name: Release

on:
  workflow_dispatch:

permissions:
  contents: write

concurrency:
  group: release-master
  cancel-in-progress: false

jobs:
  validate-release-branch:
    name: 校验发布分支
    runs-on: ubuntu-24.04
    steps:
      - name: 仅允许 master
        run: |
          test "$GITHUB_REF" = "refs/heads/master" || {
            echo "Release workflow 仅允许从 master 手动触发。" >&2
            exit 1
          }

  update-flake-lock:
    name: 更新 Nix 锁文件
    needs: validate-release-branch
    runs-on: ubuntu-24.04
    outputs:
      commit_sha: ${{ steps.commit.outputs.commit_sha }}
      version: ${{ steps.metadata.outputs.version }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: master
          fetch-depth: 0

      - uses: DeterminateSystems/nix-installer-action@v20

      - name: 更新 flake.lock
        run: nix flake update

      - id: commit
        name: 提交锁文件更新
        env:
          GIT_AUTHOR_NAME: github-actions[bot]
          GIT_AUTHOR_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
          GIT_COMMITTER_NAME: github-actions[bot]
          GIT_COMMITTER_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
        run: |
          if [[ -n "$(git status --porcelain -- flake.lock)" ]]; then
            git add flake.lock
            git commit -m "build: 更新 flake.lock" \
              -m "AI-assisted-by: Codex" \
              -m "AI-model: gpt-5.6-sol" \
              -m "AI-reasoning-effort: medium" \
              -m "Co-authored-by: Codex <codex@openai.com>"
            git push origin HEAD:master
          fi
          echo "commit_sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - id: metadata
        name: 读取版本与更新日志
        run: |
          version="$(node -p 'require("./package.json").version')"
          node scripts/release-metadata.mjs "$version" /tmp/release-notes.md
          echo "version=$version" >> "$GITHUB_OUTPUT"

  package-linux:
    name: ${{ matrix.arch }} deb 与 rpm
    needs: update-flake-lock
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            deb_arch: amd64
            electron_app_dir: release/linux-unpacked
            runner: ubuntu-24.04
          - arch: arm64
            deb_arch: arm64
            electron_app_dir: release/linux-arm64-unpacked
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.update-flake-lock.outputs.commit_sha }}

      - uses: pnpm/action-setup@v4
        with:
          version: 11.21.0
          run_install: false

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - name: 安装系统构建依赖
        run: |
          sudo apt-get update
          sudo apt-get install --yes \
            build-essential cmake pkg-config rpm \
            libfcitx5core-dev libfcitx5utils-dev nlohmann-json3-dev

      - name: 构建 deb 与 rpm
        env:
          TAMA_ASR_VERSION: ${{ needs.update-flake-lock.outputs.version }}
          TAMA_ASR_DEB_ARCH: ${{ matrix.deb_arch }}
          TAMA_ASR_ELECTRON_APP_DIR: ${{ matrix.electron_app_dir }}
        run: |
          pnpm install --frozen-lockfile
          pnpm run package:deb
          pnpm run package:rpm
          mkdir -p release-artifacts
          cp packaging/out/*.deb packaging/out/*.rpm release-artifacts/

      - uses: actions/upload-artifact@v4
        with:
          name: linux-packages-${{ matrix.arch }}
          path: release-artifacts/
          if-no-files-found: error

  build-nix:
    name: Nix ${{ matrix.system }}
    needs: update-flake-lock
    strategy:
      fail-fast: false
      matrix:
        include:
          - system: x86_64-linux
            runner: ubuntu-24.04
          - system: aarch64-linux
            runner: ubuntu-24.04-arm
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.update-flake-lock.outputs.commit_sha }}

      - uses: DeterminateSystems/nix-installer-action@v20

      - uses: cachix/cachix-action@v15
        with:
          name: ${{ vars.CACHIX_CACHE_NAME }}
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - name: 校验并配置 Cachix
        env:
          CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
          CACHIX_CACHE_NAME: ${{ vars.CACHIX_CACHE_NAME }}
          CACHIX_PUBLIC_KEY: ${{ vars.CACHIX_PUBLIC_KEY }}
        run: |
          test -n "$CACHIX_AUTH_TOKEN"
          test -n "$CACHIX_CACHE_NAME"
          test -n "$CACHIX_PUBLIC_KEY"
          mkdir -p "$HOME/.config/nix"
          {
            echo "extra-substituters = https://$CACHIX_CACHE_NAME.cachix.org"
            echo "extra-trusted-public-keys = $CACHIX_PUBLIC_KEY"
          } >> "$HOME/.config/nix/nix.conf"

      - name: 构建、上传并更新最新 pin
        env:
          CACHIX_CACHE_NAME: ${{ vars.CACHIX_CACHE_NAME }}
        run: |
          nix build ".#packages.${{ matrix.system }}.tama-asr"
          store_path="$(readlink -f result)"
          cachix push "$CACHIX_CACHE_NAME" "$store_path"
          cachix pin --keep-revisions 1 "$CACHIX_CACHE_NAME" \
            "tama-asr-${{ matrix.system }}" "$store_path"
          printf '%s\n' "$store_path" > "tama-asr-${{ matrix.system }}.txt"

      - uses: actions/upload-artifact@v4
        with:
          name: nix-build-${{ matrix.system }}
          path: tama-asr-${{ matrix.system }}.txt

  publish-release:
    name: 创建 GitHub Release
    needs: [update-flake-lock, package-linux, build-nix]
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.update-flake-lock.outputs.commit_sha }}
          fetch-depth: 0

      - name: 读取 release 元数据
        env:
          VERSION: ${{ needs.update-flake-lock.outputs.version }}
        run: |
          node scripts/release-metadata.mjs "$VERSION" release-notes.md
          if git ls-remote --exit-code --tags origin "refs/tags/v$VERSION"; then
            echo "标签 v$VERSION 已存在，拒绝覆盖现有 release。" >&2
            exit 1
          fi

      - uses: actions/download-artifact@v4
        with:
          pattern: linux-packages-*
          path: release
          merge-multiple: true

      - uses: actions/download-artifact@v4
        with:
          pattern: nix-build-*
          path: release
          merge-multiple: true

      - name: 附带发行元数据
        run: |
          cp flake.lock release/flake.lock
          cp packaging/arch/PKGBUILD release/PKGBUILD

      - uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ needs.update-flake-lock.outputs.version }}
          target_commitish: ${{ needs.update-flake-lock.outputs.commit_sha }}
          name: TamaASR ${{ needs.update-flake-lock.outputs.version }}
          body_path: release-notes.md
          files: release/*
          fail_on_unmatched_files: true