name: "Release KétaPK"

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

jobs:
  build-tauri:
    permissions:
      contents: write
      actions: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: 'windows-latest'
            os: 'windows'
          - platform: 'macos-latest'
            os: 'macos'
          - platform: 'ubuntu-22.04'
            os: 'linux'

    runs-on: ${{ matrix.platform }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 24
          cache: 'npm'

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      # Linux dependancies
      - name: Install Linux dependencies
        if: matrix.os == 'linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev build-essential curl wget file libxdo-dev libssl-dev libayatana-appindicator3-dev librsvg2-dev

      - name: Install npm dependencies
        run: npm ci

      # ------------------------------------------------------------------------
      # BUILD TAURI (non-signed version)
      # ------------------------------------------------------------------------
      - name: Build Tauri App
        uses: tauri-apps/tauri-action@v0
        id: tauri
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tagName: v__VERSION__
          releaseName: 'KétaPK v__VERSION__'
          releaseBody: 'Rapport de release automatique KétaPK.'
          releaseDraft: true
          prerelease: false

      # ------------------------------------------------------------------------
      # WINDOWS : SIGNPATH.IO signing
      # Disabled until SIGNPATH_API_TOKEN / SIGNPATH_ORGANIZATION_ID secrets are
      # configured. The full signing flow is preserved in
      # .github/release.yml.signpath-backup — restore it from there once the
      # SignPath key is available. Until then, tauri-action above already
      # uploads the unsigned MSI to the draft release directly.
      # ------------------------------------------------------------------------