OwnCord/.github/workflows/release.yml

name: Release

on:
  push:
    tags:
      - "v*"

jobs:
  release-client:
    name: Build Tauri (Windows)
    runs-on: windows-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: Client/tauri-client/package-lock.json

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: Client/tauri-client/src-tauri

      - name: Install npm dependencies
        working-directory: Client/tauri-client
        run: npm ci

      - name: Build Tauri app
        working-directory: Client/tauri-client
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: npm run tauri build

      - name: Stage Windows release assets
        shell: bash
        run: |
          mkdir -p release-staging
          NSIS_DIR="Client/tauri-client/src-tauri/target/release/bundle/nsis"
          INSTALLER=$(find "$NSIS_DIR" -name "*.exe" | head -1)
          cp "$INSTALLER" release-staging/
          NSIS_ZIP=$(find "$NSIS_DIR" -name "*_x64-setup.nsis.zip" ! -name "*.sig" | head -1)
          if [ -n "$NSIS_ZIP" ] && [ -f "$NSIS_ZIP" ]; then cp "$NSIS_ZIP" release-staging/; fi
          NSIS_SIG=$(find "$NSIS_DIR" -name "*_x64-setup.nsis.zip.sig" | head -1)
          if [ -n "$NSIS_SIG" ] && [ -f "$NSIS_SIG" ]; then cp "$NSIS_SIG" release-staging/; fi

      - name: Upload Windows release assets
        uses: actions/upload-artifact@v4
        with:
          name: windows-release-assets
          path: release-staging/

  release-server:
    name: Build server (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            artifact: server-windows
          - os: ubuntu-latest
            artifact: server-linux
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: "1.25"

      - name: Extract version from tag
        shell: bash
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          echo "VERSION=$VERSION" >> "$GITHUB_ENV"

      - name: Build server (Windows)
        if: matrix.os == 'windows-latest'
        shell: bash
        run: cd Server && go build -o chatserver.exe -ldflags "-s -w -X main.version=$VERSION" .

      - name: Build server (Linux)
        if: matrix.os == 'ubuntu-latest'
        working-directory: Server
        env:
          CGO_ENABLED: "0"
        run: go build -o chatserver -ldflags "-s -w -X main.version=$VERSION" .

      - name: Create tar.gz (Linux)
        if: matrix.os == 'ubuntu-latest'
        working-directory: Server
        run: tar czf ../chatserver-linux-amd64.tar.gz chatserver

      - name: Upload Windows binary
        if: matrix.os == 'windows-latest'
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: Server/chatserver.exe

      - name: Upload Linux archive
        if: matrix.os == 'ubuntu-latest'
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: chatserver-linux-amd64.tar.gz

  publish:
    name: Publish GitHub Release
    needs: [release-client, release-server]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: Client/tauri-client/package-lock.json

      - name: Download Windows client assets
        uses: actions/download-artifact@v4
        with:
          name: windows-release-assets
          path: windows

      - name: Download Windows server binary
        uses: actions/download-artifact@v4
        with:
          name: server-windows
          path: windows

      - name: Download Linux archive
        uses: actions/download-artifact@v4
        with:
          name: server-linux
          path: linux

      - name: Extract version from tag
        shell: bash
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          echo "VERSION=$VERSION" >> "$GITHUB_ENV"

      - name: Generate SHA256 checksums
        run: |
          find windows linux -type f -exec sha256sum {} \; > checksums.sha256

      - name: Generate server update manifest
        shell: bash
        run: |
          SERVER_HASH=$(sha256sum windows/chatserver.exe | awk '{print $1}')
          printf '{"version":"v%s","asset":"chatserver.exe","sha256":"%s"}' "$VERSION" "$SERVER_HASH" > windows/server-update-manifest.json

      - name: Sign server update assets
        working-directory: Client/tauri-client
        shell: bash
        env:
          SERVER_UPDATE_SIGNING_PRIVATE_KEY: ${{ secrets.SERVER_UPDATE_SIGNING_PRIVATE_KEY }}
          SERVER_UPDATE_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.SERVER_UPDATE_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          KEY_PATH=$(mktemp)
          printf '%s' "$SERVER_UPDATE_SIGNING_PRIVATE_KEY" > "$KEY_PATH"
          trap 'rm -f "$KEY_PATH"' EXIT
          npm ci
          npx tauri signer sign -k "$KEY_PATH" -p "$SERVER_UPDATE_SIGNING_PRIVATE_KEY_PASSWORD" ../../windows/chatserver.exe
          npx tauri signer sign -k "$KEY_PATH" -p "$SERVER_UPDATE_SIGNING_PRIVATE_KEY_PASSWORD" ../../windows/server-update-manifest.json

      - name: Install root dependencies (changelogen)
        run: npm ci

      - name: Generate changelog
        shell: bash
        run: npx changelogen --output CHANGELOG.md

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          mapfile -t assets < <(find windows linux -type f)
          assets+=(checksums.sha256)
          gh release create "${{ github.ref_name }}" \
            --notes-file CHANGELOG.md \
            "${assets[@]}"