name: Desktop release

on:
  workflow_dispatch:
    inputs:
      version:
        description: Desktop version, for example 1.0.1
        required: true
        default: "1.0.1"
      release_tag:
        description: GitHub release tag for desktop artifacts
        required: true
        default: "v1.0.1"
      pdfium_tag:
        description: GitHub release tag containing Pdfium zip assets
        required: true
        default: "pdfium-desktop-v1"
      draft:
        description: Create or update the desktop release as a draft
        required: true
        default: "true"
        type: choice
        options:
          - "true"
          - "false"

permissions:
  contents: write

env:
  DESKTOP_FIREBASE_PROJECT_ID: ${{ secrets.DESKTOP_FIREBASE_PROJECT_ID }}
  DESKTOP_FIREBASE_WEB_API_KEY: ${{ secrets.DESKTOP_FIREBASE_WEB_API_KEY }}
  DESKTOP_GOOGLE_OAUTH_CLIENT_ID: ${{ secrets.DESKTOP_GOOGLE_OAUTH_CLIENT_ID }}
  DESKTOP_GOOGLE_OAUTH_CLIENT_SECRET: ${{ secrets.DESKTOP_GOOGLE_OAUTH_CLIENT_SECRET }}

jobs:
  windows-msi:
    name: Windows MSI (${{ matrix.flavor.label }})
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        flavor:
          - label: standard
            gradle: standard
          - label: oss
            gradle: oss
    steps:
      - uses: actions/checkout@v4

      - name: Configure Gradle
        shell: pwsh
        run: |
          @'
          kotlin.code.style=official
          kotlin.daemon.jvmargs=-Xmx4096M -XX:+UseG1GC -Dfile.encoding=UTF-8
          kotlin.mpp.applyDefaultHierarchyTemplate=false
          org.gradle.caching=true
          org.gradle.configuration-cache=true
          org.gradle.jvmargs=-Xmx2048M -XX:+UseG1GC -XX:MaxGCPauseMillis=200 -XX:MaxMetaspaceSize=1024m -Dfile.encoding=UTF-8
          org.gradle.workers.max=2
          '@ | Set-Content -Path gradle.properties -NoNewline -Encoding UTF8

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "21"

      - name: Download Pdfium
        shell: pwsh
        run: ./scripts/desktop/download-pdfium.ps1 -Repository "${{ github.repository }}" -Tag "${{ inputs.pdfium_tag }}"
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Install WiX
        shell: pwsh
        run: choco install wixtoolset --no-progress -y

      - name: Build MSI
        shell: pwsh
        env:
          DESKTOP_FLAVOR: ${{ matrix.flavor.gradle }}
          DESKTOP_VERSION: ${{ inputs.version }}
        run: |
          $gradleArgs = @(
            "-PdesktopOnly=true",
            "-PdesktopFlavor=$env:DESKTOP_FLAVOR",
            "-PdesktopVersion=$env:DESKTOP_VERSION",
            "-PdesktopPackageVersion=$env:DESKTOP_VERSION",
            ":desktopApp:packageReleaseMsi"
          )
          ./gradlew.bat @gradleArgs

      - name: Stage MSI
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force release-assets | Out-Null
          $source = Get-ChildItem desktopApp/build/compose/binaries/main-release/msi -Filter *.msi | Select-Object -First 1
          if ($null -eq $source) { throw "MSI output not found" }
          Copy-Item $source.FullName "release-assets/episteme-${{ matrix.flavor.label }}-${{ inputs.version }}-windows-x64.msi"

      - uses: actions/upload-artifact@v4
        with:
          name: windows-msi-${{ matrix.flavor.label }}
          path: release-assets/*

  ubuntu-deb-tar:
    name: Ubuntu DEB and tar (${{ matrix.flavor.label }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        flavor:
          - label: standard
            gradle: standard
          - label: oss
            gradle: oss
    steps:
      - uses: actions/checkout@v4

