release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

env:
  TAURI_CLI_VERSION: 2.11.2

jobs:
  build-and-release-windows:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Restore Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: |
            src-tauri -> target
          shared-key: windows-rust-v1

      - name: Restore Tauri CLI cache
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/bin/cargo-tauri.exe
            ~/.cargo/.crates.toml
            ~/.cargo/.crates2.json
          key: ${{ runner.os }}-tauri-cli-${{ env.TAURI_CLI_VERSION }}-v1

      - name: Validate tag matches app version
        shell: pwsh
        run: |
          $tag = "${env:GITHUB_REF_NAME}"
          if (-not $tag.StartsWith("v")) { throw "Expected tag to start with 'v' (got '$tag')" }
          $expected = $tag.Substring(1)
          $cargoToml = Get-Content -Raw "src-tauri/Cargo.toml"
          $match = [regex]::Match($cargoToml, '(?m)^\s*version\s*=\s*"([^"]+)"\s*$')
          if (-not $match.Success) {
            throw "Could not parse package version from src-tauri/Cargo.toml."
          }
          $actual = $match.Groups[1].Value
          if ($actual -ne $expected) {
            throw "Tag version ($expected) does not match src-tauri/Cargo.toml version ($actual)."
          }

      - name: Install Tauri CLI
        shell: pwsh
        run: |
          $timer = Measure-Command {
            $expectedVersion = [regex]::Escape($env:TAURI_CLI_VERSION)
            $versionOutput = (& cargo tauri --version 2>$null)
            $hasExpectedVersion = $LASTEXITCODE -eq 0 -and $versionOutput -match "tauri-cli\s+$expectedVersion\b"

            if ($hasExpectedVersion) {
              Write-Host "Tauri CLI $env:TAURI_CLI_VERSION already available from cache."
            }
            else {
              cargo install tauri-cli --version $env:TAURI_CLI_VERSION --locked --force
              if ($LASTEXITCODE -ne 0) { throw "Failed to install Tauri CLI $env:TAURI_CLI_VERSION." }

              $versionOutput = (& cargo tauri --version).Trim()
              if ($versionOutput -notmatch "tauri-cli\s+$expectedVersion\b") {
                throw "Expected Tauri CLI $env:TAURI_CLI_VERSION, got '$versionOutput'."
              }
            }
          }
          Write-Host ("Tauri CLI setup completed in {0:N1}s" -f $timer.TotalSeconds)

      - name: Install Windows bundler tools
        shell: pwsh
        run: |
          $timer = Measure-Command {
            $makensis = Get-Command makensis -ErrorAction SilentlyContinue
            if ($makensis) {
              Write-Host "NSIS already available at $($makensis.Source)."
            }
            else {
              choco install nsis --no-progress -y
            }
          }
          Write-Host ("NSIS setup completed in {0:N1}s" -f $timer.TotalSeconds)

      - name: Validate updater signing secrets
        shell: pwsh
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
        run: |
          if ([string]::IsNullOrWhiteSpace("${env:TAURI_SIGNING_PRIVATE_KEY}")) {
            throw "Missing TAURI_SIGNING_PRIVATE_KEY secret. Configure updater signing secrets before releasing."
          }

      - name: Validate Cloudflare Pages publish secrets
        shell: pwsh
        env:
          WEBSITE_REPO_TOKEN: ${{ secrets.WEBSITE_REPO_TOKEN }}
        run: |
          if ([string]::IsNullOrWhiteSpace("${env:WEBSITE_REPO_TOKEN}")) {
            throw "Missing WEBSITE_REPO_TOKEN secret. This token must be able to push to prgmitchell/MIDIMasterWebsite."
          }

