release.yml

name: Release Installers

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      version:
        description: "Version number (e.g. 0.1.0) — for test builds only"
        required: true
        default: "0.0.0-test"

permissions:
  contents: write

env:
  NODE_VERSION: "22"
  GO_VERSION: "1.24"
  VERSION: ${{ github.event.inputs.version || github.ref_name }}

jobs:
  build-macos:
    strategy:
      matrix:
        include:
          - arch: arm64
            goarch: arm64
          - arch: amd64
            goarch: amd64
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install Wails
        run: go install github.com/wailsapp/wails/v2/cmd/wails@latest

      - name: Build socAdmin server binary
        run: |
          cd frontend && APP_VERSION=${VERSION} npm ci && APP_VERSION=${VERSION} npm run build && cd ..
          CGO_ENABLED=1 GOARCH=${{ matrix.goarch }} go build -ldflags="-s -w" -o bin/socadmin .

      - name: Install manager frontend deps
        run: cd manager/frontend && npm ci

      - name: Build Soca Manager .app
        run: cd manager && wails build -clean -platform darwin/${{ matrix.goarch }} -ldflags "-X main.version=${VERSION}"

      - name: Embed server binary into .app
        run: |
          APP_PATH="manager/build/bin/Soca Manager.app"
          mkdir -p "$APP_PATH/Contents/Resources"
          cp bin/socadmin "$APP_PATH/Contents/Resources/socadmin"
          chmod +x "$APP_PATH/Contents/Resources/socadmin"

      - name: Setup signing keychain
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          CERT_PATH="$RUNNER_TEMP/devid.p12"
          KEYCHAIN_PATH="$RUNNER_TEMP/app-signing.keychain-db"

          printf '%s' "$APPLE_CERTIFICATE" | base64 -D > "$CERT_PATH"

          /usr/bin/openssl pkcs12 -in "$CERT_PATH" -noout -passin "pass:$APPLE_CERTIFICATE_PASSWORD" && echo "Certificate OK" || { echo "Certificate verification failed"; exit 1; }

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH"

          security import "$CERT_PATH" -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security -f pkcs12 -k "$KEYCHAIN_PATH" || true

          curl -sL https://www.apple.com/certificateauthority/DeveloperIDG2CA.cer -o "$RUNNER_TEMP/DeveloperIDG2CA.cer"
          security import "$RUNNER_TEMP/DeveloperIDG2CA.cer" -k "$KEYCHAIN_PATH" -T /usr/bin/codesign || true

          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          IDENTITY=$(security find-identity -v -p codesigning "$KEYCHAIN_PATH" | grep "Developer ID Application" | head -1 | awk -F'"' '{print $2}')
          if [ -z "$IDENTITY" ]; then
            echo "No signing identity found"
            security find-identity -v "$KEYCHAIN_PATH"
            exit 1
          fi
          echo "Signing identity: $IDENTITY"
          echo "SIGNING_IDENTITY=$IDENTITY" >> "$GITHUB_ENV"

      - name: Sign .app bundle
        run: |
          APP_PATH="manager/build/bin/Soca Manager.app"

          find "$APP_PATH/Contents" -type f -name "*.dylib" -exec \
            codesign --force --options runtime --timestamp --sign "$SIGNING_IDENTITY" {} \;

          codesign --force --options runtime --timestamp --sign "$SIGNING_IDENTITY" \
            "$APP_PATH/Contents/Resources/socadmin"
          codesign --force --options runtime --timestamp --sign "$SIGNING_IDENTITY" \
            "$APP_PATH/Contents/MacOS/soca-manager"
          codesign --force --options runtime --timestamp --sign "$SIGNING_IDENTITY" \
            "$APP_PATH"

          codesign -vvv --deep --strict "$APP_PATH"

      - name: Create and sign DMG
        run: |
          VERSION=${VERSION#v}
          OUTPUT_DIR="build/macos/dist"
          mkdir -p "$OUTPUT_DIR"
          DMG_PATH="$OUTPUT_DIR/Soca-Manager-${VERSION}-macos-${{ matrix.arch }}.dmg"
          APP_PATH="manager/build/bin/Soca Manager.app"

          TEMP_DMG="$OUTPUT_DIR/temp.dmg"
          MOUNT_DIR="/tmp/socadmin-dmg-mount"

          hdiutil create -size 100m -fs HFS+ -volname "Soca Manager" "$TEMP_DMG" -ov
          hdiutil attach "$TEMP_DMG" -mountpoint "$MOUNT_DIR"
          cp -R "$APP_PATH" "$MOUNT_DIR/"
          ln -s /Applications "$MOUNT_DIR/Applications"
          hdiutil detach "$MOUNT_DIR"
          hdiutil convert "$TEMP_DMG" -format UDZO -o "$DMG_PATH"
          rm -f "$TEMP_DMG"

          codesign --force --timestamp --sign "$SIGNING_IDENTITY" "$DMG_PATH"

