release.yml

name: release

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: write

jobs:
  windows-release:
    runs-on: windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: false

      - name: Setup Node.js (20 LTS)
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Setup Rust (stable)
        uses: dtolnay/rust-toolchain@stable

      - name: Install frontend dependencies
        run: npm ci

      - name: Checkout tutor core (no submodule)
        uses: actions/checkout@v4
        with:
          repository: aryanbarak/fiae-tutor-core
          path: fiae-tutor-core
          fetch-depth: 1

      - name: Export-sync tutor resources
        shell: pwsh
        run: |
          Set-StrictMode -Version Latest
          $ErrorActionPreference = 'Stop'

          python -m pip install -U pip
          python -m pip install -e .\fiae-tutor-core
          python -m fiae_tutor.export.tutor_static --out .\_build\tutor

          if (Test-Path .\src-tauri\resources\tutor\*) {
            Remove-Item -Recurse -Force .\src-tauri\resources\tutor\* -ErrorAction SilentlyContinue
          }
          New-Item -ItemType Directory -Force -Path .\src-tauri\resources\tutor | Out-Null
          Copy-Item -Recurse .\_build\tutor\* .\src-tauri\resources\tutor\

          if (!(Test-Path .\src-tauri\resources\tutor\topics)) {
            throw 'Missing topics folder after export'
          }

          Push-Location .\src-tauri\resources\tutor
          if (-not (Test-Path .\manifest.json)) { throw 'manifest.json missing after export-sync' }
          if (-not (Test-Path .\index.json)) { throw 'index.json missing after export-sync' }
          if (-not (Get-ChildItem .\topics -Directory | Select-Object -First 1)) {
            throw 'topics/* missing after export-sync'
          }
          Pop-Location

      - name: Build Tauri installers + updater metadata
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: npm run tauri build

      - name: Validate and collect release assets
        shell: pwsh
        run: |
          Set-StrictMode -Version Latest
          $ErrorActionPreference = 'Stop'

          $tag = $env:GITHUB_REF_NAME
          $version = $tag.TrimStart('v')
          $bundleRoot = Join-Path $env:GITHUB_WORKSPACE 'src-tauri\target\release\bundle'

          $nsis = Get-ChildItem (Join-Path $bundleRoot 'nsis') -Filter 'CodeZertifikat_*setup.exe' -File | Sort-Object LastWriteTime -Descending | Select-Object -First 1
          $msi = Get-ChildItem (Join-Path $bundleRoot 'msi') -Filter 'CodeZertifikat_*.msi' -File | Sort-Object LastWriteTime -Descending | Select-Object -First 1
          if (-not $nsis) { throw 'NSIS installer not found' }
          if (-not $msi) { throw 'MSI installer not found' }

          $latest = Get-ChildItem $bundleRoot -Recurse -Filter 'latest.json' -File | Select-Object -First 1
          if (-not $latest) { throw 'latest.json not found. Ensure createUpdaterArtifacts and signing env are set.' }

          $latestJson = Get-Content $latest.FullName -Raw
          if ($latestJson -notmatch ('"version"\s*:\s*"' + [regex]::Escape($version) + '"')) {
            throw "latest.json version mismatch. Expected: $version"
          }

          $sigFiles = Get-ChildItem $bundleRoot -Recurse -Filter '*.sig' -File
          if (-not $sigFiles) { throw 'No .sig signature files found' }

          $releaseDir = Join-Path $env:GITHUB_WORKSPACE 'release_assets'
          if (Test-Path $releaseDir) { Remove-Item -Recurse -Force $releaseDir }
          New-Item -ItemType Directory -Path $releaseDir | Out-Null

          Copy-Item $nsis.FullName (Join-Path $releaseDir $nsis.Name) -Force
          Copy-Item $msi.FullName (Join-Path $releaseDir $msi.Name) -Force
          Copy-Item $latest.FullName (Join-Path $releaseDir 'latest.json') -Force

          $sigOut = Join-Path $releaseDir 'signatures'
          New-Item -ItemType Directory -Path $sigOut | Out-Null
          foreach ($sig in $sigFiles) {
            Copy-Item $sig.FullName (Join-Path $sigOut $sig.Name) -Force
          }

          $shaLines = @()
          $hashTargets = @(
            (Join-Path $releaseDir $nsis.Name),
            (Join-Path $releaseDir $msi.Name),
            (Join-Path $releaseDir 'latest.json')
          ) + (Get-ChildItem $sigOut -File | Select-Object -ExpandProperty FullName)

          foreach ($f in $hashTargets) {
            $h = (Get-FileHash $f -Algorithm SHA256).Hash
            $name = [IO.Path]::GetFileName($f)
            $shaLines += "$h  $name"
          }
          Set-Content (Join-Path $releaseDir 'SHA256SUMS.txt') -Value $shaLines

          Write-Host 'Release asset list:'
          Get-ChildItem $releaseDir -Recurse -File | ForEach-Object { Write-Host $_.FullName }

      - name: Upload release assets as workflow artifact
        uses: actions/upload-artifact@v4
        with:
          name: release-assets
          path: release_assets/**
          if-no-files-found: error

      - name: Create GitHub release and upload assets
        uses: softprops/action-gh-release@v2
        with:
          files: |
            release_assets/CodeZertifikat_*setup.exe
            release_assets/CodeZertifikat_*.msi
            release_assets/latest.json
            release_assets/signatures/*.sig
            release_assets/SHA256SUMS.txt
          generate_release_notes: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}