deploy-release.yml

name: Deploy Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to deploy (e.g., 1.1.0)'
        required: true
        type: string

permissions:
  contents: write
  actions: read

jobs:
  deploy-mac:
    name: Build & Deploy macOS
    runs-on: macos-latest
    environment:
      name: production
      url: https://github.com/${{ github.repository }}/releases/tag/v${{ inputs.version }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: v${{ inputs.version }}
          fetch-depth: 1
          token: ${{ secrets.GITHUB_TOKEN }}
          submodules: false

      - name: Verify release tag exists
        run: |
          git fetch --tags --depth=1
          if ! git rev-parse "v${{ inputs.version }}" >/dev/null 2>&1; then
            echo "❌ Release tag v${{ inputs.version }} not found!"
            echo "Available tags:"
            git tag | grep "^v" | sort -V | tail -10
            exit 1
          fi
          echo "✅ Release tag verified: v${{ inputs.version }}"

      - name: Checkout main for version bump
        uses: actions/checkout@v4
        with:
          ref: main
          path: repo-version

      - name: Update package.json version on main
        id: bump-version
        working-directory: repo-version
        env:
          VERSION: ${{ inputs.version }}
        run: |
          npm version "${VERSION}" --no-git-tag-version --allow-same-version
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add package.json package-lock.json
          if git diff --staged --quiet; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
            echo "⚠️ Version already matches insights release, no commit created"
          else
            git commit -m "chore: bump version to v${VERSION}"
            git push origin main
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      # Cache whisper.cpp build artifacts
      # Note: Cache key includes script hash. To force rebuild after whisper.cpp upstream changes,
      # either modify setup-whisper-cpp.sh or delete the cache manually in GitHub Actions settings.
      - name: Cache whisper.cpp build
        id: cache-whisper
        uses: actions/cache@v4
        with:
          path: |
            whisper.cpp/build-arm64
            whisper.cpp/build-x86_64
            bin/whisper-cli
          key: whisper-cpp-universal-${{ runner.os }}-${{ hashFiles('scripts/setup-whisper-cpp.sh') }}
          restore-keys: |
            whisper-cpp-universal-${{ runner.os }}-

      # Cache electron-builder's default cache location on macOS
      - name: Cache Electron
        uses: actions/cache@v4
        with:
          path: |
            ~/Library/Caches/electron
            ~/Library/Caches/electron-builder
          key: electron-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
          restore-keys: |
            electron-${{ runner.os }}-

      - name: Install dependencies
        run: npm ci --prefer-offline

      - name: Update package.json version
        run: |
          npm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
          echo "✅ Updated package.json to version ${{ inputs.version }}"

      - name: Build whisper.cpp (universal binary)
        if: steps.cache-whisper.outputs.cache-hit != 'true'
        run: npm run setup:whisper:universal

      - name: Verify whisper-cli exists
        run: |
          CACHE_HIT="${{ steps.cache-whisper.outputs.cache-hit }}"

          if [ "$CACHE_HIT" = "true" ]; then
            # Cache was hit - binary MUST exist
            if [ ! -f "bin/whisper-cli" ]; then
              echo "❌ Cache hit but whisper-cli not found - cache may be corrupt or paths misconfigured!"
              exit 1
            fi
            echo "✅ whisper-cli restored from cache"
            lipo -info bin/whisper-cli
          else
            # Cache miss - binary should have been built, verify it exists
            if [ ! -f "bin/whisper-cli" ]; then
              echo "❌ whisper-cli not found after build, rebuilding..."
              npm run setup:whisper:universal
              if [ ! -f "bin/whisper-cli" ]; then
                echo "❌ Failed to build whisper-cli even after rebuild!"
                exit 1
              fi
            fi
            echo "✅ whisper-cli built successfully"
            lipo -info bin/whisper-cli
          fi