      - name: Validate Netlify bridge publish secrets
        shell: pwsh
        env:
          NETLIFY_BRIDGE_PUBLISH: ${{ vars.NETLIFY_BRIDGE_PUBLISH }}
          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
          NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID }}
        run: |
          $bridgeRaw = "${env:NETLIFY_BRIDGE_PUBLISH}"
          if ([string]::IsNullOrWhiteSpace($bridgeRaw)) { $bridgeRaw = "true" }
          $bridgeEnabled = @("1", "true", "yes", "on") -contains $bridgeRaw.Trim().ToLowerInvariant()
          if (-not $bridgeEnabled) {
            Write-Host "Netlify bridge publishing is disabled."
            exit 0
          }
          if ([string]::IsNullOrWhiteSpace("${env:NETLIFY_AUTH_TOKEN}")) {
            throw "Missing NETLIFY_AUTH_TOKEN secret. It is required while NETLIFY_BRIDGE_PUBLISH is enabled."
          }
          if ([string]::IsNullOrWhiteSpace("${env:NETLIFY_SITE_ID}")) {
            throw "Missing NETLIFY_SITE_ID secret. It is required while NETLIFY_BRIDGE_PUBLISH is enabled."
          }

      - name: Build (Tauri)
        shell: pwsh
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          Push-Location "src-tauri"
          try {
            $timer = Measure-Command {
              cargo tauri build --bundles nsis
            }
            Write-Host ("Tauri bundle build completed in {0:N1}s" -f $timer.TotalSeconds)
          } finally {
            Pop-Location
          }

      - name: Generate updater metadata (latest.json)
        shell: pwsh
        run: |
          $tag = "${env:GITHUB_REF_NAME}"
          $repo = "${env:GITHUB_REPOSITORY}"

          $nsisDir = "src-tauri/target/release/bundle/nsis"
          $setupExe = Get-ChildItem -Path $nsisDir -Filter *.exe |
            Where-Object { $_.Name -like "*setup*.exe" } |
            Select-Object -First 1

          if (-not $setupExe) {
            throw "Could not find NSIS setup executable in $nsisDir"
          }

          $sigPath = "$($setupExe.FullName).sig"
          if (-not (Test-Path $sigPath)) {
            throw "Missing signature file for updater artifact: $sigPath"
          }

          $signature = (Get-Content -Raw $sigPath).Trim()
          $downloadUrl = "https://github.com/$repo/releases/download/$tag/$($setupExe.Name)"

          $latest = @{
            version = $tag
            notes = "See release notes on GitHub."
            pub_date = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
            platforms = @{
              "windows-x86_64" = @{
                signature = $signature
                url = $downloadUrl
              }
            }
          }

          $latestJsonPath = "src-tauri/target/release/bundle/latest.json"
          $latest | ConvertTo-Json -Depth 8 | Out-File -FilePath $latestJsonPath -Encoding utf8

      - name: Checkout Cloudflare Pages source
        uses: actions/checkout@v4
        with:
          repository: prgmitchell/MIDIMasterWebsite
          token: ${{ secrets.WEBSITE_REPO_TOKEN }}
          path: midimaster-website

      - name: Publish updater metadata to Cloudflare Pages source
        shell: pwsh
        run: |
          $timer = Measure-Command {
            $tag = "${env:GITHUB_REF_NAME}"
            $latestJsonPath = "src-tauri/target/release/bundle/latest.json"
            if (-not (Test-Path -LiteralPath $latestJsonPath)) {
              throw "Updater metadata file not found: $latestJsonPath"
            }

            $websiteRoot = "midimaster-website"
            $targetPath = Join-Path $websiteRoot "public/latest.json"
            New-Item -ItemType Directory -Force -Path (Split-Path -Parent $targetPath) | Out-Null
            Copy-Item -LiteralPath $latestJsonPath -Destination $targetPath -Force

            Push-Location $websiteRoot
            try {
              git config user.name "github-actions[bot]"
              git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
              git add public/latest.json

              git diff --cached --quiet
              if ($LASTEXITCODE -eq 0) {
                Write-Host "Cloudflare Pages updater metadata is already current."
              }
              elseif ($LASTEXITCODE -eq 1) {
                git commit -m "Update MIDIMaster updater metadata for $tag"
                if ($LASTEXITCODE -ne 0) { throw "Failed to commit website updater metadata." }
                git push
                if ($LASTEXITCODE -ne 0) { throw "Failed to push website updater metadata." }
              }
              else {
                throw "Failed to compare staged website updater metadata."
              }
            }
            finally {
              Pop-Location
            }
          }
          Write-Host ("Cloudflare Pages updater metadata publish completed in {0:N1}s" -f $timer.TotalSeconds)

