release.yml

name: Build and Release

on:
  push:
    tags:
      - 'v*'

jobs:
  create-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Extract changelog for version
        id: changelog
        run: |
          VERSION="${GITHUB_REF_NAME#v}"

          # Extract app changelog section (between this version and next version header)
          APP_CONTENT=$(awk "/^## ${VERSION}$/,/^## [0-9]/" app/CHANGELOG.md | sed '1d;$d' | sed '/^$/d')

          # Extract extension changelog section
          EXT_CONTENT=$(awk "/^## ${VERSION}$/,/^## [0-9]/" extension/CHANGELOG.md | sed '1d;$d' | sed '/^$/d')

          # Build release notes with headers (skip empty sections)
          {
            if [ -n "$APP_CONTENT" ]; then
              echo "## Desktop App"
              echo ""
              echo "$APP_CONTENT"
              echo ""
            fi

            if [ -n "$EXT_CONTENT" ]; then
              echo "## Chrome Extension"
              echo ""
              echo "$EXT_CONTENT"
              echo ""
            fi
          } > release-notes.md

          echo "Generated release notes for v${VERSION}:"
          cat release-notes.md

      - name: Create Release
        uses: softprops/action-gh-release@v2
        with:
          body_path: release-notes.md
          generate_release_notes: true
          append_body: true
          draft: true
          prerelease: ${{ contains(github.ref, 'alpha') || contains(github.ref, 'beta') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-extension:
    name: Build Chrome Extension
    runs-on: ubuntu-latest
    needs: create-release
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build extension
        run: pnpm --filter think-extension build

      - name: Create ZIP archive
        run: |
          cd extension/dist
          zip -r ../../think-extension-${{ github.ref_name }}.zip .

      - name: Upload extension artifact
        uses: actions/upload-artifact@v4
        with:
          name: chrome-extension
          path: think-extension-${{ github.ref_name }}.zip
          retention-days: 1

  build-macos:
    name: Build macOS App
    runs-on: macos-latest
    needs: create-release
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'pnpm'

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install Poetry
        uses: snok/install-poetry@v1
        with:
          version: '1.8.0'
          virtualenvs-create: true
          virtualenvs-in-project: true

      - name: Install SQLCipher
        run: brew install sqlcipher

      - name: Install pnpm dependencies
        run: pnpm install --frozen-lockfile

      - name: Install backend dependencies
        working-directory: backend
        run: |
          export C_INCLUDE_PATH="$(brew --prefix sqlcipher)/include"
          export LIBRARY_PATH="$(brew --prefix sqlcipher)/lib"
          export CFLAGS="-I$(brew --prefix sqlcipher)/include"
          export LDFLAGS="-L$(brew --prefix sqlcipher)/lib"
          poetry run pip install pysqlcipher3 --no-cache-dir
          poetry install

      - name: Import Code Signing Certificate
        env:
          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
          MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
          echo "$MACOS_CERTIFICATE" | base64 --decode > $RUNNER_TEMP/certificate.p12
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security import $RUNNER_TEMP/certificate.p12 -P "$MACOS_CERTIFICATE_PWD" \
            -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH

      - name: Build all (stub + backend + app)
        env:
          CODESIGN_IDENTITY: ${{ secrets.CODESIGN_IDENTITY }}
          NOTARIZE: '1'
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          CSC_LINK: ${{ secrets.MACOS_CERTIFICATE }}
          CSC_KEY_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
        run: pnpm build:all:release

      - name: Upload macOS artifacts
        uses: actions/upload-artifact@v4
        with:
          name: electron-app-macos
          path: |
            app/release/*.dmg
            app/release/*.zip
            app/release/latest-mac.yml
          retention-days: 1

  build-windows:
    name: Build Windows App
    runs-on: windows-latest
    needs: create-release
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'pnpm'

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install Poetry
        run: pip install poetry==1.8.0

      - name: Configure Poetry
        run: poetry config virtualenvs.in-project true
        working-directory: backend

      - name: Install pnpm dependencies
        run: pnpm install --frozen-lockfile

      - name: Install backend dependencies
        working-directory: backend
        run: poetry install

      - name: Download MSVC-compiled sqlite-vec
        shell: pwsh
        run: |
          # Download MSVC-compiled vec0.dll from sqlite-vec releases
          $vec0Url = "https://github.com/asg017/sqlite-vec/releases/download/v0.1.6/sqlite-vec-0.1.6-loadable-windows-x86_64.tar.gz"
          $tarPath = "$env:RUNNER_TEMP\sqlite-vec.tar.gz"
          $extractPath = "$env:RUNNER_TEMP\sqlite-vec"

          Invoke-WebRequest -Uri $vec0Url -OutFile $tarPath
          New-Item -ItemType Directory -Path $extractPath -Force
          tar -xzf $tarPath -C $extractPath

          # Find where sqlite_vec package is installed and copy vec0.dll there
          $sitePackages = poetry run python -c "import site; print(site.getsitepackages()[0])"
          $sqliteVecDir = Join-Path $sitePackages "sqlite_vec"

          if (Test-Path $sqliteVecDir) {
            Copy-Item "$extractPath\vec0.dll" -Destination $sqliteVecDir -Force
            Write-Host "Copied vec0.dll to $sqliteVecDir"
          } else {
            Write-Host "Warning: sqlite_vec directory not found at $sqliteVecDir"
          }
        working-directory: backend

      - name: Build backend
        run: pnpm build:backend

      - name: Build native stub
        run: pnpm build:stub

      - name: Build app (frontend)
        run: pnpm --filter think-app build

      - name: Build Electron app (NSIS installer)
        run: pnpm --filter think-app electron:build

      - name: Upload Windows artifacts
        uses: actions/upload-artifact@v4
        with:
          name: electron-app-windows
          path: |
            app/release/*.exe
            app/release/latest.yml
          retention-days: 1

  upload-release:
    name: Upload Release Artifacts
    runs-on: ubuntu-latest
    needs: [create-release, build-extension, build-macos, build-windows]
    permissions:
      contents: write
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: List artifacts
        run: find artifacts -type f

      - name: Upload to Release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            artifacts/chrome-extension/*.zip
            artifacts/electron-app-macos/*.dmg
            artifacts/electron-app-macos/*.zip
            artifacts/electron-app-macos/latest-mac.yml
            artifacts/electron-app-windows/*.exe
            artifacts/electron-app-windows/latest.yml
          draft: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}