# Waggle — Release Build Workflow
#
# Builds desktop apps for Windows (NSIS) and macOS (DMG) on tag push.
# Publishes artifacts as GitHub Release assets.
#
# Trigger: push tag v* (e.g., v1.0.0)
# Also supports manual dispatch for testing.

name: Release Build

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: write

jobs:
  build-windows:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: app/src-tauri

      - name: Install dependencies
        run: npm install

      - name: Build packages (shared -> core -> agent -> server)
        run: npm run build:packages

      - name: Build sidecar
        run: node scripts/build-sidecar.mjs

      - name: Bundle native dependencies
        run: node scripts/bundle-native-deps.mjs

      - name: Bundle Node.js runtime
        run: node scripts/bundle-node.mjs

      - name: Stage sidecar dependencies
        run: node scripts/stage-sidecar-deps.mjs

      - name: Build frontend
        run: cd apps/web && npx vite build

      - name: Build Tauri (Windows)
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          projectPath: app
          tagName: ${{ github.ref_name }}
          releaseName: 'Waggle ${{ github.ref_name }}'
          releaseBody: 'See the release notes for details.'
          releaseDraft: true
          prerelease: false

  build-macos:
    runs-on: macos-latest
    strategy:
      matrix:
        target: [aarch64-apple-darwin, x86_64-apple-darwin]
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: app/src-tauri

      - name: Install dependencies
        run: npm install

      - name: Build packages (shared -> core -> agent -> server)
        run: npm run build:packages

      - name: Build sidecar
        run: node scripts/build-sidecar.mjs

      - name: Bundle native dependencies
        run: node scripts/bundle-native-deps.mjs
        env:
          TARGET_ARCH: ${{ matrix.target == 'aarch64-apple-darwin' && 'arm64' || 'x64' }}

      - name: Bundle Node.js runtime
        run: node scripts/bundle-node.mjs
        env:
          TARGET_ARCH: ${{ matrix.target == 'aarch64-apple-darwin' && 'arm64' || 'x64' }}

      - name: Stage sidecar dependencies
        run: node scripts/stage-sidecar-deps.mjs
        env:
          TARGET_ARCH: ${{ matrix.target == 'aarch64-apple-darwin' && 'arm64' || 'x64' }}

      - name: Build frontend
        run: cd apps/web && npx vite build

      - name: Build Tauri (macOS)
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          projectPath: app
          tagName: ${{ github.ref_name }}
          releaseName: 'Waggle ${{ github.ref_name }}'
          releaseBody: 'See the release notes for details.'
          releaseDraft: true
          prerelease: false
          args: --target ${{ matrix.target }}

  # NOTE: the Tauri auto-updater is disabled for v1 (plugins.updater removed from
  # tauri.conf.json — see BUILD P0-2 / P1-8). The former `update-manifest` job
  # published a latest.json with EMPTY signatures, which every client rejected at
  # signature verification. Re-enabling the updater requires:
  #   1. Provision a TAURI_SIGNING_PRIVATE_KEY (+ password) repo secret.
  #   2. Restore `plugins.updater` (endpoints + pubkey) in tauri.conf.json and
  #      set bundle.createUpdaterArtifacts so tauri-action emits signed .sig files.
  #   3. Restore a latest.json generator that reads the real signatures from the
  #      build artifacts (tauri-action can publish the manifest directly).