release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

jobs:
  release-debian:
    name: Build Debian release artifact (${{ matrix.arch }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            platform: linux/amd64
          - arch: armhf
            platform: linux/arm/v7
          - arch: arm64
            platform: linux/arm64
    steps:
      - name: Remove old release artifacts
        run: rm -f ../kel-agent_*

      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build Debian package in Debian stable container
        run: |
          docker run --rm --platform "${{ matrix.platform }}" \
            -v "${{ github.workspace }}:${{ github.workspace }}" \
            -w "${{ github.workspace }}" \
            -e SCHROOT_SESSION_ID=debian-docker \
            debian:stable \
            bash -c '
              set -euxo pipefail
              export DEBIAN_FRONTEND=noninteractive
              apt-get update
              # golang-any provides the Go compiler. All Go source deps come
              # from go mod vendor inside deb-package-ci, so no golang-*-dev
              # packages from the Debian archive are needed here.
              apt-get install -y --no-install-recommends \
                autorevision \
                build-essential \
                ca-certificates \
                debhelper \
                dh-golang \
                dpkg-dev \
                fakeroot \
                git \
                golang-any \
                libhamlib-dev \
                make \
                pkg-config \
                wget
              # The workspace is bind-mounted from the host runner; git
              # considers it "dubious" because the container runs as root.
              # Mark it safe so autorevision can read git metadata.
              git config --global --add safe.directory "${{ github.workspace }}"
              make deb-package-ci
              mkdir -p "${{ github.workspace }}/dist"
              cp ../kel-agent_*_${{ matrix.arch }}.deb "${{ github.workspace }}/dist/"
            '

      - name: Verify shared library dependencies
        run: |
          echo "==> Checking .deb contents"
          dpkg-deb -c dist/kel-agent_*_${{ matrix.arch }}.deb
          echo "==> Checking binary dependencies"
          dpkg-deb -x dist/kel-agent_*_${{ matrix.arch }}.deb /tmp/deb-extract
          ldd /tmp/deb-extract/usr/bin/kel-agent || true

      - name: Upload Debian artifact
        uses: actions/upload-artifact@v7
        with:
          name: deb-${{ matrix.arch }}
          path: dist/kel-agent_*_${{ matrix.arch }}.deb
          if-no-files-found: error

  release-flatpak:
    name: Build the Flatpak release artifact
    runs-on: ubuntu-latest
    container:
      image: bilelmoussaoui/flatpak-github-actions:freedesktop-20.08
      options: --privileged

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Mark workspace as git-safe
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Build Flatpak
        uses: bilelmoussaoui/flatpak-github-actions/flatpak-builder@v6
        with:
          bundle: kel-agent.flatpak
          manifest-path: flatpak/radio.k0swe.Kel_Agent.yml
          branch: main
          cache-key: flatpak-builder-${{ github.sha }}

      - name: Upload Flatpak artifact
        uses: actions/upload-artifact@v7
        with:
          name: flatpak
          path: kel-agent.flatpak
          if-no-files-found: error

  release-macos:
    name: Build the MacOS release artifact
    runs-on: macos-latest

    steps:
      - name: Create keychain with signing certificates
        run: |
          set -euo pipefail
          keychain=~/Library/Keychains/k0swe.keychain-db

          # Create a fresh keychain (delete first in case of reuse)
          security delete-keychain k0swe.keychain 2>/dev/null || true
          security create-keychain -p "" k0swe.keychain
          security set-keychain-settings -lut 21600 "$keychain"
          security unlock-keychain -p "" "$keychain"

          # Decode P12 and import all identities, granting access to both
          # codesign (for app binaries) and productsign (for installer pkgs)
          echo "${{ secrets.CERTIFICATES_P12 }}" | base64 -d > /tmp/certs.p12
          security import /tmp/certs.p12 -k "$keychain" \
            -P "${{ secrets.CERTIFICATES_P12_PASSWORD }}" \
            -T /usr/bin/codesign -T /usr/bin/productsign
          rm -f /tmp/certs.p12

