name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: write

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --no-frozen-lockfile

      - name: Set version from tag
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          VERSION="${GITHUB_REF#refs/tags/v}"
          pnpm pkg set version="$VERSION"

      - name: Build app
        env:
          NODE_OPTIONS: '--max-old-space-size=8192'
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: quant-jump-pro
          SENTRY_PROJECT: electron
        run: pnpm build

      - name: Create GitHub Release
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          gh release create "$TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --title "$TAG" \
            --generate-notes \
            --draft=false 2>/dev/null || echo "Release $TAG already exists, skipping creation"

      - name: Upload dist artifact
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: |
            out/renderer
            dist-electron
          retention-days: 1

  release-mac:
    needs: build
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: arm64
            runner: macos-14
            dist_command: pnpm dist:mac:arm64
          - arch: x64
            runner: macos-15-intel
            dist_command: pnpm dist:mac:x64
    runs-on: ${{ matrix.runner }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download dist artifact
        uses: actions/download-artifact@v4
        with:
          name: dist

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm

      - name: Setup Python for node-gyp
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install dependencies
        run: pnpm install --no-frozen-lockfile

      - name: Set version from tag
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          VERSION="${GITHUB_REF#refs/tags/v}"
          pnpm pkg set version="$VERSION"

      - name: Build app (macOS ${{ matrix.arch }})
        env:
          NODE_OPTIONS: '--max-old-space-size=8192'
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: quant-jump-pro
          SENTRY_PROJECT: electron
        run: pnpm build

      - name: Verify packaged inputs (macOS ${{ matrix.arch }})
        run: |
          test -f dist-electron/main/index.cjs
          test -f dist-electron/preload/index.js
          test -f out/renderer/index.html
          test -f mcp-server/dist/index.js

      - name: Package (macOS ${{ matrix.arch }})
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: ${{ matrix.dist_command }} --publish never

      - name: Upload assets to release
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          for f in release/*.dmg release/*.zip release/*.blockmap; do
            [ -f "$f" ] || continue
            echo "Uploading: $f"
            gh release upload "$TAG" "$f" --repo "$GITHUB_REPOSITORY" --clobber 2>&1 || \
              (sleep 5 && gh release upload "$TAG" "$f" --repo "$GITHUB_REPOSITORY" --clobber 2>&1) || \
              echo "WARNING: failed to upload $f, continuing..."
          done

  release-win:
    needs: build
    runs-on: windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download dist artifact
        uses: actions/download-artifact@v4
        with:
          name: dist

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm

      - name: Setup Python for node-gyp
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install dependencies
        run: pnpm install --no-frozen-lockfile

      - name: Set version from tag
        if: startsWith(github.ref, 'refs/tags/v')
        shell: bash
        run: |
          VERSION="${GITHUB_REF#refs/tags/v}"
          pnpm pkg set version="$VERSION"

      - name: Build app (Windows)
        env:
          NODE_OPTIONS: '--max-old-space-size=8192'
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: quant-jump-pro
          SENTRY_PROJECT: electron
        run: pnpm build

      - name: Verify packaged inputs (Windows)
        shell: bash
        run: |
          test -f dist-electron/main/index.cjs
          test -f dist-electron/preload/index.js
          test -f out/renderer/index.html
          test -f mcp-server/dist/index.js

      - name: Package (Windows)
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: pnpm dist:win --publish never

      - name: Upload assets to release
        if: startsWith(github.ref, 'refs/tags/v')
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          for f in release/*.exe release/*.blockmap; do
            [ -f "$f" ] || continue
            echo "Uploading: $f"
            gh release upload "$TAG" "$f" --repo "$GITHUB_REPOSITORY" --clobber 2>&1 || \
              (sleep 5 && gh release upload "$TAG" "$f" --repo "$GITHUB_REPOSITORY" --clobber 2>&1) || \
              echo "WARNING: failed to upload $f, continuing..."
          done

  release-linux:
    needs: build
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download dist artifact
        uses: actions/download-artifact@v4
        with:
          name: dist

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm

      - name: Setup Python for node-gyp
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Linux packaging dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libarchive-tools rpm

      - name: Install dependencies
        run: pnpm install --no-frozen-lockfile

      - name: Set version from tag
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          VERSION="${GITHUB_REF#refs/tags/v}"
          pnpm pkg set version="$VERSION"

      - name: Build app (Linux)
        env:
          NODE_OPTIONS: '--max-old-space-size=8192'
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: quant-jump-pro
          SENTRY_PROJECT: electron
        run: pnpm build

      - name: Verify packaged inputs (Linux)
        run: |
          test -f dist-electron/main/index.cjs
          test -f dist-electron/preload/index.js
          test -f out/renderer/index.html
          test -f mcp-server/dist/index.js

      - name: Package (Linux)
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: pnpm dist:linux --publish never

      - name: Upload assets to release
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -x
          TAG="${GITHUB_REF#refs/tags/}"
          ls -la release/ || true
          for f in release/*.AppImage release/*.deb release/*.rpm release/*.pacman release/*.blockmap; do
            [ -f "$f" ] || continue
            echo "Uploading: $f"
            gh release upload "$TAG" "$f" --repo "$GITHUB_REPOSITORY" --clobber 2>&1 || \
              (sleep 5 && gh release upload "$TAG" "$f" --repo "$GITHUB_REPOSITORY" --clobber 2>&1) || \
              echo "WARNING: failed to upload $f, continuing..."
          done

  upload-stable-links:
    needs: [release-mac, release-win, release-linux]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')

    steps:
      - name: Upload stable-named assets for /latest/download links
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${GITHUB_REF#refs/tags/v}"
          REPO="${GITHUB_REPOSITORY}"
          DOWNLOAD_BASE="https://github.com/${REPO}/releases/download/v${VERSION}"

