name: rc

# Release-candidate desktop builds for stabilization: every push to a
# release/** branch builds the app matrix and uploads rc-* artifacts.
# Core's RC Docker images come from the core repo's own rc.yml; final
# signed/notarized releases still come from release.yml on tag push.
on:
  push:
    branches: ['release/**']
  workflow_dispatch:

permissions:
  contents: read

# One build per branch at a time; a newer push supersedes an in-flight one.
concurrency:
  group: rc-${{ github.ref }}
  cancel-in-progress: true

jobs:
  setup:
    runs-on: ubuntu-latest
    outputs:
      date: ${{ steps.date.outputs.date }}
      version: ${{ steps.version.outputs.version }}

    steps:
      - name: Get date
        id: date
        run: echo "date=$(date -u +%Y%m%d)" >> "$GITHUB_OUTPUT"

      - name: Derive version from branch name
        id: version
        run: |
          # release/v0.3.0 -> 0.3.0 (tolerate a missing v prefix too)
          version="${GITHUB_REF_NAME#release/}"
          version="${version#v}"
          echo "version=$version" >> "$GITHUB_OUTPUT"

  build:
    needs: setup
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-22.04
            platform: linux
            arch: x64
          - os: macos-14
            platform: mac
            arch: arm64
          - os: windows-latest
            platform: win
            arch: x64

    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Read build configuration
        id: config
        shell: bash
        run: |
          NODE_VERSION=$(node -p "require('./.build-config.json').versions.node")
          PYTHON_VERSION=$(node -p "require('./.build-config.json').versions.python")
          echo "node=$NODE_VERSION" >> $GITHUB_OUTPUT
          echo "python=$PYTHON_VERSION" >> $GITHUB_OUTPUT
          echo "Node ${NODE_VERSION}, Python ${PYTHON_VERSION}"

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ steps.config.outputs.node }}

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ steps.config.outputs.python }}

      # macOS: import signing cert so build-macos.sh can codesign the .app.
      # RC builds are signed but not notarized (same as nightlies) — testers
      # clear Gatekeeper with `xattr -dr com.apple.quarantine <app>.app`.
      # Graceful fallback: no-op when secrets are absent.
      - name: Import Apple signing certificate
        if: matrix.platform == 'mac'
        env:
          APPLE_CERTIFICATE_P12_BASE64: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          set -euo pipefail
          if [[ -z "${APPLE_CERTIFICATE_P12_BASE64:-}" ]]; then
              echo "APPLE_CERTIFICATE_P12_BASE64 not set — skipping (unsigned build)"
              exit 0
          fi
          printf '%s' "$APPLE_CERTIFICATE_P12_BASE64" | base64 --decode > "$RUNNER_TEMP/cert.p12"
          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
          security set-keychain-settings -lut 21600 build.keychain
          security list-keychains -d user -s build.keychain login.keychain-db
          security import "$RUNNER_TEMP/cert.p12" -k build.keychain \
              -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list \
              -S apple-tool:,apple:,codesign: \
              -s -k "$KEYCHAIN_PASSWORD" build.keychain
          rm -f "$RUNNER_TEMP/cert.p12"
          security find-identity -v -p codesigning build.keychain | grep -q "Developer ID Application"

      - name: Build
        run: ./scripts/build-release.sh
        shell: bash
        env:
          # PAT with read access to the private got-feedback repos so
          # build-common.sh can clone core + the bundled plugins.
          GH_CLONE_TOKEN: ${{ secrets.FEEDBACK_CLONE_TOKEN }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          # No notarization for RC builds — testers use xattr -dr com.apple.quarantine
          CSC_FOR_PULL_REQUEST: "true"

      # macOS: zip the .app for tester distribution (same as nightly.yml).
      - name: Zip macOS app
        if: matrix.platform == 'mac'
        shell: bash
        run: |
          set -euo pipefail
          app=$(ls -d release/mac*/*.app 2>/dev/null | head -n1 || true)
          if [[ -z "${app:-}" || ! -d "$app" ]]; then
            echo "::error::No .app bundle found under release/mac*/"
            exit 1
          fi
          name=$(basename "$app" .app)
          ditto -c -k --sequesterRsrc --keepParent "$app" "release/${name}-macos-arm64.zip"
          echo "Zipped $app -> release/${name}-macos-arm64.zip"

      # Windows: electron-builder's `dir` target leaves win-unpacked/ with no
      # packaged installer (Velopack is skipped for RC builds). Zip the directory
      # so testers can download and extract, then launch the app .exe directly.
      - name: Zip win-unpacked
        if: matrix.platform == 'win'
        shell: pwsh
        run: |
          Compress-Archive -Path release\win-unpacked\* -DestinationPath release\feedback-windows-x64.zip
          Write-Host "Zipped win-unpacked -> release\feedback-windows-x64.zip"

      - name: Clean up signing keychain
        if: always() && matrix.platform == 'mac'
        run: |
          security delete-keychain build.keychain 2>/dev/null || true

      - name: Upload RC artifacts
        uses: actions/upload-artifact@v4
        with:
          name: rc-${{ needs.setup.outputs.version }}-${{ needs.setup.outputs.date }}-${{ matrix.platform }}-${{ matrix.arch }}
          path: |
            release/*.AppImage
            release/*.deb
            release/*.zip
            build/Release/*.pdb
          if-no-files-found: warn
          retention-days: 14