name: Modrinth App build
on:
  push:
    branches:
      - main
    tags:
      - 'v*'
    paths:
      - .github/workflows/theseus-build.yml
      - 'apps/app/**'
      - 'apps/app-frontend/**'
      - 'packages/app-lib/**'
      - 'packages/app-macros/**'
      - 'packages/assets/**'
      - 'packages/ui/**'
      - 'packages/utils/**'
  workflow_dispatch:
    inputs:
      sign-windows-binaries:
        description: Sign Windows binaries
        type: boolean
        default: false
        required: false
      environment:
        description: Environment
        type: choice
        options:
          - prod
          - staging
          - prod-with-staging-archon
        default: prod
        required: false
      app-version-override:
        description: Temporary app version override for updater testing
        type: string
        required: false

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/prod' }}

jobs:
  build:
    name: Build
    env:
      VITE_STRIPE_PUBLISHABLE_KEY: pk_live_51JbFxJJygY5LJFfKLVVldb10HlLt24p421OWRsTOWc5sXYFOnFUXWieSc6HD3PHo25ktx8db1WcHr36XGFvZFVUz00V9ixrCs5
      RUSTC_WRAPPER: 'sccache'
    strategy:
      fail-fast: false
      matrix:
        platform:
          [
            namespace-profile-medium-amd64-macos,
            namespace-profile-medium-amd64-windows,
            namespace-profile-medium-amd64,
          ]
        include:
          - platform: namespace-profile-medium-amd64-macos
            artifact-target-name: universal-apple-darwin
          - platform: namespace-profile-medium-amd64-windows
            artifact-target-name: x86_64-pc-windows-msvc
          - platform: namespace-profile-medium-amd64
            artifact-target-name: x86_64-unknown-linux-gnu

    runs-on: ${{ matrix.platform }}

    steps:
      - name: Check out code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Setup Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
        with:
          rustflags: ''
          target: ${{ contains(matrix.platform, 'macos') && 'x86_64-apple-darwin' || '' }}

      - name: Setup mold
        if: contains(matrix.platform, 'ubuntu')
        uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1 / Mold 2.41.0

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .nvmrc

      - name: Enable Corepack
        run: corepack enable

      - name: Set up caches
        if: contains(matrix.platform, 'ubuntu') || contains(matrix.platform, 'macos')
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          cache: |
            rust
            pnpm

      - name: Configure sccache
        if: contains(matrix.platform, 'ubuntu') || contains(matrix.platform, 'macos')
        run: nsc cache sccache setup --cache_name default >> "$GITHUB_ENV"

      - name: Generate tauri-dev.conf.json
        shell: bash
        run: |
          GIT_HASH=$(git rev-parse --short HEAD)
          cat > apps/app/tauri-dev.conf.json <<EOF
          {
            "productName": "Modrinth App (dev-${GIT_HASH})",
            "mainBinaryName": "Modrinth App (dev-${GIT_HASH})",
            "identifier": "ModrinthApp-dev-${GIT_HASH}",
            "bundle": {
              "fileAssociations": []
            }
          }
          EOF

      - name: Install Linux build dependencies
        if: contains(matrix.platform, 'ubuntu')
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev

      - name: Setup Java
        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
        with:
          distribution: temurin
          java-version: 17

      - name: Setup Dasel
        uses: jaxxstorm/action-install-gh-release@25e24d2d23ae098373794ef1d6faecb48ee52da8 # v3.0.0
        with:
          repo: TomWright/dasel
          tag: v2.8.1
          extension-matching: disable
          rename-to: ${{ contains(matrix.platform, 'windows') && 'dasel.exe' || 'dasel' }}
          chmod: 0755

      - name: Set application version and environment
        shell: bash
        run: |
          APP_VERSION="${{ inputs.app-version-override }}"
          if [ -z "$APP_VERSION" ]; then
            APP_VERSION="$(git describe --tags --always | sed -E 's/-([0-9]+)-(g[0-9a-fA-F]+)$/-canary+\1.\2/')"
          fi
          BUILD_ENVIRONMENT="${{ inputs.environment || 'prod' }}"
          echo "Setting application version to $APP_VERSION"
          echo "Using environment $BUILD_ENVIRONMENT"
          dasel put -f apps/app/Cargo.toml -t string -v "${APP_VERSION#v}" 'package.version'
          dasel put -f packages/app-lib/Cargo.toml -t string -v "${APP_VERSION#v}" 'package.version'
          dasel put -f apps/app-frontend/package.json -t string -v "${APP_VERSION#v}" 'version'