      - name: Generate icons
        run: npm run icons

      - name: Build application
        run: npm run build

      - name: Verify Apple credentials
        run: |
          echo "🔐 Verifying Apple notarization credentials..."
          if [ -z "$APPLE_ID" ]; then
            echo "⚠️ Warning: APPLE_ID is not set"
          else
            echo "✅ APPLE_ID is set: ${APPLE_ID:0:3}***"
          fi
          if [ -z "$APPLE_APP_SPECIFIC_PASSWORD" ]; then
            echo "⚠️ Warning: APPLE_APP_SPECIFIC_PASSWORD is not set"
          else
            echo "✅ APPLE_APP_SPECIFIC_PASSWORD is set: ****-****-****-****"
          fi
          if [ -z "$APPLE_TEAM_ID" ]; then
            echo "⚠️ Warning: APPLE_TEAM_ID is not set"
          else
            echo "✅ APPLE_TEAM_ID is set: $APPLE_TEAM_ID"
          fi
          if [ -z "$CSC_LINK" ]; then
            echo "⚠️ Warning: CSC_LINK (signing certificate) is not set"
          else
            echo "✅ CSC_LINK is set"
          fi
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          CSC_LINK: ${{ secrets.CSC_LINK }}

      - name: Build Electron app for macOS
        id: electron-build
        timeout-minutes: 60
        run: |
          echo "🏗️ Starting electron-builder..."
          echo "📅 Start time: $(date)"

          # Run electron-builder with verbose output
          npx electron-builder --mac --publish never 2>&1 | tee electron-builder.log
          BUILD_EXIT_CODE=${PIPESTATUS[0]}

          echo "📅 End time: $(date)"

          if [ $BUILD_EXIT_CODE -ne 0 ]; then
            echo "❌ electron-builder failed with exit code $BUILD_EXIT_CODE"
            echo "📋 Last 100 lines of log:"
            tail -100 electron-builder.log
            exit $BUILD_EXIT_CODE
          fi

          echo "✅ electron-builder completed successfully"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_LINK: ${{ secrets.CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          # Enable verbose notarization logging
          DEBUG: electron-notarize*

      - name: Upload build log on failure
        if: failure() && steps.electron-build.outcome == 'failure'
        uses: actions/upload-artifact@v4
        with:
          name: electron-builder-log
          path: electron-builder.log
          retention-days: 7

      - name: Upload macOS artifacts to release
        if: success()
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload v${{ inputs.version }} \
            release/*.dmg \
            release/*.zip \
            release/*.blockmap \
            release/latest-mac.yml \
            --clobber

      - name: Deployment notification
        if: success()
        uses: actions/github-script@v7
        env:
          VERSION: ${{ inputs.version }}
        with:
          script: |
            const version = process.env.VERSION;
            try {
              const deployment = await github.rest.repos.createDeployment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                ref: `v${version}`,
                environment: 'production',
                description: `WhisperDesk v${version} deployed`,
                required_contexts: []
              });
              await github.rest.repos.createDeploymentStatus({
                owner: context.repo.owner,
                repo: context.repo.repo,
                deployment_id: deployment.data.id,
                state: 'success',
                environment_url: `https://github.com/${context.repo.owner}/${context.repo.repo}/releases/tag/v${version}`,
                description: 'Build completed and uploaded to GitHub Release'
              });
            } catch (error) {
              console.error('Failed to create deployment:', error);
            }

  # Optional: Build for Windows (uncomment when ready)
  # deploy-windows:
  #   name: Build & Deploy Windows
  #   runs-on: windows-latest
  #   environment:
  #     name: production
  #
  #   steps:
  #     - name: Checkout code
  #       uses: actions/checkout@v4
  #       with:
  #         ref: v${{ inputs.version }}
  #
  #     - name: Verify release tag exists
  #       run: |
  #         if (-not (git rev-parse "v${{ inputs.version }}" 2>$null)) {
  #           Write-Error "Release tag v${{ inputs.version }} not found!"
  #           exit 1
  #         }
  #
  #     - name: Setup Node.js
  #       uses: actions/setup-node@v4
  #       with:
  #         node-version: '20'
  #         cache: 'npm'
  #
  #     - name: Install dependencies
  #       run: npm ci
  #
  #     - name: Build application
  #       run: npm run build
  #
  #     - name: Build Electron app for Windows
  #       run: npx electron-builder --win --publish never
  #       env:
  #         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  #
  #     - name: Upload Windows artifacts to release
  #       uses: softprops/action-gh-release@v2
  #       if: success()
  #       with:
  #         tag_name: v${{ inputs.version }}
  #         files: |
  #           release/*.exe
  #           release/*.blockmap
  #           release/latest.yml
  #         fail_on_unmatched_files: true
  #       env:
  #         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}