          declare -A FILES=(
            ["Claude-Agent-Teams-UI-arm64.dmg"]="Claude.Agent.Teams.UI-${VERSION}-arm64.dmg"
            ["Claude-Agent-Teams-UI-x64.dmg"]="Claude.Agent.Teams.UI-${VERSION}.dmg"
            ["Claude-Agent-Teams-UI-Setup.exe"]="Claude.Agent.Teams.UI.Setup.${VERSION}.exe"
            ["Claude-Agent-Teams-UI.AppImage"]="Claude.Agent.Teams.UI-${VERSION}.AppImage"
            ["Claude-Agent-Teams-UI-amd64.deb"]="claude-agent-teams-ui_${VERSION}_amd64.deb"
            ["Claude-Agent-Teams-UI-x86_64.rpm"]="claude-agent-teams-ui-${VERSION}.x86_64.rpm"
            ["Claude-Agent-Teams-UI.pacman"]="claude-agent-teams-ui-${VERSION}.pacman"
          )

          # Remove old stable assets (ignore errors if they don't exist)
          for STABLE_NAME in "${!FILES[@]}"; do
            gh release delete-asset "v${VERSION}" "$STABLE_NAME" --repo "$REPO" --yes 2>/dev/null || true
          done

          # Download versioned files and re-upload with stable names
          for STABLE_NAME in "${!FILES[@]}"; do
            VERSIONED_NAME="${FILES[$STABLE_NAME]}"
            echo "Downloading ${VERSIONED_NAME} -> ${STABLE_NAME}"
            curl -fSL -o "$STABLE_NAME" "${DOWNLOAD_BASE}/${VERSIONED_NAME}" && \
              gh release upload "v${VERSION}" "$STABLE_NAME" --repo "$REPO" --clobber
            rm -f "$STABLE_NAME"
          done

      - name: Publish canonical updater metadata
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF#refs/tags/v}"
          TAG="v${VERSION}"
          REPO="${GITHUB_REPOSITORY}"
          RELEASE_DATE="$(date -u +"%Y-%m-%dT%H:%M:%S.000Z")"
          TMP_DIR="$(mktemp -d)"
          cd "$TMP_DIR"

          sha512_base64() {
            openssl dgst -sha512 -binary "$1" | openssl base64 -A
          }

          file_size() {
            wc -c < "$1" | tr -d '[:space:]'
          }

          download_asset() {
            local name="$1"
            curl -fSL -o "$name" "https://github.com/${REPO}/releases/download/${TAG}/${name}"
          }

          # Canonical Windows feed
          download_asset "Claude-Agent-Teams-UI-Setup.exe"
          WIN_SHA="$(sha512_base64 Claude-Agent-Teams-UI-Setup.exe)"
          WIN_SIZE="$(file_size Claude-Agent-Teams-UI-Setup.exe)"
          cat > latest.yml <<EOF
          version: ${VERSION}
          files:
            - url: Claude-Agent-Teams-UI-Setup.exe
              sha512: ${WIN_SHA}
              size: ${WIN_SIZE}
          path: Claude-Agent-Teams-UI-Setup.exe
          sha512: ${WIN_SHA}
          releaseDate: '${RELEASE_DATE}'
          EOF

          # Canonical Linux feed
          download_asset "Claude-Agent-Teams-UI.AppImage"
          LINUX_SHA="$(sha512_base64 Claude-Agent-Teams-UI.AppImage)"
          LINUX_SIZE="$(file_size Claude-Agent-Teams-UI.AppImage)"
          cat > latest-linux.yml <<EOF
          version: ${VERSION}
          files:
            - url: Claude-Agent-Teams-UI.AppImage
              sha512: ${LINUX_SHA}
              size: ${LINUX_SIZE}
          path: Claude-Agent-Teams-UI.AppImage
          sha512: ${LINUX_SHA}
          releaseDate: '${RELEASE_DATE}'
          EOF

          # Canonical macOS feed.
          # electron-updater consumes only one latest-mac.yml asset on GitHub releases.
          # We publish the x64 feed here because it works on Intel Macs and remains
          # installable on Apple Silicon via Rosetta until we add arch-specific feed
          # selection or universal packaging.
          download_asset "Claude.Agent.Teams.UI-${VERSION}-mac.zip"
          download_asset "Claude.Agent.Teams.UI-${VERSION}.dmg"
          MAC_ZIP_SHA="$(sha512_base64 Claude.Agent.Teams.UI-${VERSION}-mac.zip)"
          MAC_ZIP_SIZE="$(file_size Claude.Agent.Teams.UI-${VERSION}-mac.zip)"
          MAC_DMG_SHA="$(sha512_base64 Claude.Agent.Teams.UI-${VERSION}.dmg)"
          MAC_DMG_SIZE="$(file_size Claude.Agent.Teams.UI-${VERSION}.dmg)"
          cat > latest-mac.yml <<EOF
          version: ${VERSION}
          files:
            - url: Claude.Agent.Teams.UI-${VERSION}-mac.zip
              sha512: ${MAC_ZIP_SHA}
              size: ${MAC_ZIP_SIZE}
            - url: Claude.Agent.Teams.UI-${VERSION}.dmg
              sha512: ${MAC_DMG_SHA}
              size: ${MAC_DMG_SIZE}
          path: Claude.Agent.Teams.UI-${VERSION}-mac.zip
          sha512: ${MAC_ZIP_SHA}
          releaseDate: '${RELEASE_DATE}'
          EOF

          gh release upload "${TAG}" latest.yml latest-linux.yml latest-mac.yml --repo "${REPO}" --clobber