name: Release

on:
  release:
    types: [created]

permissions:
  id-token: write # Required for OIDC
  contents: read

jobs:
  frontend-build:
    name: Frontend Build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: template

    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build
        run: bun run turbo -- build --ui=stream

      - name: Upload dist artifact
        uses: actions/upload-artifact@v4
        with:
          name: frontend-dist
          path: template/dist/
          if-no-files-found: error

  build:
    name: Build (${{ matrix.target }})
    needs: frontend-build
    runs-on: ${{ matrix.runner }}

    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-musl
            runner: ubuntu-latest
            use_cross: false
            archive_ext: tar.gz
            npm_dir: linux-x64
            bin_name: piccali-cli

          - target: aarch64-unknown-linux-musl
            runner: ubuntu-latest
            use_cross: true
            archive_ext: tar.gz
            npm_dir: linux-arm64
            bin_name: piccali-cli

          - target: aarch64-apple-darwin
            runner: macos-latest
            use_cross: false
            archive_ext: tar.gz
            npm_dir: darwin-arm64
            bin_name: piccali-cli

          - target: x86_64-pc-windows-msvc
            runner: windows-latest
            use_cross: false
            archive_ext: zip
            npm_dir: win32-x64
            bin_name: piccali-cli.exe

    steps:
      - uses: actions/checkout@v4

      - name: Download frontend dist
        uses: actions/download-artifact@v4
        with:
          name: frontend-dist
          path: template/dist/

      - uses: oven-sh/setup-bun@v2

      - name: Install Bun dependencies
        run: bun install --frozen-lockfile
        working-directory: template

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}

      - name: Install musl tools
        if: contains(matrix.target, 'musl') && !matrix.use_cross
        run: sudo apt-get update && sudo apt-get install -y musl-tools

      - name: Install cross
        if: matrix.use_cross
        uses: taiki-e/install-action@v2
        with:
          tool: cross

      - name: Build (native)
        if: "!matrix.use_cross"
        run: cargo build --release --target ${{ matrix.target }}

      - name: Build (cross)
        if: matrix.use_cross
        run: cross build --release --target ${{ matrix.target }}

      # --- Package Linux / macOS ---
      - name: Package (tar.gz)
        if: matrix.archive_ext == 'tar.gz'
        shell: bash
        run: |
          BIN=target/${{ matrix.target }}/release/piccali-cli
          ARCHIVE=piccali-cli-${{ github.ref_name }}-${{ matrix.target }}.tar.gz
          tar -czf "$ARCHIVE" -C "$(dirname "$BIN")" "$(basename "$BIN")"
          echo "ARCHIVE=$ARCHIVE" >> "$GITHUB_ENV"

      # --- Package Windows ---
      - name: Package (zip)
        if: matrix.archive_ext == 'zip'
        shell: pwsh
        run: |
          $bin = "target\${{ matrix.target }}\release\piccali-cli.exe"
          $archive = "piccali-cli-${{ github.ref_name }}-${{ matrix.target }}.zip"
          Compress-Archive -Path $bin -DestinationPath $archive
          "ARCHIVE=$archive" | Out-File -FilePath $env:GITHUB_ENV -Append

      - name: Upload archive artifact
        uses: actions/upload-artifact@v4
        with:
          name: archive-${{ matrix.target }}
          path: ${{ env.ARCHIVE }}
          if-no-files-found: error

      # --- Copy binary into npm platform package for publishing ---
      - name: Stage binary for npm (Unix)
        if: matrix.archive_ext == 'tar.gz'
        shell: bash
        run: |
          cp target/${{ matrix.target }}/release/${{ matrix.bin_name }} \
             package/npm/${{ matrix.npm_dir }}/${{ matrix.bin_name }}
          chmod +x package/npm/${{ matrix.npm_dir }}/${{ matrix.bin_name }}

      - name: Stage binary for npm (Windows)
        if: matrix.archive_ext == 'zip'
        shell: pwsh
        run: |
          Copy-Item "target\${{ matrix.target }}\release\${{ matrix.bin_name }}" `
            -Destination "package\npm\${{ matrix.npm_dir }}\${{ matrix.bin_name }}"

      - name: Upload npm platform artifact
        uses: actions/upload-artifact@v4
        with:
          name: npm-${{ matrix.npm_dir }}
          path: package/npm/${{ matrix.npm_dir }}/
          if-no-files-found: error

  upload-release-assets:
    name: Upload release assets
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          pattern: archive-*
          path: artifacts
          merge-multiple: true

      - name: Upload assets to GitHub release
        uses: softprops/action-gh-release@v2
        with:
          files: artifacts/**

  publish-crate:
    name: Publish to crates.io
    needs: frontend-build
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Download frontend dist
        uses: actions/download-artifact@v4
        with:
          name: frontend-dist
          path: template/dist/

      - uses: oven-sh/setup-bun@v2

      - name: Install Bun dependencies
        run: bun install --frozen-lockfile
        working-directory: template

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - name: Publish
        run: cargo publish --no-verify --token ${{ secrets.CARGO_REGISTRY_TOKEN }}

  publish-npm:
    name: Publish to npm
    needs: build
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2

      - uses: actions/setup-node@v4
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      # Download all per-platform binaries staged by the build jobs
      - name: Download linux-x64 binary
        uses: actions/download-artifact@v4
        with:
          name: npm-linux-x64
          path: package/npm/linux-x64/

      - name: Download linux-arm64 binary
        uses: actions/download-artifact@v4
        with:
          name: npm-linux-arm64
          path: package/npm/linux-arm64/

      - name: Download darwin-arm64 binary
        uses: actions/download-artifact@v4
        with:
          name: npm-darwin-arm64
          path: package/npm/darwin-arm64/

      - name: Download win32-x64 binary
        uses: actions/download-artifact@v4
        with:
          name: npm-win32-x64
          path: package/npm/win32-x64/

      # Bump versions in all package.json files to match the git tag
      - name: Set version from tag
        run: bun run package/scripts/set-version.ts "${{ github.ref_name }}"

      # Publish platform packages first (the wrapper depends on them)
      - name: Publish @piccali/linux-x64
        run: npm publish --access public
        working-directory: package/npm/linux-x64
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish @piccali/linux-arm64
        run: npm publish --access public
        working-directory: package/npm/linux-arm64
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish @piccali/darwin-arm64
        run: npm publish --access public
        working-directory: package/npm/darwin-arm64
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish @piccali/win32-x64
        run: npm publish --access public
        working-directory: package/npm/win32-x64
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      # Publish the main wrapper package last
      - name: Publish piccali-cli
        run: npm publish --access public
        working-directory: package
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
