name: Release Binaries

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            name: tina4-linux-amd64
          - target: x86_64-apple-darwin
            os: macos-latest
            name: tina4-darwin-amd64
          - target: aarch64-apple-darwin
            os: macos-latest
            name: tina4-darwin-arm64
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            name: tina4-windows-amd64.exe

    runs-on: ${{ matrix.os }}

    env:
      SIGN_ENABLED: ${{ secrets.CERT_THUMBPRINT }}

    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install cross-compilation tools (Linux ARM)
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        run: |
          sudo apt-get update
          sudo apt-get install -y gcc-aarch64-linux-gnu

      - name: Build
        run: cargo build --release --target ${{ matrix.target }}
        env:
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc

      - name: Rename binary (Unix)
        if: runner.os != 'Windows'
        run: cp target/${{ matrix.target }}/release/tina4 ${{ matrix.name }}

      - name: Rename binary (Windows)
        if: runner.os == 'Windows'
        run: cp target/${{ matrix.target }}/release/tina4.exe ${{ matrix.name }}

      - name: Install SimplySign Desktop (Windows)
        if: runner.os == 'Windows' && env.SIGN_ENABLED != ''
        shell: powershell
        run: |
          Write-Host "Downloading SimplySign Desktop..."
          $installerUrl = "https://simplysign.certum.eu/downloads/SimplySignDesktop-latest.msi"
          $installerPath = "$env:RUNNER_TEMP\SimplySignDesktop.msi"
          Invoke-WebRequest -Uri $installerUrl -OutFile $installerPath -UseBasicParsing
          Write-Host "Installing SimplySign Desktop..."
          Start-Process msiexec.exe -ArgumentList "/i", $installerPath, "/quiet", "/norestart" -Wait
          Write-Host "SimplySign Desktop installed"

      - name: Sign Windows binary
        if: runner.os == 'Windows' && env.SIGN_ENABLED != ''
        shell: powershell
        env:
          SIMPLYSIGN_OTP_URI: ${{ secrets.SIMPLYSIGN_OTP_URI }}
          CERT_THUMBPRINT: ${{ secrets.CERT_THUMBPRINT }}
          SIMPLYSIGN_EXE_PATH: "C:\\Program Files\\Certum\\SimplySign Desktop\\SimplySignDesktop.exe"
          SIGN_TARGET: ${{ matrix.name }}
        run: |
          .\scripts\sign-windows.ps1

      - name: Upload to Release
        uses: softprops/action-gh-release@v2
        with:
          files: ${{ matrix.name }}

  publish-crate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Publish to crates.io
        run: cargo publish || echo "Already published — skipping"
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_IO_TOKEN }}
