "$BUNDLE_DIR/nsis" -name "*.exe" -exec cp {} release-artifacts/ \;
            fi
          elif [[ "${{ matrix.os }}" == "macos" ]]; then
            if [[ -d "$BUNDLE_DIR/dmg" ]]; then
              find "$BUNDLE_DIR/dmg" -name "*.dmg" -exec cp {} release-artifacts/ \;
            fi
          elif [[ "${{ matrix.os }}" == "linux" ]]; then
            if [[ -d "$BUNDLE_DIR/deb" ]]; then
              find "$BUNDLE_DIR/deb" -name "*.deb" -exec cp {} release-artifacts/ \;
            fi
            if [[ -d "$BUNDLE_DIR/appimage" ]]; then
              find "$BUNDLE_DIR/appimage" -name "*.AppImage" -exec cp {} release-artifacts/ \;
            fi
          fi
          
          echo "Artifacts to upload:"
          ls -R release-artifacts

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: artifacts-desktop-${{ matrix.os }}-${{ matrix.arch }}
          path: release-artifacts
          if-no-files-found: warn
          retention-days: 1

  # ============================================
  # Android builds
  # ============================================
  build-android:
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: lts/*
          cache: 'npm'

      - name: Setup Java JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '17'

      - name: Setup Android SDK
        uses: android-actions/setup-android@v3

      - name: Install Android NDK
        run: sdkmanager "ndk;29.0.14206865"

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-linux-android,armv7-linux-androideabi

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: './src-tauri -> target'
          key: android

      - name: Gradle cache
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
            src-tauri/gen/android/.gradle
          key: gradle-${{ hashFiles('src-tauri/gen/android/**/*.gradle*', 'src-tauri/gen/android/**/gradle-wrapper.properties') }}
          restore-keys: gradle-

      - name: Install frontend dependencies
        run: npm ci

      - name: Setup Android signing
        run: |
          cd src-tauri/gen/android
          echo "keyAlias=${{ secrets.ANDROID_KEY_ALIAS }}" > keystore.properties
          echo "password=${{ secrets.ANDROID_KEY_PASSWORD }}" >> keystore.properties
          base64 -d <<< "${{ secrets.ANDROID_KEY_BASE64 }}" > $RUNNER_TEMP/keystore.jks
          echo "storeFile=$RUNNER_TEMP/keystore.jks" >> keystore.properties

      - name: Build and sign arm64 APK
        run: |
          VERSION=${{ github.ref_name }}
          BT="$ANDROID_HOME/build-tools/$(ls $ANDROID_HOME/build-tools/ | tail -1)"

          npx tauri android build --apk --target aarch64

          SIGNED_APK=$(find src-tauri/gen/android/app/build/outputs/apk -path '*/release/*-signed*' -name '*.apk' -type f 2>/dev/null | head -1)
          RELEASE_APK=$(find src-tauri/gen/android/app/build/outputs/apk -path '*/release/*.apk' -name '*.apk' -type f 2>/dev/null | head -1)
          APK_PATH="${SIGNED_APK:-$RELEASE_APK}"
          DEST="OpenCodeUI-${VERSION}-android-arm64.apk"
          
          if $BT/apksigner verify "$APK_PATH" 2>/dev/null; then
            cp "$APK_PATH" "$DEST"
          else
            $BT/zipalign -v 4 "$APK_PATH" "${APK_PATH}.aligned"
            $BT/apksigner sign \
              --ks $RUNNER_TEMP/keystore.jks \
              --ks-key-alias ${{ secrets.ANDROID_KEY_ALIAS }} \
              --ks-pass pass:${{ secrets.ANDROID_KEY_PASSWORD }} \
              --key-pass pass:${{ secrets.ANDROID_KEY_PASSWORD }} \
              --out "$DEST" "${APK_PATH}.aligned"
          fi
          
          mkdir -p release-artifacts
          mv "$DEST" release-artifacts/
          rm -rf src-tauri/gen/android/app/build/outputs/apk
        env:
          NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/29.0.14206865

      - name: Build and sign armv7 APK
        run: |
          VERSION=${{ github.ref_name }}
          BT="$ANDROID_HOME/build-tools/$(ls $ANDROID_HOME/build-tools/ | tail -1)"

          npx tauri android build --apk --target armv7

          SIGNED_APK=$(find src-tauri/gen/android/app/build/outputs/apk -path '*/release/*-signed*' -name '*.apk' -type f 2>/dev/null | head -1)
          RELEASE_APK=$(find src-tauri/gen/android/app/build/outputs/apk -path '*/release/*.apk' -name '*.apk' -type f 2>/dev/null | head -1)
          APK_PATH="${SIGNED_APK:-$RELEASE_APK}"
          DEST="OpenCodeUI-${VERSION}-android-armv7.apk"
          
          if $BT/apksigner verify "$APK_PATH" 2>/dev/null; then
            cp "$APK_PATH" "$DEST"
          else
            $BT/zipalign -v 4 "$APK_PATH" "${APK_PATH}.aligned"
            $BT/apksigner sign \
              --ks $RUNNER_TEMP/keystore.jks \
              --ks-key-alias ${{ secrets.ANDROID_KEY_ALIAS }} \
              --ks-pass pass:${{ secrets.ANDROID_KEY_PASSWORD }} \
              --key-pass pass:${{ secrets.ANDROID_KEY_PASSWORD }} \
              --out "$DEST" "${APK_PATH}.aligned"
          fi
          
          mv "$DEST" release-artifacts/
        env:
          NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/29.0.14206865

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: artifacts-android
          path: release-artifacts/*
          retention-days: 1

  # ============================================
  # Publish Release (Runs after builds)
  # ============================================
  publish-release:
    permissions:
      contents: write
    runs-on: ubuntu-latest
    needs: [build-desktop, build-android]
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: Display structure of downloaded files
        run: ls -R artifacts

      - name: Extract changelog for this version
        id: changelog
        run: |
          TAG="${{ github.ref_name }}"
          # Extract the section between "## [$TAG]" and the next "## [" (or EOF)
          BODY=$(sed -n "/^## \[${TAG}\]/,/^## \[/{ /^## \[${TAG}\]/d; /^## \[/d; p; }" CHANGELOG.md)
          # Trim leading/trailing blank lines
          BODY=$(echo "$BODY" | sed -e '/./,$!d' -e :a -e '/^\n*$/{$d;N;ba;}')
          if [ -z "$BODY" ]; then
            BODY="No changelog entry found for ${TAG}."
          fi
          # Write to file for multiline support
          echo "$BODY" > /tmp/release-body.md
          # Append download section
          printf '\n---\n\n**Desktop:** Windows (.exe), macOS (.dmg), Linux (.deb, .AppImage)\n**Mobile:** Android (.apk) — arm64, armeabi-v7a\n' >> /tmp/release-body.md

      - name: Create Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: 'OpenCodeUI ${{ github.ref_name }}'
          body_path: /tmp/release-body.md
          files: artifacts/*
          draft: false
          prerelease: ${{ contains(github.ref_name, 'canary') || contains(github.ref_name, 'alpha') || contains(github.ref_name, 'beta') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}