name: Release to NPM & GitHub

on:
  push:
    tags:
      - 'v*'

env:
  CARGO_TERM_COLOR: always

jobs:
  # Job 1: 编译多平台CLI二进制
  build-binaries:
    name: Build CLI Binaries
    runs-on: ubuntu-latest
    strategy:
      matrix:
        target:
          - x86_64-unknown-linux-gnu
          - x86_64-pc-windows-gnu
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Install Rust targets
      run: |
        rustup target add x86_64-unknown-linux-gnu
        rustup target add x86_64-apple-darwin
        rustup target add aarch64-apple-darwin
        rustup target add x86_64-pc-windows-gnu

    - name: Build with Docker
      run: |
        docker build -f Dockerfile.build -t aiw-builder:latest .
        docker run --rm \
          -v "$(pwd):/workspace" \
          aiw-builder:latest \
          sh -c "rustup target add ${{ matrix.target }} && cargo build --release --target ${{ matrix.target }}"

    - name: Verify binary
      run: |
        if [ "${{ matrix.target }}" = "x86_64-pc-windows-gnu" ]; then
          OUTPUT_PATH="target/${{ matrix.target }}/release/aiw.exe"
        else
          OUTPUT_PATH="target/${{ matrix.target }}/release/aiw"
        fi
        file "$OUTPUT_PATH"
        ls -lah "$OUTPUT_PATH"
        echo "✅ Binary built successfully"

    - name: Upload binary artifacts
      uses: actions/upload-artifact@v4
      with:
        name: aiw-binary-${{ matrix.target }}
        path: |
          target/${{ matrix.target }}/release/aiw
          target/${{ matrix.target }}/release/aiw.exe
        retention-days: 1

  # Job 2: 准备NPM包并发布
  publish-npm:
    name: Publish to NPM
    runs-on: ubuntu-latest
    needs: build-binaries
    if: startsWith(github.ref, 'refs/tags/')

    permissions:
      contents: read
      id-token: write  # Required for npm OIDC trusted publishing

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Create bin directory
      run: mkdir -p bin

    - name: Download all binaries
      uses: actions/download-artifact@v4
      with:
        path: ./binaries

    - name: Prepare binaries for NPM
      run: |
        # 复制二进制到bin/
        cp binaries/aiw-binary-x86_64-unknown-linux-gnu/aiw bin/aiw-linux-x64
        cp binaries/aiw-binary-x86_64-pc-windows-gnu/aiw.exe bin/aiw-windows-x64.exe

        # 设置可执行权限
        chmod +x bin/*

        # 列出文件
        ls -lah bin/

    - name: Update package.json with correct version
      run: |
        VERSION=${GITHUB_REF#refs/tags/v}
        sed -i "s/\"version\": \"[^\"]*\"/\"version\": \"$VERSION\"/" package.json
        echo "✅ 发布版本: $VERSION"
        cat package.json | grep version

    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '22'
        registry-url: 'https://registry.npmjs.org'

    - name: Ensure npm version supports OIDC
      run: |
        npm install -g npm@latest
        npm --version

    - name: Publish to NPM (OIDC Trusted Publishing)
      run: npm publish --access public
      # No NPM_TOKEN needed - uses OIDC trusted publishing

    - name: 📢 Publish success notification
      if: success()
      run: |
        echo "✅ NPM包发布成功！"
        echo "Package: aiw"
        echo "Version: ${GITHUB_REF#refs/tags/v}"
        echo "Registry: https://npmjs.com/package/aiw"

  # Job 3: 发布二进制到GitHub Release
  publish-github-release:
    name: Publish GitHub Release
    runs-on: ubuntu-latest
    needs: build-binaries
    if: startsWith(github.ref, 'refs/tags/')

    permissions:
      contents: write

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Download all binaries
      uses: actions/download-artifact@v4
      with:
        path: ./binaries

    - name: Prepare release files
      run: |
        mkdir -p release-files
        cp binaries/aiw-binary-x86_64-unknown-linux-gnu/aiw release-files/aiw-linux-x64
        cp binaries/aiw-binary-x86_64-pc-windows-gnu/aiw.exe release-files/aiw-windows-x64.exe

        # 生成校验和
        cd release-files
        sha256sum * > SHA256SUMS
        cat SHA256SUMS
        ls -lah

    - name: Create GitHub Release
      uses: softprops/action-gh-release@v1
      with:
        files: |
          release-files/aiw-linux-x64
          release-files/aiw-windows-x64.exe
          release-files/SHA256SUMS
        generate_release_notes: true
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