      - name: Configure Gradle
        run: |
          cat > gradle.properties <<'EOF'
          kotlin.code.style=official
          kotlin.daemon.jvmargs=-Xmx4096M -XX:+UseG1GC -Dfile.encoding=UTF-8
          kotlin.mpp.applyDefaultHierarchyTemplate=false
          org.gradle.caching=true
          org.gradle.configuration-cache=true
          org.gradle.jvmargs=-Xmx2048M -XX:+UseG1GC -XX:MaxGCPauseMillis=200 -XX:MaxMetaspaceSize=1024m -Dfile.encoding=UTF-8
          org.gradle.workers.max=2
          EOF

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "21"

      - name: Make Gradle wrapper executable
        run: chmod +x gradlew

      - name: Install packaging tools
        run: sudo apt-get update && sudo apt-get install -y fakeroot dpkg-dev binutils

      - name: Download Pdfium
        shell: pwsh
        run: ./scripts/desktop/download-pdfium.ps1 -Repository "${{ github.repository }}" -Tag "${{ inputs.pdfium_tag }}"
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Build DEB and Linux tarball
        run: >
          ./gradlew
          -PdesktopOnly=true
          -PdesktopFlavor=${{ matrix.flavor.gradle }}
          -PdesktopVersion=${{ inputs.version }}
          -PdesktopPackageVersion=${{ inputs.version }}
          :desktopApp:packageDeb
          :desktopApp:packageLinuxTar

      - name: Stage DEB and tarball
        run: |
          set -euo pipefail
          mkdir -p release-assets
          cp "$(find desktopApp/build/compose/binaries/main/deb -name '*.deb' -print -quit)" \
            "release-assets/episteme-${{ matrix.flavor.label }}-${{ inputs.version }}-linux-amd64.deb"
          cp "$(find desktopApp/build/compose/binaries/main/linux-tar -name '*.tar.gz' -print -quit)" \
            "release-assets/episteme-${{ matrix.flavor.label }}-${{ inputs.version }}-linux-x64.tar.gz"

      - uses: actions/upload-artifact@v4
        with:
          name: ubuntu-deb-tar-${{ matrix.flavor.label }}
          path: release-assets/*

  fedora-rpm:
    name: Fedora RPM (${{ matrix.flavor.label }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        flavor:
          - label: standard
            gradle: standard
          - label: oss
            gradle: oss
    steps:
      - uses: actions/checkout@v4

      - name: Configure Gradle
        run: |
          cat > gradle.properties <<'EOF'
          kotlin.code.style=official
          kotlin.daemon.jvmargs=-Xmx4096M -XX:+UseG1GC -Dfile.encoding=UTF-8
          kotlin.mpp.applyDefaultHierarchyTemplate=false
          org.gradle.caching=true
          org.gradle.configuration-cache=true
          org.gradle.jvmargs=-Xmx2048M -XX:+UseG1GC -XX:MaxGCPauseMillis=200 -XX:MaxMetaspaceSize=1024m -Dfile.encoding=UTF-8
          org.gradle.workers.max=2
          EOF

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "21"

      - name: Make Gradle wrapper executable
        run: chmod +x gradlew

      - name: Download Pdfium
        shell: pwsh
        run: ./scripts/desktop/download-pdfium.ps1 -Repository "${{ github.repository }}" -Tag "${{ inputs.pdfium_tag }}"
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Build RPM in Fedora
        run: |
          set -euo pipefail
          docker run --rm \
            -v "$PWD:/workspace" \
            -v "$JAVA_HOME:/host-jdk-21:ro" \
            -w /workspace \
            -e DESKTOP_FIREBASE_PROJECT_ID \
            -e DESKTOP_FIREBASE_WEB_API_KEY \
            -e DESKTOP_GOOGLE_OAUTH_CLIENT_ID \
            -e DESKTOP_GOOGLE_OAUTH_CLIENT_SECRET \
            fedora:44 bash -lc '
              set -euo pipefail
              dnf install -y ca-certificates findutils git rpm-build unzip which
              update-ca-trust
              export JAVA_HOME=/host-jdk-21
              export PATH="$JAVA_HOME/bin:$PATH"
              if [ -f /etc/pki/java/cacerts ]; then
                export JAVA_TOOL_OPTIONS="-Djavax.net.ssl.trustStore=/etc/pki/java/cacerts ${JAVA_TOOL_OPTIONS:-}"
              elif [ -f /etc/pki/ca-trust/extracted/java/cacerts ]; then
                export JAVA_TOOL_OPTIONS="-Djavax.net.ssl.trustStore=/etc/pki/ca-trust/extracted/java/cacerts ${JAVA_TOOL_OPTIONS:-}"
              fi
              JPACKAGE_HOME="$JAVA_HOME"
              ./gradlew \
                -PdesktopOnly=true \
                -PdesktopFlavor=${{ matrix.flavor.gradle }} \
                -PdesktopVersion=${{ inputs.version }} \
                -PdesktopPackageVersion=${{ inputs.version }} \
                -PdesktopPackagingJavaHome="$JPACKAGE_HOME" \
                :desktopApp:packageRpm
            '
          sudo chown -R "$USER:$USER" desktopApp/build

