name: Cross-platform build (disposable signatures)

on:
  workflow_dispatch:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: build-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: CI test bundle / ${{ matrix.platform }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux-x86_64
            os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            bundles: appimage,deb
          - platform: windows-x86_64
            os: windows-2022
            target: x86_64-pc-windows-msvc
            bundles: nsis,msi
          - platform: darwin-aarch64
            os: macos-15
            target: aarch64-apple-darwin
            bundles: dmg,app
          - platform: darwin-x86_64
            os: macos-15-intel
            target: x86_64-apple-darwin
            bundles: dmg,app
    runs-on: ${{ matrix.os }}
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - name: Install Linux desktop dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf
      - run: npm ci
      - run: npm test
      - run: cargo test --locked --manifest-path src-tauri/Cargo.toml
      - run: cargo build --locked --release --manifest-path scripts/release-verifier/Cargo.toml
      - run: python -m unittest discover -s scripts -p 'release_test.py' -v
      - name: Generate disposable CI key (never a production secret)
        run: |
          python scripts/release.py ci-key --directory "$RUNNER_TEMP/ci-updater"
          python -c "import json,os; open(os.environ['GITHUB_ENV'],'a').write('RELEASE_VERSION='+json.load(open('package.json'))['version']+'\n')"
      - name: Build packages and updater bundles
        run: npm run tauri:build -- --ci --target '${{ matrix.target }}' --bundles '${{ matrix.bundles }}' --config "$RUNNER_TEMP/ci-updater/updater-build.json"
      - name: Collect and verify every test bundle
        run: python scripts/release.py collect --bundle 'src-tauri/target/${{ matrix.target }}/release/bundle' --directory ci-packages --platform '${{ matrix.platform }}' --version "$RELEASE_VERSION"
      - uses: actions/upload-artifact@v4
        with:
          name: CI-NOT-FOR-RELEASE-${{ matrix.platform }}
          if-no-files-found: error
          retention-days: 7
          path: ci-packages/*