waggle-os/.github/workflows/tauri-build-pr.yml

# Waggle — Tauri Build Verification (per-PR + main pushes)
#
# CC Sesija A §2.4 Task A13 (PM-reframed scope). Verifies the desktop app
# builds cleanly on Win + macOS for every PR + main push, so a regression
# can't sneak in unnoticed between releases. Distinct from release.yml
# which only triggers on `v*` tags + uploads to GitHub Releases (this
# workflow only uploads to the workflow run as artifacts for download
# verification, no release publishing).
#
# Exit signal: green CI here means tag-push to release.yml is safe to
# pull the trigger on. Red CI here = same investigation flow as release.yml
# (Rust compile / Vite build / sidecar bundle / native dep failure).

name: Tauri Build Verification

on:
  pull_request:
    branches:
      - main
    paths:
      - 'app/**'
      - 'apps/web/**'
      - 'packages/**'
      - 'scripts/**'
      - 'package.json'
      - 'package-lock.json'
      - '.github/workflows/tauri-build-pr.yml'
  push:
    branches:
      - main
    paths:
      - 'app/**'
      - 'apps/web/**'
      - 'packages/**'
      - 'scripts/**'
      - 'package.json'
      - 'package-lock.json'
  workflow_dispatch:

jobs:
  verify-windows:
    runs-on: windows-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: app/src-tauri

      - name: Install dependencies
        run: npm install

      - name: Build packages (shared → core → agent → server)
        run: npm run build:packages

      - name: Build sidecar
        run: node scripts/build-sidecar.mjs

      - name: Bundle native dependencies
        run: node scripts/bundle-native-deps.mjs

      - name: Bundle Node.js runtime
        run: node scripts/bundle-node.mjs

      - name: Stage sidecar dependencies
        run: node scripts/stage-sidecar-deps.mjs

      - name: Build frontend
        run: cd apps/web && npx vite build

      - name: Build Tauri (Windows)
        # @tauri-apps/cli is declared in app/package.json devDeps but is absent
        # from package-lock.json, so `npm install` never installs it and a bare
        # `npx tauri` errors "could not determine executable to run". Fetch the
        # CLI explicitly by package name (npx resolves the win32 binary).
        run: cd app && npx --yes @tauri-apps/cli@2 build
        env:
          # Skip code signing for PR verification — release.yml handles signing
          # only on tag push.
          TAURI_PRIVATE_KEY: ''
          TAURI_KEY_PASSWORD: ''

      - name: Upload Windows artifacts
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: waggle-windows-${{ github.sha }}
          path: |
            app/src-tauri/target/release/bundle/nsis/*.exe
            app/src-tauri/target/release/bundle/msi/*.msi
          if-no-files-found: warn
          retention-days: 7

  verify-macos:
    runs-on: macos-latest
    timeout-minutes: 60
    strategy:
      # Per-arch, matching release.yml. Universal builds are rejected by the
      # bundle scripts (sqlite-vec / onnxruntime / node ship per-arch binaries),
      # so each arch is staged and built separately.
      matrix:
        target: [aarch64-apple-darwin, x86_64-apple-darwin]
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: app/src-tauri

      - name: Install dependencies
        run: npm install

      - name: Build packages (shared → core → agent → server)
        run: npm run build:packages

      - name: Build sidecar
        run: node scripts/build-sidecar.mjs

      - name: Bundle native dependencies
        run: node scripts/bundle-native-deps.mjs
        env:
          TARGET_ARCH: ${{ matrix.target == 'aarch64-apple-darwin' && 'arm64' || 'x64' }}

      - name: Bundle Node.js runtime
        run: node scripts/bundle-node.mjs
        env:
          TARGET_ARCH: ${{ matrix.target == 'aarch64-apple-darwin' && 'arm64' || 'x64' }}

      - name: Stage sidecar dependencies
        run: node scripts/stage-sidecar-deps.mjs
        env:
          TARGET_ARCH: ${{ matrix.target == 'aarch64-apple-darwin' && 'arm64' || 'x64' }}

      - name: Build frontend
        run: cd apps/web && npx vite build

      - name: Build Tauri (macOS ${{ matrix.target }})
        # See verify-windows note: fetch @tauri-apps/cli by package name (absent
        # from the lockfile). Built per-arch — universal is rejected by the
        # bundle scripts (per-arch native modules), matching release.yml.
        run: cd app && npx --yes @tauri-apps/cli@2 build --target ${{ matrix.target }}
        env:
          TAURI_PRIVATE_KEY: ''
          TAURI_KEY_PASSWORD: ''

      - name: Upload macOS artifacts
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: waggle-macos-${{ matrix.target }}-${{ github.sha }}
          path: |
            app/src-tauri/target/${{ matrix.target }}/release/bundle/dmg/*.dmg
            app/src-tauri/target/${{ matrix.target }}/release/bundle/macos/*.app
          if-no-files-found: warn
          retention-days: 7