      - name: Notarize DMG
        env:
          APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
        run: |
          VERSION=${VERSION#v}
          DMG_PATH="build/macos/dist/Soca-Manager-${VERSION}-macos-${{ matrix.arch }}.dmg"

          API_KEY_PATH="$RUNNER_TEMP/AuthKey.p8"
          echo "$APPLE_API_KEY_P8" > "$API_KEY_PATH"

          xcrun notarytool submit "$DMG_PATH" \
            --key "$API_KEY_PATH" \
            --key-id "$APPLE_API_KEY_ID" \
            --issuer "$APPLE_API_ISSUER_ID" \
            --wait

          xcrun stapler staple "$DMG_PATH"

      - name: Verify signature
        run: |
          VERSION=${VERSION#v}
          DMG_PATH="build/macos/dist/Soca-Manager-${VERSION}-macos-${{ matrix.arch }}.dmg"
          spctl -a -vv --type install "$DMG_PATH"

      - name: Cleanup keychain
        if: always()
        run: security delete-keychain "$RUNNER_TEMP/app-signing.keychain-db" || true

      - uses: actions/upload-artifact@v4
        with:
          name: macos-dmg-${{ matrix.arch }}
          path: build/macos/dist/*.dmg

  build-windows:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install NSIS
        shell: bash
        run: |
          choco install nsis -y
          echo "C:\\Program Files (x86)\\NSIS" >> $GITHUB_PATH

      - name: Install Wails
        run: go install github.com/wailsapp/wails/v2/cmd/wails@latest

      - name: Build socAdmin server binary
        shell: bash
        run: |
          cd frontend && npm ci && npm run build && cd ..
          CGO_ENABLED=1 go build -ldflags="-s -w" -o bin/socadmin.exe .

      - name: Install frontend deps
        run: cd manager/frontend && npm ci

      - name: Build & package EXE (amd64 + arm64)
        shell: bash
        run: |
          export PATH="/c/Program Files (x86)/NSIS:$PATH"
          VERSION=${VERSION#v}
          cd manager
          # 1) Build amd64 with -nsis to generate wails_tools.nsh with resolved templates
          wails build -clean -platform windows/amd64 -nsis -ldflags "-X main.version=v${VERSION}"
          cp ../bin/socadmin.exe build/bin/socadmin.exe
          # 2) Remove the amd64-only installer (we'll create a dual-arch one)
          rm -f build/bin/*amd64-installer.exe
          # 3) Build arm64 binary (no -clean to preserve amd64 binary)
          wails build -platform windows/arm64 -o soca-manager-arm64.exe -skipbindings -ldflags "-X main.version=v${VERSION}"
          # 4) Re-run NSIS with both binaries for dual-arch installer
          makensis \
            "-DARG_WAILS_AMD64_BINARY=..\..\bin\soca-manager.exe" \
            "-DARG_WAILS_ARM64_BINARY=..\..\bin\soca-manager-arm64.exe" \
            build/windows/installer/project.nsi
          mkdir -p ../build/windows/dist
          cp build/bin/*installer.exe "../build/windows/dist/Soca-Manager-${VERSION}-windows-setup.exe"

      - uses: actions/upload-artifact@v4
        with:
          name: windows-exe
          path: build/windows/dist/*.exe

  build-linux:
    strategy:
      matrix:
        include:
          - runner: ubuntu-24.04
            arch: amd64
          - runner: ubuntu-24.04-arm
            arch: arm64
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install system deps
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev fakeroot zstd

      - name: Install Wails
        run: go install github.com/wailsapp/wails/v2/cmd/wails@latest

      - name: Install frontend deps
        run: cd manager/frontend && npm ci

      - name: Build & package .deb + Arch
        run: |
          chmod +x build/linux/package.sh
          VERSION=${VERSION#v}
          ./build/linux/package.sh "$VERSION"

      - uses: actions/upload-artifact@v4
        with:
          name: linux-packages-${{ matrix.arch }}
          path: |
            build/linux/dist/*.deb
            build/linux/dist/*.pkg.tar.zst

  release:
    needs: [build-macos, build-windows, build-linux]
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: |
            artifacts/*.dmg
            artifacts/*.exe
            artifacts/*.deb
            artifacts/*.pkg.tar.zst