      - name: Stage RPM
        run: |
          set -euo pipefail
          mkdir -p release-assets
          cp "$(find desktopApp/build/compose/binaries/main/rpm -name '*.rpm' -print -quit)" \
            "release-assets/episteme-${{ matrix.flavor.label }}-${{ inputs.version }}-linux-x86_64.rpm"

      - uses: actions/upload-artifact@v4
        with:
          name: fedora-rpm-${{ matrix.flavor.label }}
          path: release-assets/*

  arch-package:
    name: Arch package (${{ matrix.flavor.label }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        flavor:
          - label: standard
            gradle: standard
            aur: episteme-bin
          - label: oss
            gradle: oss
            aur: episteme-oss-bin
    steps:
      - uses: actions/checkout@v4

      - name: Configure Gradle
        run: |
          cat > gradle.properties <<'EOF'
          kotlin.code.style=official
          kotlin.daemon.jvmargs=-Xmx4096M -XX:+UseG1GC -Dfile.encoding=UTF-8
          kotlin.mpp.applyDefaultHierarchyTemplate=false
          org.gradle.caching=true
          org.gradle.configuration-cache=true
          org.gradle.jvmargs=-Xmx2048M -XX:+UseG1GC -XX:MaxGCPauseMillis=200 -XX:MaxMetaspaceSize=1024m -Dfile.encoding=UTF-8
          org.gradle.workers.max=2
          EOF

