ci.yml

name: CI

on:
  push:
    tags: ['v*.*.*']

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  NODE_VERSION: 22.14.0
  # Pinned bblanchon/pdfium-binaries release used to provide the native PDFium
  # libraries that src-tauri/tauri.*.conf.json bundle as resources. Bump this
  # tag deliberately when updating PDFium.
  PDFIUM_VERSION: chromium/7906
  NDK_VERSION: 28.2.13676358

jobs:

  # ── Gate: tests must pass before any release job runs ────────────────────────
  test:
    name: Test
    runs-on: windows-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Cache PDFium binary (Windows)
        id: cache-pdfium-win
        uses: actions/cache@v4
        with:
          path: src-tauri/pdfium-bin/windows
          key: pdfium-windows-${{ env.PDFIUM_VERSION }}

      - name: Download PDFium binary
        if: steps.cache-pdfium-win.outputs.cache-hit != 'true'
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p src-tauri/pdfium-bin/windows
          curl -sL "https://github.com/bblanchon/pdfium-binaries/releases/download/${PDFIUM_VERSION//\//%2F}/pdfium-win-x64.tgz" -o pdfium.tgz
          tar -xzf pdfium.tgz bin/pdfium.dll
          mv bin/pdfium.dll src-tauri/pdfium-bin/windows/pdfium.dll
          rm -rf bin pdfium.tgz

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Install npm dependencies
        run: npm ci

      - name: Run Rust format check
        run: cargo fmt --manifest-path src-tauri/Cargo.toml -- --check

      - name: Run Rust clippy
        run: cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings

      - name: Run frontend tests
        run: npm run test:unit

      - name: Check GitHub Pages output
        run: npm run check:pages

      - name: Run Rust tests
        run: npm run test:rust

      - name: Run frontend build
        run: npm run build

  # ── After tests pass ─────────────────────────────────────────────────────────
  verify-release:
    name: Verify release
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Validate semantic version tag
        shell: bash
        run: |
          set -euo pipefail
          semver_regex='^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$'
          if [[ ! "${GITHUB_REF_NAME}" =~ ${semver_regex} ]]; then
            echo "Tag ${GITHUB_REF_NAME} is not a valid release tag."
            echo "Use vMAJOR.MINOR.PATCH or vMAJOR.MINOR.PATCH-prerelease, e.g. v1.2.3 or v1.2.3-rc.1."
            exit 1
          fi

      - name: Verify tagged commit is on main
        shell: bash
        run: |
          set -euo pipefail
          git fetch origin main
          tag_commit="$(git rev-list -n 1 "${GITHUB_REF_NAME}")"
          if ! git merge-base --is-ancestor "${tag_commit}" origin/main; then
            echo "Tag ${GITHUB_REF_NAME} must point to a commit already reachable from main."
            exit 1
          fi

      - name: Verify release version matches tag
        shell: bash
        run: |
          set -euo pipefail
          tag_version="${GITHUB_REF_NAME#v}"
          pkg_version=$(node -p "require('./package.json').version")
          tauri_version=$(node -p "require('./src-tauri/tauri.conf.json').version")

          echo "Tag version:             $tag_version"
          echo "package.json version:    $pkg_version"
          echo "tauri.conf.json version: $tauri_version"

          if [[ "$tag_version" != "$pkg_version" ]]; then
            echo "Tag version does not match package.json version."
            exit 1
          fi

          if [[ "$tag_version" != "$tauri_version" ]]; then
            echo "Tag version does not match tauri.conf.json version."
            exit 1
          fi

      - name: Verify changelog has an entry for this version
        shell: bash
        run: |
          set -euo pipefail
          tag_version="${GITHUB_REF_NAME#v}"
          node scripts/extract-changelog.cjs "$tag_version"

  build-windows:
    name: Build Windows installers
    needs: verify-release
    runs-on: windows-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Cache PDFium binary (Windows)
        id: cache-pdfium-win-build
        uses: actions/cache@v4
        with:
          path: src-tauri/pdfium-bin/windows
          key: pdfium-windows-${{ env.PDFIUM_VERSION }}