          cp "packages/app-lib/.env.${BUILD_ENVIRONMENT}" packages/app-lib/.env

      - name: Install dependencies
        run: pnpm install

      - name: Set up Windows code signing
        if: contains(matrix.platform, 'windows')
        shell: bash
        run: |
          if [ '${{ startsWith(github.ref, 'refs/tags/v') || inputs.sign-windows-binaries }}' = 'true' ]; then
            choco install jsign --ignore-dependencies # GitHub runners come with a global Java installation already
          else
            dasel delete -f apps/app/tauri-release.conf.json 'bundle.windows.signCommand'
          fi

      - name: Build macOS app
        run: ${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') || inputs.app-version-override != '') && 'pnpm --filter=@modrinth/app run tauri build --target universal-apple-darwin --config tauri-release.conf.json' || 'pnpm --filter=@modrinth/app run tauri build --target universal-apple-darwin --config tauri-dev.conf.json' }}
        if: contains(matrix.platform, 'macos')
        env:
          TAURI_BUNDLER_DMG_IGNORE_CI: 'true'
          ENABLE_CODE_SIGNING: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}

      - name: Build Linux app
        run: ${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') || inputs.app-version-override != '') && 'pnpm --filter=@modrinth/app run tauri build --config tauri-release.conf.json' || 'pnpm --filter=@modrinth/app run tauri build --config tauri-dev.conf.json' }}
        if: contains(matrix.platform, 'ubuntu')
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}

      - name: Build Windows app
        run: |
          [System.Convert]::FromBase64String("$env:DIGICERT_ONE_SIGNER_CLIENT_CERTIFICATE_BASE64") | Set-Content -Path signer-client-cert.p12 -AsByteStream
          $env:DIGICERT_ONE_SIGNER_CREDENTIALS = "$env:DIGICERT_ONE_SIGNER_API_KEY|$PWD\signer-client-cert.p12|$env:DIGICERT_ONE_SIGNER_CLIENT_CERTIFICATE_PASSWORD"
          $env:JAVA_HOME = "$env:JAVA_HOME_17_X64"
          ${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') || inputs.app-version-override != '') && 'pnpm --filter=@modrinth/app run tauri build --config tauri-release.conf.json --verbose --bundles "nsis,updater"' || 'pnpm --filter=@modrinth/app run tauri build --config tauri-dev.conf.json --verbose --bundles "nsis,updater"' }}
          Remove-Item -Path signer-client-cert.p12 -ErrorAction SilentlyContinue
        if: contains(matrix.platform, 'windows')
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
          DIGICERT_ONE_SIGNER_API_KEY: ${{ secrets.DIGICERT_ONE_SIGNER_API_KEY }}
          DIGICERT_ONE_SIGNER_CLIENT_CERTIFICATE_BASE64: ${{ secrets.DIGICERT_ONE_SIGNER_CLIENT_CERTIFICATE_BASE64 }}
          DIGICERT_ONE_SIGNER_CLIENT_CERTIFICATE_PASSWORD: ${{ secrets.DIGICERT_ONE_SIGNER_CLIENT_CERTIFICATE_PASSWORD }}

      - name: Upload app bundles
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: App bundle (${{ matrix.artifact-target-name }})
          path: |
            target/release/bundle/appimage/Modrinth App_*.AppImage*
            target/release/bundle/deb/Modrinth App_*.deb*
            target/release/bundle/rpm/Modrinth App-*.rpm*
            target/release/bundle/appimage/Modrinth App (dev-*)_*.AppImage*
            target/release/bundle/deb/Modrinth App (dev-*)_*.deb*
            target/release/bundle/rpm/Modrinth App (dev-*)-*.rpm*
            target/universal-apple-darwin/release/bundle/macos/Modrinth App.app.tar.gz*
            target/universal-apple-darwin/release/bundle/macos/Modrinth App (dev-*)*.app.tar.gz
            target/universal-apple-darwin/release/bundle/dmg/Modrinth App (dev-*)*.dmg
            target/universal-apple-darwin/release/bundle/dmg/Modrinth App_*.dmg*
            target/release/bundle/nsis/Modrinth App_*-setup.exe*
            target/release/bundle/nsis/Modrinth App (dev-*)_*-setup.exe*
            target/release/bundle/nsis/Modrinth App_*-setup.nsis.zip*