          # Allow tools to use the keys without an interactive password prompt
          security set-key-partition-list -S apple-tool:,apple: -s -k "" "$keychain"

          # Add to the user keychain search list
          security list-keychains -d user -s "$keychain" ~/Library/Keychains/login.keychain-db

      - name: Checkout code
        uses: actions/checkout@v7

      - name: Install Go
        uses: actions/setup-go@v6
        with:
          go-version: 1.26.x

      - name: Build Hamlib
        run: |
          brew install automake libtool
          make hamlib

      - name: Test
        env:
          SKIP_INTEGRATION_TESTS: "1"
        run: make test

      - name: Set signing keychain as default
        run: security default-keychain -d user -s ~/Library/Keychains/k0swe.keychain-db

      - name: Resolve signing identities from imported certificate
        run: |
          set -euo pipefail
          keychain=~/Library/Keychains/k0swe.keychain-db

          app_identity=$(security find-identity -v -p codesigning "$keychain" | sed -n 's/.*"\(Developer ID Application:.*\)"/\1/p' | head -n1)
          installer_identity=$(security find-identity -v -p basic "$keychain" | sed -n 's/.*"\(Developer ID Installer:.*\)"/\1/p' | head -n1)

          if [ -z "$app_identity" ] || [ -z "$installer_identity" ]; then
            echo "::error::Unable to resolve Developer ID signing identities from imported certificate."
            echo "==> Available codesigning identities:"
            security find-identity -v -p codesigning "$keychain" || true
            echo "==> Available basic identities:"
            security find-identity -v -p basic "$keychain" || true
            exit 1
          fi

          echo "Resolved Developer ID Application identity."
          echo "Resolved Developer ID Installer identity."
          echo "MACOS_APP_SIGN_IDENTITY=$app_identity" >> "$GITHUB_ENV"
          echo "MACOS_INSTALL_SIGN_IDENTITY=$installer_identity" >> "$GITHUB_ENV"

      - name: Build Mac package
        run: make mac-package

      - name: Verify shared library dependencies
        run: otool -L out/macos-pkg/root/usr/local/bin/kel-agent

      - name: Notarize Mac package
        run: |
          output=$(xcrun notarytool submit kel-agent_mac.pkg \
            --apple-id "${{ secrets.APPLE_ID }}" \
            --password "${{ secrets.APPLE_APP_PASSWORD }}" \
            --team-id "${{ secrets.APPLE_TEAM_ID }}" \
            --output-format json \
            --wait)
          echo "$output"

          json_response=$(echo "$output" | tail -1)
          submission_id=$(echo "$json_response" | jq -r '.id // empty')
          status=$(echo "$json_response" | jq -r '.status // empty')

          if [ "$status" != "Accepted" ]; then
            echo "::error::Notarization status is '$status' (expected 'Accepted')"
            if [ -n "$submission_id" ]; then
              echo "==> Fetching Apple notarization log for submission $submission_id"
              xcrun notarytool log "$submission_id" \
                --apple-id "${{ secrets.APPLE_ID }}" \
                --password "${{ secrets.APPLE_APP_PASSWORD }}" \
                --team-id "${{ secrets.APPLE_TEAM_ID }}" || true
            fi
            exit 1
          fi

      - name: Staple notarization ticket
        run: xcrun stapler staple kel-agent_mac.pkg

      - name: Upload macOS artifact
        uses: actions/upload-artifact@v7
        with:
          name: macos
          path: kel-agent_mac.pkg
          if-no-files-found: error

  release-windows:
    name: Build the Windows release artifact
    runs-on: windows-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Install Go
        uses: actions/setup-go@v6
        with:
          # https://packages.debian.org/stable/golang
          go-version: 1.26.x

