name: Desktop release

on:
  push:
    tags: ["v*"]
  # Manual runs are artifact-only, unsigned, and NEVER create a release.
  # Use this for the first Windows/Linux dress rehearsal without secrets.
  workflow_dispatch:

permissions:
  contents: read

# Serialize separate runs for the same ref; never cancel an upload in flight.
concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  NEXT_TELEMETRY_DISABLED: "1"

jobs:
  quality:
    name: Release gates
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: "26"
          cache: npm
      - run: npm ci
      - name: Tag must match package.json
        if: github.event_name == 'push'
        run: |
          node --input-type=module -e '
            import fs from "node:fs";
            const {version} = JSON.parse(fs.readFileSync("package.json", "utf8"));
            if (process.env.GITHUB_REF_NAME !== `v${version}`) {
              console.error("Release tag must equal v" + version);
              process.exit(1);
            }
          '
      - run: npm run typecheck
      - run: npm test
      - run: npm run lint

  draft:
    name: Prepare one draft
    needs: quality
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: write
    steps:
      # This job succeeds without creating anything on manual rehearsals.
      # Preparing once avoids the publisher's list-miss/create race between OS jobs.
      - name: Create or reuse the tag's draft
        if: github.event_name == 'push'
        uses: actions/github-script@v9
        with:
          script: |
            const {owner, repo} = context.repo;
            const tag = context.ref.replace(/^refs\/tags\//, "");
            const version = tag.slice(1);
            const releases = await github.paginate(github.rest.repos.listReleases, {
              owner, repo, per_page: 100,
            });
            const matches = releases.filter(release =>
              release.tag_name === tag || release.tag_name === version);
            if (matches.length > 1) {
              throw new Error(`Multiple releases match ${tag}; resolve them before uploading.`);
            }
            if (matches.length === 1) {
              if (!matches[0].draft) {
                throw new Error(`${tag} is already published; refusing to modify it.`);
              }
              core.info(`Reusing draft ${matches[0].id} for ${tag}`);
              return;
            }
            const {data} = await github.rest.repos.createRelease({
              owner, repo, tag_name: tag, name: version, draft: true,
            });
            core.info(`Created draft ${data.id} for ${tag}`);

  package:
    name: Package (${{ matrix.platform }})
    needs: [quality, draft]
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: macos-26
            platform: mac-arm64
            builder_args: --mac --arm64
          - os: windows-2025
            platform: windows-x64
            builder_args: --win --x64
          - os: ubuntu-24.04
            platform: linux-x64
            builder_args: --linux --x64
    runs-on: ${{ matrix.os }}
    # Apple's notarization queue has taken ~2 hours for this team.
    timeout-minutes: 180
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: "26"
          cache: npm
      # The mac icon is the Icon Composer document (build/icon.icon);
      # compiling it needs both macOS 26+ and actool ≥ 26 (Xcode 26+).
      # Xcode 26's asset compiler crashes on macOS 15's older frameworks.
      # Select the latest stable Xcode; no-op for Windows/Linux.
      - name: Select Xcode 26+ for actool (mac icon compile)
        if: runner.os == 'macOS'
        uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: latest-stable
      - run: npm ci
      - name: Native renderer tests on this OS
        run: npx electron --import tsx --test tests/pdf-native-render.test.ts tests/pdf-ops.test.ts tests/svg-native-render.test.ts tests/browser-service.test.ts
        env:
          NODE_ENV: test
          ELECTRON_RUN_AS_NODE: "1"
      - run: npm run build
      - run: node scripts/build-server.mjs
      - run: node scripts/smoke-server.mjs --electron
      - name: Validate macOS release secrets
        if: github.event_name == 'push' && runner.os == 'macOS'
        env:
          CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          for name in CSC_LINK CSC_KEY_PASSWORD APPLE_ID APPLE_APP_SPECIFIC_PASSWORD APPLE_TEAM_ID; do
            if [[ -z "${!name}" ]]; then
              echo "::error::Missing signing/notarization secret: $name"
              exit 1
            fi
          done
      - name: Signed and notarized macOS release → draft
        if: github.event_name == 'push' && runner.os == 'macOS'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: npx electron-builder ${{ matrix.builder_args }} --publish always -c.forceCodeSigning=true
      - name: Windows/Linux release → draft
        if: github.event_name == 'push' && runner.os != 'macOS'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npx electron-builder ${{ matrix.builder_args }} --publish always
      - name: Unsigned macOS rehearsal (no publish, no notarization)
        if: github.event_name == 'workflow_dispatch' && runner.os == 'macOS'
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: "false"
        run: npx electron-builder ${{ matrix.builder_args }} --publish never -c.mac.notarize=false
      - name: Windows/Linux rehearsal (no publish)
        if: github.event_name == 'workflow_dispatch' && runner.os != 'macOS'
        run: npx electron-builder ${{ matrix.builder_args }} --publish never
      - name: Save installers and update metadata
        uses: actions/upload-artifact@v7
        with:
          name: learnharness-${{ matrix.platform }}
          retention-days: 7
          if-no-files-found: error
          path: |
            dist/*.dmg
            dist/*.zip
            dist/*.exe
            dist/*.AppImage
            dist/*.deb
            dist/*.blockmap
            dist/latest*.yml