      - name: Make Gradle wrapper executable
        run: chmod +x gradlew

      - name: Download Pdfium
        shell: pwsh
        run: ./scripts/desktop/download-pdfium.ps1 -Repository "${{ github.repository }}" -Tag "${{ inputs.pdfium_tag }}"
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Build Arch package
        run: |
          set -euo pipefail
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            -e DESKTOP_FIREBASE_PROJECT_ID \
            -e DESKTOP_FIREBASE_WEB_API_KEY \
            -e DESKTOP_GOOGLE_OAUTH_CLIENT_ID \
            -e DESKTOP_GOOGLE_OAUTH_CLIENT_SECRET \
            archlinux:latest bash -lc '
              set -euo pipefail
              pacman -Syu --noconfirm
              pacman -S --needed --noconfirm base-devel desktop-file-utils git jdk21-openjdk namcap unzip
              export JAVA_HOME=/usr/lib/jvm/java-21-openjdk
              export PATH="$JAVA_HOME/bin:$PATH"
              useradd -m builder
              chown -R builder:builder /workspace
              runuser -u builder -- env \
                JAVA_HOME="$JAVA_HOME" \
                PATH="$PATH" \
                DESKTOP_FIREBASE_PROJECT_ID="$DESKTOP_FIREBASE_PROJECT_ID" \
                DESKTOP_FIREBASE_WEB_API_KEY="$DESKTOP_FIREBASE_WEB_API_KEY" \
                DESKTOP_GOOGLE_OAUTH_CLIENT_ID="$DESKTOP_GOOGLE_OAUTH_CLIENT_ID" \
                DESKTOP_GOOGLE_OAUTH_CLIENT_SECRET="$DESKTOP_GOOGLE_OAUTH_CLIENT_SECRET" \
                bash -lc "cd /workspace && ./gradlew \
                -PdesktopOnly=true \
                -PdesktopFlavor=${{ matrix.flavor.gradle }} \
                -PdesktopVersion=${{ inputs.version }} \
                -PdesktopPackageVersion=${{ inputs.version }} \
                -PdesktopAurPackageRelease=1 \
                :desktopApp:prepareAurPackage && \
                cd desktopApp/build/aur/${{ matrix.flavor.aur }} && \
                makepkg -sf --cleanbuild --nodeps && \
                makepkg --printsrcinfo > .SRCINFO.generated && \
                cmp -s .SRCINFO .SRCINFO.generated && \
                pkgfile=\$(find . -maxdepth 1 -name '*.pkg.tar.zst' -print -quit) && \
                desktop_file=${{ matrix.flavor.aur }} && \
                desktop_file=\${desktop_file%-bin}.desktop && \
                tmpdir=\$(mktemp -d) && \
                bsdtar -xOf \"\$pkgfile\" \"usr/share/applications/\$desktop_file\" > \"\$tmpdir/\$desktop_file\" && \
                desktop-file-validate \"\$tmpdir/\$desktop_file\" && \
                namcap PKGBUILD && \
                namcap \"\$pkgfile\" && \
                cd /workspace && \
                mkdir -p release-assets && \
                cp \$(find desktopApp/build/aur/${{ matrix.flavor.aur }} -maxdepth 1 -name '*.pkg.tar.zst' -print -quit) \
                  release-assets/${{ matrix.flavor.aur }}-${{ inputs.version }}-1-x86_64.pkg.tar.zst && \
                ./gradlew \
                -PdesktopOnly=true \
                -PdesktopFlavor=${{ matrix.flavor.gradle }} \
                -PdesktopVersion=${{ inputs.version }} \
                -PdesktopPackageVersion=${{ inputs.version }} \
                -PdesktopAurPackageRelease=1 \
                -PdesktopAurSourceUrl=https://github.com/${{ github.repository }}/releases/download/${{ inputs.release_tag }}/episteme-${{ matrix.flavor.label }}-${{ inputs.version }}-linux-x64.tar.gz \
                :desktopApp:prepareAurPackage && \
                cd desktopApp/build/aur/${{ matrix.flavor.aur }} && \
                makepkg --printsrcinfo > .SRCINFO.generated && \
                cmp -s .SRCINFO .SRCINFO.generated"
            '
          sudo chown -R "$USER:$USER" desktopApp/build release-assets

      - name: Stage Arch package and AUR metadata
        run: |
          set -euo pipefail
          mkdir -p release-assets
          tar -C "desktopApp/build/aur/${{ matrix.flavor.aur }}" \
            -czf "release-assets/aur-${{ matrix.flavor.aur }}-${{ inputs.version }}.tar.gz" \
            PKGBUILD .SRCINFO

      - uses: actions/upload-artifact@v4
        with:
          name: arch-package-${{ matrix.flavor.label }}
          path: release-assets/*

  publish-release:
    name: Publish draft release
    runs-on: ubuntu-latest
    needs:
      - windows-msi
      - ubuntu-deb-tar
      - fedora-rpm
      - arch-package
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: downloaded-artifacts

      - name: Collect release assets
        run: |
          set -euo pipefail
          mkdir -p release-assets
          find downloaded-artifacts -type f -exec cp {} release-assets/ \;
          (cd release-assets && sha256sum * > SHA256SUMS.txt)

      - name: Create or update GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          if ! gh release view "${{ inputs.release_tag }}" --repo "${{ github.repository }}" >/dev/null 2>&1; then
            draft_flag=""
            if [ "${{ inputs.draft }}" = "true" ]; then
              draft_flag="--draft"
            fi
            gh release create "${{ inputs.release_tag }}" \
              --repo "${{ github.repository }}" \
              --title "Episteme ${{ inputs.version }}" \
              --notes "Desktop release ${{ inputs.version }}" \
              $draft_flag
          fi
          gh release upload "${{ inputs.release_tag }}" release-assets/* \
            --repo "${{ github.repository }}" \
            --clobber