name: Package release

on:
  workflow_call:
    secrets:
      CSC_LINK:
        required: true
      CSC_KEY_PASSWORD:
        required: true
      APPLE_ID:
        required: true
      APPLE_APP_SPECIFIC_PASSWORD:
        required: true
      APPLE_TEAM_ID:
        required: true

permissions:
  contents: read

jobs:
  build-linux:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: true
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.5

      - name: Cache dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.bun/install/cache
            node_modules
            stats/node_modules
            vendor/texthooker-ui/node_modules
            vendor/subminer-yomitan/node_modules
          key: ${{ runner.os }}-${{ runner.arch }}-bun-${{ hashFiles('bun.lock', 'stats/bun.lock', 'vendor/texthooker-ui/bun.lock', 'vendor/subminer-yomitan/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-bun-

      - name: Install dependencies
        run: |
          bun install --frozen-lockfile
          cd stats && bun install --frozen-lockfile

      - name: Build texthooker-ui
        run: |
          cd vendor/texthooker-ui
          bun install --frozen-lockfile
          bun run build

      - name: Download previous package size reports
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          mkdir -p .tmp/package-baseline
          previous=$(gh api "repos/$GITHUB_REPOSITORY/releases" --jq '[.[] | select(.draft == false and .tag_name != env.GITHUB_REF_NAME)] | sort_by(.published_at) | last | .tag_name // empty')
          if [ -n "$previous" ]; then
            gh release download "$previous" --pattern 'package-size-*.json' --dir .tmp/package-baseline || echo 'Previous release has no package size reports; size comparison will be skipped.'
          fi

      - name: Build AppImage
        run: bun run build:appimage

      - name: Build unversioned AppImage
        run: |
          shopt -s nullglob
          appimages=(release/SubMiner-*.AppImage)
          if [ "${#appimages[@]}" -eq 0 ]; then
            echo "No versioned AppImage found to create unversioned artifact."
            ls -la release
            exit 1
          fi
          cp "${appimages[0]}" release/SubMiner.AppImage

      - name: Smoke packaged runtime assets
        shell: bash
        run: xvfb-run -a bun run test:package "release/linux-unpacked/resources"

      - name: Upload AppImage artifact
        uses: actions/upload-artifact@v4
        with:
          name: appimage
          path: |
            release/*.AppImage
            release/latest*.yml
            release/*.blockmap
            release/package-size-*.json
          if-no-files-found: error

  build-macos:
    runs-on: macos-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: true
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.5

      - name: Cache dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.bun/install/cache
            node_modules
            stats/node_modules
            vendor/texthooker-ui/node_modules
            vendor/subminer-yomitan/node_modules
          key: ${{ runner.os }}-${{ runner.arch }}-bun-${{ hashFiles('bun.lock', 'stats/bun.lock', 'vendor/texthooker-ui/bun.lock', 'vendor/subminer-yomitan/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-bun-

      - name: Validate macOS signing/notarization secrets
        run: |
          missing=0
          for name in CSC_LINK CSC_KEY_PASSWORD APPLE_ID APPLE_APP_SPECIFIC_PASSWORD APPLE_TEAM_ID; do
            if [ -z "${!name}" ]; then
              echo "Missing required secret: $name"
              missing=1
            fi
          done
          if [ "$missing" -ne 0 ]; then
            echo "Set all required macOS signing/notarization secrets and rerun."
            exit 1
          fi
        env:
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

      - name: Install dependencies
        run: |
          bun install --frozen-lockfile
          cd stats && bun install --frozen-lockfile

      - name: Build texthooker-ui
        run: |
          cd vendor/texthooker-ui
          bun install --frozen-lockfile
          bun run build

      - name: Download previous package size reports
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          mkdir -p .tmp/package-baseline
          previous=$(gh api "repos/$GITHUB_REPOSITORY/releases" --jq '[.[] | select(.draft == false and .tag_name != env.GITHUB_REF_NAME)] | sort_by(.published_at) | last | .tag_name // empty')
          if [ -n "$previous" ]; then
            gh release download "$previous" --pattern 'package-size-*.json' --dir .tmp/package-baseline || echo 'Previous release has no package size reports; size comparison will be skipped.'
          fi

      - name: Build signed + notarized macOS artifacts
        run: bun run build:mac
        env:
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

      - name: Smoke packaged runtime assets
        shell: bash
        run: bun run test:package "release/mac-arm64/SubMiner.app/Contents/Resources"

      - name: Upload macOS artifacts
        uses: actions/upload-artifact@v4
        with:
          name: macos
          path: |
            release/*.dmg
            release/*.zip
            release/latest*.yml
            release/*.blockmap
            release/package-size-*.json
          if-no-files-found: error

  build-windows:
    runs-on: windows-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: true
          persist-credentials: false

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.5

      - name: Cache dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.bun/install/cache
            node_modules
            stats/node_modules
            vendor/texthooker-ui/node_modules
            vendor/subminer-yomitan/node_modules
          key: ${{ runner.os }}-${{ runner.arch }}-bun-${{ hashFiles('bun.lock', 'stats/bun.lock', 'vendor/texthooker-ui/bun.lock', 'vendor/subminer-yomitan/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-bun-

      - name: Install dependencies
        run: |
          bun install --frozen-lockfile
          cd stats && bun install --frozen-lockfile

      - name: Build texthooker-ui
        shell: powershell
        run: |
          Set-Location vendor/texthooker-ui
          bun install --frozen-lockfile
          bun run build

      - name: Download previous package size reports
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          mkdir -p .tmp/package-baseline
          previous=$(gh api "repos/$GITHUB_REPOSITORY/releases" --jq '[.[] | select(.draft == false and .tag_name != env.GITHUB_REF_NAME)] | sort_by(.published_at) | last | .tag_name // empty')
          if [ -n "$previous" ]; then
            gh release download "$previous" --pattern 'package-size-*.json' --dir .tmp/package-baseline || echo 'Previous release has no package size reports; size comparison will be skipped.'
          fi

      - name: Verify managed Windows launcher
        run: bun test src/main/runtime/managed-launcher.test.ts

      - name: Verify Windows launcher bootstrap
        run: bun test src/main/runtime/windows-launcher-bootstrap.test.ts

      - name: Build unsigned Windows artifacts
        run: bun run build:win:unsigned

      - name: Smoke packaged runtime assets
        shell: bash
        run: bun run test:package "release/win-unpacked/resources"

      - name: Upload Windows artifacts
        uses: actions/upload-artifact@v4
        with:
          name: windows
          path: |
            release/*.exe
            release/*.zip
            release/latest*.yml
            release/*.blockmap
            release/package-size-*.json
          if-no-files-found: error