Lumotia/.github/workflows/build.yml

# Cross-platform release build. Produces installer artifacts for
# Linux (.AppImage + .deb), Windows (.msi + .exe), macOS (.dmg + .app).
#
# Triggers:
# - Manual: any branch via "Run workflow" in the GitHub Actions UI.
#   Use this to build a Windows binary on demand to dual-boot test.
# - Tag push (v*): builds + drafts a GitHub Release with all artifacts
#   attached. Tag a release with `git tag v0.2.0 && git push --tags`.
#
# Artifacts:
# - workflow_dispatch builds: uploaded as Action artifacts
#   (visible in the run page, downloadable for 30 days).
# - tag builds: attached to a draft GitHub Release named after the tag.
#   Promote the draft to a release when ready.
#
# Signing:
# - macOS code-signing not configured. The .dmg will trigger Gatekeeper
#   warnings on the first run; users will need to right-click → Open.
#   To wire signing later, set APPLE_SIGNING_IDENTITY +
#   APPLE_CERTIFICATE secrets and uncomment the env block.
# - Windows code-signing not configured. The .exe/.msi will trigger
#   SmartScreen warnings on first run. To wire signing later, set
#   WINDOWS_CERTIFICATE + WINDOWS_CERTIFICATE_PASSWORD secrets.
name: build

on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      tag_name:
        description: 'Optional tag name to attach the build to (leave blank for plain artifacts)'
        required: false

concurrency:
  group: build-${{ github.ref }}
  cancel-in-progress: false  # let release builds finish even on tag re-pushes

jobs:
  build:
    name: build (${{ matrix.os }})
    permissions:
      contents: write  # needed to create draft releases on tag pushes
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-22.04
            artifact_glob: |
              src-tauri/target/release/bundle/appimage/*.AppImage
              src-tauri/target/release/bundle/deb/*.deb
          - os: windows-latest
            artifact_glob: |
              src-tauri/target/release/bundle/msi/*.msi
              src-tauri/target/release/bundle/nsis/*.exe
          - os: macos-latest
            artifact_glob: |
              src-tauri/target/release/bundle/dmg/*.dmg
              src-tauri/target/release/bundle/macos/*.app
    runs-on: ${{ matrix.os }}
    timeout-minutes: 60

    steps:
      - uses: actions/checkout@v4

      # System packages — same as check.yml but locked to release-build needs.
      - name: Install Linux deps
        if: matrix.os == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libwebkit2gtk-4.1-dev \
            libappindicator3-dev \
            librsvg2-dev \
            libasound2-dev \
            libudev-dev \
            patchelf \
            cmake \
            build-essential

      - name: Install macOS deps
        if: matrix.os == 'macos-latest'
        run: |
          brew list cmake >/dev/null 2>&1 || brew install cmake

      - name: Install Windows deps
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: |
          cmake --version
          choco install -y llvm --no-progress

      - name: Install Node
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      # Workspace is at the repo root; target dir is ./target (not
      # src-tauri/target). See note in check.yml for details.
      - name: Cache Rust
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: .
          shared-key: kon-build-${{ matrix.os }}

      - name: Install JS deps
        run: npm ci

      # tauri-action handles `tauri build` plus, on tag pushes, attaches
      # artifacts to a GitHub draft release. Empty tagName disables the
      # release-creation behaviour for manual workflow_dispatch runs.
      - name: Build (release)
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Uncomment when signing certs are configured in repo secrets:
          # APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          # APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          # APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          # WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
          # WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
        with:
          # If pushed as a tag, use the tag name; otherwise leave empty
          # so tauri-action builds artifacts but does not touch releases.
          tagName: ${{ github.ref_type == 'tag' && github.ref_name || (inputs.tag_name || '') }}
          releaseName: ${{ github.ref_type == 'tag' && github.ref_name || (inputs.tag_name || '') }}
          releaseDraft: true
          prerelease: false
          # Build all bundle types the OS supports.
          args: ''

      # Always upload as an Actions artifact too — accessible from the
      # workflow run page even if the release-creation step was skipped.
      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: kon-${{ matrix.os }}-${{ github.sha }}
          path: ${{ matrix.artifact_glob }}
          retention-days: 30
          if-no-files-found: warn