  # The last gate before a human publishes: after ALL three packaging jobs
  # have uploaded, fail the run unless the tag's single draft release holds
  # exactly the 11 verified assets (4 installers + mac updater ZIP + their
  # blockmaps + 3 latest*.yml feeds) and the feeds reference those uploads
  # by exact name at the package.json version. Read-only: it never creates,
  # edits, publishes, or deletes anything. Manual rehearsals upload nothing,
  # so there is no draft to verify and the job stays skipped.
  verify:
    name: Verify draft release
    needs: package
    if: github.event_name == 'push'
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
    env:
      GH_TOKEN: ${{ github.token }}
    steps:
      # The tagged revision — verify exactly what was packaged, not a moving default.
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.sha }}
      - uses: actions/setup-node@v7
        with:
          node-version: "26"
          cache: npm
      - run: npm ci
      - name: List every release, drafts included
        # --slurp wraps the paginated pages into one JSON document
        # ([[release,...],[release,...]]); the validator flattens it.
        run: gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/releases?per_page=100" > "$RUNNER_TEMP/releases.json"
      - name: Select the tag's single draft
        # Machine JSON on stdout (release id + asset ids); warnings on stderr.
        run: npx tsx scripts/verify-release.ts select "$RUNNER_TEMP/releases.json" --tag "$GITHUB_REF_NAME" > "$RUNNER_TEMP/draft.json"
      - name: Download the three update feeds
        run: |
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/metadata"
          for name in latest-mac.yml latest.yml latest-linux.yml; do
            id=$(DRAFT="$RUNNER_TEMP/draft.json" NAME="$name" node -e '
              const fs = require("node:fs");
              const draft = JSON.parse(fs.readFileSync(process.env.DRAFT, "utf8"));
              const asset = draft.assets.find((entry) => entry.name === process.env.NAME);
              if (asset == null) { console.error("draft has no " + process.env.NAME); process.exit(1); }
              console.log(asset.id);
            ')
            gh api "repos/$GITHUB_REPOSITORY/releases/assets/$id" -H "Accept: application/octet-stream" > "$RUNNER_TEMP/metadata/$name"
            echo "downloaded $name ($(wc -c < "$RUNNER_TEMP/metadata/$name") bytes)"
          done
      - name: Verify draft assets and update feeds
        run: npx tsx scripts/verify-release.ts verify "$RUNNER_TEMP/releases.json" "$RUNNER_TEMP/metadata" --tag "$GITHUB_REF_NAME"