name: "Release KétaPK"

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

jobs:
  build-tauri:
    permissions:
      contents: write
      actions: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: 'windows-latest'
            os: 'windows'
          - platform: 'macos-latest'
            os: 'macos'
          - platform: 'ubuntu-22.04'
            os: 'linux'

    runs-on: ${{ matrix.platform }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 24
          cache: 'npm'

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      # Linux dependancies
      - name: Install Linux dependencies
        if: matrix.os == 'linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev build-essential curl wget file libxdo-dev libssl-dev libayatana-appindicator3-dev librsvg2-dev

      - name: Install npm dependencies
        run: npm ci

      # ------------------------------------------------------------------------
      # BUILD TAURI (non-signed version)
      # ------------------------------------------------------------------------
      - name: Build Tauri App
        uses: tauri-apps/tauri-action@v0
        id: tauri
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tagName: v__VERSION__
          releaseName: 'KétaPK v__VERSION__'
          releaseBody: 'Rapport de release automatique KétaPK.'
          releaseDraft: true
          prerelease: false

      # ------------------------------------------------------------------------
      # WINDOWS : SIGNPATH.IO signing
      # ------------------------------------------------------------------------
      - name: Upload Unsigned Windows Artifact to GitHub
        if: matrix.os == 'windows'
        id: upload-unsigned
        uses: actions/upload-artifact@v4
        with:
          name: unsigned-ketapk-windows
          path: src-tauri/target/release/bundle/msi/*.msi

      - name: Submit Signing Request to SignPath
        if: matrix.os == 'windows'
        uses: signpath/github-action-submit-signing-request@v2
        with:
          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
          organization-id: '${{ secrets.SIGNPATH_ORGANIZATION_ID }}'
          project-slug: 'ketapk'
          signing-policy-slug: 'release-signing'
          github-artifact-id: '${{ steps.upload-unsigned.outputs.artifact-id }}'
          wait-for-completion: true
          output-artifact-directory: 'signed-windows-installer'
          github-token: '${{ secrets.GITHUB_TOKEN }}'

      # Non-signed asset replacement by signed assed on Github release
      - name: Upload Signed Windows MSI to Release
        if: matrix.os == 'windows'
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.tauri.outputs.releaseTagName }}
          files: signed-windows-installer/*.msi
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}