      - name: Download PDFium binary
        if: steps.cache-pdfium-win-build.outputs.cache-hit != 'true'
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p src-tauri/pdfium-bin/windows
          curl -sL "https://github.com/bblanchon/pdfium-binaries/releases/download/${PDFIUM_VERSION//\//%2F}/pdfium-win-x64.tgz" -o pdfium.tgz
          tar -xzf pdfium.tgz bin/pdfium.dll
          mv bin/pdfium.dll src-tauri/pdfium-bin/windows/pdfium.dll
          rm -rf bin pdfium.tgz

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Install npm dependencies
        run: npm ci

      - name: Build Windows installer bundles
        run: npm run tauri build

      - name: Collect Windows installers
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path release-assets | Out-Null

          $nsis = Get-ChildItem -Path src-tauri/target/release/bundle/nsis -Filter *.exe -ErrorAction SilentlyContinue

          if (!$nsis) { Write-Error "No NSIS .exe installer found."; exit 1 }

          $version = $env:GITHUB_REF_NAME -replace '^v', ''
          Copy-Item $nsis.FullName "release-assets/DocLatch_${version}_windows_x64.exe" -Force

      - name: Upload Windows installers
        uses: actions/upload-artifact@v4
        with:
          name: windows-installers
          path: release-assets/*
          if-no-files-found: error

  build-linux:
    name: Build Linux installers
    needs: verify-release
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Cache PDFium binary (Linux)
        id: cache-pdfium-linux
        uses: actions/cache@v4
        with:
          path: src-tauri/pdfium-bin/linux
          key: pdfium-linux-${{ env.PDFIUM_VERSION }}

      - name: Download PDFium binary
        if: steps.cache-pdfium-linux.outputs.cache-hit != 'true'
        run: |
          set -euo pipefail
          mkdir -p src-tauri/pdfium-bin/linux
          curl -sL "https://github.com/bblanchon/pdfium-binaries/releases/download/${PDFIUM_VERSION//\//%2F}/pdfium-linux-x64.tgz" -o pdfium.tgz
          tar -xzf pdfium.tgz lib/libpdfium.so
          mv lib/libpdfium.so src-tauri/pdfium-bin/linux/libpdfium.so
          rm -rf lib pdfium.tgz

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf build-essential curl wget file

      - name: Install npm dependencies
        run: npm ci

      - name: Build Linux installer bundles
        run: npm run tauri build

      - name: Collect Linux installers
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p release-assets

          appimage=$(find src-tauri/target/release/bundle/appimage -name '*.AppImage' 2>/dev/null || true)

          if [[ -z "$appimage" ]]; then echo "No .AppImage found."; exit 1; fi

          version="${GITHUB_REF_NAME#v}"
          cp "$appimage" "release-assets/DocLatch_${version}_linux_x64_portable.AppImage"

      - name: Upload Linux installers
        uses: actions/upload-artifact@v4
        with:
          name: linux-installers
          path: release-assets/*
          if-no-files-found: error

  build-macos:
    name: Build macOS installers
    if: false  # DISABLED
    needs: [verify-release, build-windows, build-linux]
    runs-on: macos-13
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Cache PDFium binary (macOS)
        id: cache-pdfium-macos
        uses: actions/cache@v4
        with:
          path: src-tauri/pdfium-bin/macos
          key: pdfium-macos-${{ env.PDFIUM_VERSION }}

      - name: Download PDFium binary
        if: steps.cache-pdfium-macos.outputs.cache-hit != 'true'
        run: |
          set -euo pipefail
          mkdir -p src-tauri/pdfium-bin/macos
          curl -sL "https://github.com/bblanchon/pdfium-binaries/releases/download/${PDFIUM_VERSION//\//%2F}/pdfium-mac-x64.tgz" -o pdfium.tgz
          tar -xzf pdfium.tgz lib/libpdfium.dylib
          mv lib/libpdfium.dylib src-tauri/pdfium-bin/macos/libpdfium.dylib
          rm -rf lib pdfium.tgz

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Install npm dependencies
        run: npm ci

      - name: Build macOS installer bundles
        run: npm run tauri build

      - name: Collect macOS installers
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p release-assets

          dmg=$(find src-tauri/target/release/bundle/dmg -name '*.dmg' 2>/dev/null || true)

          if [[ -z "$dmg" ]]; then echo "No .dmg installer found."; exit 1; fi

          cp $dmg release-assets/

      - name: Upload macOS installers
        uses: actions/upload-artifact@v4
        with:
          name: macos-installers
          path: release-assets/*
          if-no-files-found: error

  build-android:
    name: Build Android APK
    needs: verify-release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
      ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '21'