      - name: Install MSYS2 with MinGW64 pkg-config
        id: msys2
        # Explicitly install MSYS2 and mingw-w64-x86_64-pkgconf instead of relying on
        # whatever MSYS2 subsystems the runner image happens to pre-install.  Runner images
        # have changed which subsystems are present, causing pkg-config probing to fail.
        # PKG_CONFIG is set to the full .exe path so CGo bypasses Strawberry Perl's
        # pkg-config.bat shim that appears earlier on the default PATH and breaks CGo.
        uses: msys2/setup-msys2@v2
        with:
          msystem: MINGW64
          update: false
          install: mingw-w64-x86_64-pkgconf

      - name: Export PKG_CONFIG path
        run: |
          $msys2Location = "${{ steps.msys2.outputs.msys2-location }}"
          if (-not $msys2Location) {
            Write-Error "msys2/setup-msys2 did not expose msys2-location output"
            exit 1
          }
          Write-Host "MSYS2 location: $msys2Location"

          # pkgconf >= 1~2.0 ships as pkgconf.exe; older releases ship pkg-config.exe.
          # Search all common MSYS2 environments and fallback locations because runner
          # images have changed default install paths and available subsystems.
          $candidateBins = @(
            "$msys2Location\mingw64\bin"
            "$msys2Location\ucrt64\bin"
            "$msys2Location\clang64\bin"
            "C:\msys64\mingw64\bin"
            "D:\a\_temp\msys64\mingw64\bin"
          ) | Where-Object { Test-Path $_ } | Select-Object -Unique

          $pkgConfigExe = $null
          foreach ($bin in $candidateBins) {
            foreach ($exe in @("pkg-config.exe", "pkgconf.exe")) {
              $candidate = Join-Path $bin $exe
              if (Test-Path $candidate) {
                $pkgConfigExe = $candidate
                break
              }
            }
            if ($pkgConfigExe) { break }
          }

          if (-not $pkgConfigExe) {
            Write-Error "Neither pkg-config.exe nor pkgconf.exe found in candidate bins: $($candidateBins -join ', ')"
            exit 1
          }

          $pkgConfigBin = Split-Path $pkgConfigExe -Parent
          Write-Host "Using pkg-config from: $pkgConfigExe"
          Add-Content $env:GITHUB_PATH $pkgConfigBin
          Add-Content $env:GITHUB_ENV  "PKG_CONFIG=$pkgConfigExe"

      - name: Verify pkg-config
        run: |
          & $env:PKG_CONFIG --version

      - name: Build Hamlib
        shell: bash
        run: make hamlib

      - name: Test
        shell: bash
        run: make test

      - name: Install WiX v4
        run: dotnet tool install --global wix --version 4.*

      - name: Build Windows package
        run: |
          $env:PATH += ";$env:USERPROFILE\.dotnet\tools"
          make win-package

      - name: Upload Windows artifact
        uses: actions/upload-artifact@v7
        with:
          name: windows
          path: win/kel-agent.msi
          if-no-files-found: error

  publish:
    name: Publish release artifacts
    runs-on: ubuntu-latest
    permissions:
      contents: write
    needs:
      - release-debian
      - release-flatpak
      - release-macos
      - release-windows
    steps:
      - name: Download Debian artifacts
        uses: actions/download-artifact@v8
        with:
          path: release-artifacts
          pattern: deb-*
          merge-multiple: true

      - name: Download Flatpak artifact
        uses: actions/download-artifact@v8
        with:
          name: flatpak
          path: release-artifacts

      - name: Download macOS artifact
        uses: actions/download-artifact@v8
        with:
          name: macos
          path: release-artifacts

      - name: Download Windows artifact
        uses: actions/download-artifact@v8
        with:
          name: windows
          path: release-artifacts

      - name: List release artifacts
        run: ls -lah release-artifacts

      - name: Publish GitHub release assets
        uses: softprops/action-gh-release@v3
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: |
            release-artifacts/*.deb
            release-artifacts/kel-agent.flatpak
            release-artifacts/kel-agent_mac.pkg
            release-artifacts/kel-agent.msi
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}