      - name: Publish updater metadata to Netlify bridge
        shell: pwsh
        env:
          NETLIFY_BRIDGE_PUBLISH: ${{ vars.NETLIFY_BRIDGE_PUBLISH }}
          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
          NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID }}
        run: |
          $bridgeRaw = "${env:NETLIFY_BRIDGE_PUBLISH}"
          if ([string]::IsNullOrWhiteSpace($bridgeRaw)) { $bridgeRaw = "true" }
          $bridgeEnabled = @("1", "true", "yes", "on") -contains $bridgeRaw.Trim().ToLowerInvariant()
          if (-not $bridgeEnabled) {
            Write-Host "Netlify bridge publishing is disabled."
            exit 0
          }

          $timer = Measure-Command {
            $latestJsonPath = "src-tauri/target/release/bundle/latest.json"
            if (-not (Test-Path -LiteralPath $latestJsonPath)) {
              throw "Updater metadata file not found: $latestJsonPath"
            }

            $websiteCatalogPath = "midimaster-website/public/catalog.json"
            if (-not (Test-Path -LiteralPath $websiteCatalogPath)) {
              throw "Website store catalog not found: $websiteCatalogPath"
            }

            $publishDir = Join-Path $env:RUNNER_TEMP "netlify-bridge"
            if (Test-Path -LiteralPath $publishDir) {
              Remove-Item -LiteralPath $publishDir -Recurse -Force
            }
            New-Item -ItemType Directory -Force -Path (Join-Path $publishDir "updates") | Out-Null
            Copy-Item -LiteralPath $latestJsonPath -Destination (Join-Path $publishDir "updates/latest.json") -Force
            Copy-Item -LiteralPath $websiteCatalogPath -Destination (Join-Path $publishDir "catalog.json") -Force

            $redirects = @(
              "/latest.json  /updates/latest.json  301"
              "/packages/*  https://store.midimaster.app/packages/:splat  301"
              "/icons/*  https://store.midimaster.app/icons/:splat  301"
              "/*  https://midimaster.app/:splat  301"
            ) -join "`n"
            $redirects += "`n"
            $utf8NoBom = New-Object System.Text.UTF8Encoding($false)
            [System.IO.File]::WriteAllText((Join-Path $publishDir "_redirects"), $redirects, $utf8NoBom)

            & "scripts/netlify/Invoke-NetlifyMergeDeploy.ps1" `
              -SourceDir $publishDir `
              -SiteId "${env:NETLIFY_SITE_ID}"
          }
          Write-Host ("Netlify bridge redirect publish completed in {0:N1}s" -f $timer.TotalSeconds)

      - name: Prepare GitHub release asset list
        id: release_assets
        shell: pwsh
        env:
          UPDATER_BRIDGE_RELEASE: ${{ vars.UPDATER_BRIDGE_RELEASE }}
          UPDATER_BRIDGE_INCLUDE_SIG: ${{ vars.UPDATER_BRIDGE_INCLUDE_SIG }}
        run: |
          $bridgeRaw = "${env:UPDATER_BRIDGE_RELEASE}"
          if ([string]::IsNullOrWhiteSpace($bridgeRaw)) { $bridgeRaw = "true" }
          $bridgeEnabled = @("1", "true", "yes", "on") -contains $bridgeRaw.Trim().ToLowerInvariant()

          $includeSigRaw = "${env:UPDATER_BRIDGE_INCLUDE_SIG}"
          $includeSig = @("1", "true", "yes", "on") -contains $includeSigRaw.Trim().ToLowerInvariant()

          $files = @(
            "src-tauri/target/release/bundle/nsis/*.exe"
          )

          if ($bridgeEnabled) {
            $files += "src-tauri/target/release/bundle/latest.json"
            if ($includeSig) {
              $files += "src-tauri/target/release/bundle/nsis/*.exe.sig"
            }
            Write-Host "Bridge release mode is ON."
          } else {
            Write-Host "Bridge release mode is OFF."
          }

          "files<<EOF" >> $env:GITHUB_OUTPUT
          $files -join "`n" >> $env:GITHUB_OUTPUT
          "EOF" >> $env:GITHUB_OUTPUT

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: MIDIMaster ${{ github.ref_name }}
          draft: false
          prerelease: false
          generate_release_notes: true
          fail_on_unmatched_files: true
          files: ${{ steps.release_assets.outputs.files }}