name: Release

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: write

jobs:
  build:
    strategy:
      fail-fast: false
      # tauri-action's find-or-create-release check races across parallel
      # matrix jobs and can create two separate release objects for the
      # same tag, each missing the other's assets — force serial builds.
      # Every platform added below shares that release object, so they all
      # have to stay in this one serialized matrix.
      max-parallel: 1
      matrix:
        include:
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            arch: x64
          - os: windows-latest
            target: aarch64-pc-windows-msvc
            arch: arm64
          # 22.04 is the oldest runner with webkit2gtk-4.1 (what Tauri 2
          # needs); building on it keeps the glibc floor as low as possible
          - os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            arch: x64
          - os: macos-latest
            target: aarch64-apple-darwin
            arch: arm64
          - os: macos-latest
            target: x86_64-apple-darwin
            arch: x64
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4

      - if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential curl wget file \
            libwebkit2gtk-4.1-dev librsvg2-dev libssl-dev libxdo-dev \
            libayatana-appindicator3-dev patchelf

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri
          key: ${{ matrix.target }}

      - run: npm ci

      # TAURI_SIGNING_* below is the updater's minisign keypair, not OS code
      # signing — there is no Apple certificate, so macOS builds are only
      # ad-hoc signed (bundle.macOS.signingIdentity "-") and Gatekeeper still
      # asks the user to allow them on first launch.
      - uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          tagName: ${{ github.ref_name }}
          releaseName: "Summarum ${{ github.ref_name }}"
          releaseDraft: true
          prerelease: false
          args: --target ${{ matrix.target }}

  notes:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          prev=$(git tag --sort=-v:refname | grep -v "^${{ github.ref_name }}$" | head -1)
          # release-checklist version bumps (bump version to X / bump cargo
          # version to X / update tauri.conf version to X / sync Cargo.lock
          # or package-lock.json with X) are internal bookkeeping, not
          # user-facing changes — never worth a changelog line.
          noise='^- (bump( cargo)? version to|update tauri\.conf version to|sync (Cargo\.lock|package-lock\.json) with) [0-9]+\.[0-9]+\.[0-9]+$'
          filter() { grep -vE "$noise" | sed -E 's/ \(#[0-9]+\)$//'; }
          {
            echo "## What's new"
            if [ -n "$prev" ]; then
              git log "$prev..${{ github.ref_name }}" --pretty=format:"- %s" --no-merges | filter
              echo ""
              echo "**Full Changelog**: https://github.com/${{ github.repository }}/compare/$prev...${{ github.ref_name }}"
            else
              git log "${{ github.ref_name }}" --pretty=format:"- %s" --no-merges | filter
            fi
          } > notes.md
          gh release edit "${{ github.ref_name }}" --notes-file notes.md --draft=false