      - name: Cache Android NDK
        id: cache-ndk
        uses: actions/cache@v4
        with:
          path: /usr/local/lib/android/sdk/ndk/${{ env.NDK_VERSION }}
          key: android-ndk-${{ env.NDK_VERSION }}

      - name: Install Android NDK
        if: steps.cache-ndk.outputs.cache-hit != 'true'
        run: |
          SDKMANAGER="$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager"
          yes | "$SDKMANAGER" --licenses > /dev/null 2>&1 || true
          "$SDKMANAGER" "ndk;${{ env.NDK_VERSION }}"

      - name: Set NDK_HOME
        run: echo "NDK_HOME=$ANDROID_HOME/ndk/${{ env.NDK_VERSION }}" >> "$GITHUB_ENV"

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Add Android Rust targets
        run: rustup target add aarch64-linux-android armv7-linux-androideabi i686-linux-android x86_64-linux-android

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Cache Gradle dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: gradle-${{ hashFiles('src-tauri/Cargo.lock') }}
          restore-keys: gradle-

      - name: Install npm dependencies
        run: npm ci

      - name: Initialize Android project
        run: npx tauri android init

      - name: Write release keystore
        run: echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 -d > src-tauri/gen/android/app/doclatch-release.jks

      - name: Inject Android signing config
        run: |
          awk '
            /^    defaultConfig \{/ {
              print "    signingConfigs {"
              print "        create(\"release\") {"
              print "            keyAlias = System.getenv(\"ANDROID_KEY_ALIAS\")"
              print "            keyPassword = System.getenv(\"ANDROID_KEYSTORE_PASSWORD\")"
              print "            storeFile = file(\"doclatch-release.jks\")"
              print "            storePassword = System.getenv(\"ANDROID_KEYSTORE_PASSWORD\")"
              print "        }"
              print "    }"
            }
            /getByName\("release"\)/ {
              print
              print "            signingConfig = signingConfigs.getByName(\"release\")"
              next
            }
            { print }
          ' src-tauri/gen/android/app/build.gradle.kts > /tmp/build.gradle.kts
          mv /tmp/build.gradle.kts src-tauri/gen/android/app/build.gradle.kts

      - name: Build Android APK (release)
        run: npx tauri android build

      - name: Collect Android APK
        run: |
          set -euo pipefail
          mkdir -p release-assets
          apk=$(find src-tauri/gen/android/app/build/outputs/apk -name '*-release.apk' 2>/dev/null || true)
          if [[ -z "$apk" ]]; then echo "No signed release APK found."; exit 1; fi
          version="${GITHUB_REF_NAME#v}"
          cp "$apk" "release-assets/DocLatch_${version}_android.apk"

      - name: Upload Android APK
        uses: actions/upload-artifact@v4
        with:
          name: android-apk
          path: release-assets/*.apk
          if-no-files-found: error

  create-release:
    name: Create release
    needs: [build-windows, build-linux, build-android]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Download Windows installers
        uses: actions/download-artifact@v4
        with:
          name: windows-installers
          path: release-assets

      - name: Download Linux installers
        uses: actions/download-artifact@v4
        with:
          name: linux-installers
          path: release-assets

      - name: Download Android APK
        uses: actions/download-artifact@v4
        with:
          name: android-apk
          path: release-assets

      - name: Compute combined checksums
        shell: bash
        run: |
          set -euo pipefail
          cd release-assets
          sha256sum * > SHA256SUMS.txt

      - name: Prepare release notes
        shell: bash
        run: |
          set -euo pipefail
          tag_version="${GITHUB_REF_NAME#v}"
          {
            echo "# DocLatch ${GITHUB_REF_NAME}"
            echo
            node scripts/extract-changelog.cjs "$tag_version"
            echo
            echo "## Checksums (SHA-256)"
            echo
            echo '```'
            cat release-assets/SHA256SUMS.txt
            echo '```'
          } > release-notes.md

      - name: Create GitHub release
        uses: softprops/action-gh-release@v2.6.2
        with:
          tag_name: ${{ github.ref_name }}
          name:  DocLatch ${{ github.ref_name }}
          body_path: release-notes.md
          files: release-assets/*
          draft: false
          prerelease: ${{ contains(github.ref_name, '-') }}
          fail_on_unmatched_files: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}