build.yml

name: Build and Release

on:
  push:
    tags:
      - 'v[0-9]*.[0-9]*.[0-9]*'
    branches:
      - master

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false  # Never cancel an in-flight release

jobs:
  test:
    name: Run Tests
    uses: ./.github/workflows/test.yml

  prepare:
    name: Prepare Metadata
    runs-on: ubuntu-latest
    timeout-minutes: 5
    needs: test
    outputs:
      version: ${{ steps.version.outputs.version }}
      tag: ${{ steps.version.outputs.tag }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          fetch-depth: '1'
          ref: ${{ github.ref }}

      - name: Determine Version
        id: version
        uses: ./.github/actions/determine-version

  build:
    needs: [test, prepare]
    uses: ./.github/workflows/build-and-package.yml
    with:
      version: ${{ needs.prepare.outputs.version }}
      asset_name_prefix: OpenSSH-GUI

  create_installer:
    name: Create Windows Installer
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [test, prepare, build]
    if: startsWith(github.ref, 'refs/tags/')

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v7
        with:
          fetch-depth: '1'
          ref: ${{ github.ref }}
      
      - name: Download Windows binary
        uses: actions/download-artifact@v8
        with:
          name: OpenSSH-GUI-win-x64.exe
          path: ./publish

      - name: Install build dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends \
            nsis \
            librsvg2-bin \
            imagemagick

      - name: Convert SVG to multi-resolution ICO
        run: |
          set -euo pipefail
          for SIZE in 16 32 48 64 128 256; do
            rsvg-convert -w "$SIZE" -h "$SIZE" \
              images/openssh-gui.svg -o "/tmp/icon-${SIZE}.png"
          done
          convert \
            /tmp/icon-16.png  /tmp/icon-32.png  /tmp/icon-48.png \
            /tmp/icon-64.png  /tmp/icon-128.png /tmp/icon-256.png \
            installer-icon.ico

      - name: Substitute installer variables
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
        run: |
          sed \
            -e "s|@@VERSION@@|${VERSION}|g" \
            -e "s|@@SOURCE_EXE@@|publish/OpenSSH-GUI-win-x64.exe|g" \
            installer/OpenSSH-GUI.nsi > installer.nsi

      - name: Build installer
        run: makensis installer.nsi

      - name: Upload installer artifact
        uses: actions/upload-artifact@v7
        with:
          name: OpenSSH-GUI-${{ needs.prepare.outputs.version }}-Setup
          path: OpenSSH-GUI-${{ needs.prepare.outputs.version }}-Setup.exe
          if-no-files-found: error

  release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [test, prepare, build, create_installer]
    if: startsWith(github.ref, 'refs/tags/')

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Download all build artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts/

      - name: Prepare and validate release assets
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
        run: |
          set -euo pipefail
          rm -rf release-assets
          mkdir -p release-assets

          # Copy all artifacts, hard-fail on name collision
          find artifacts -type f | while read -r FILE; do
            DEST="release-assets/$(basename "$FILE")"
            if [[ -f "$DEST" ]]; then
              echo "::error::Artifact name collision detected: $(basename "$FILE")"
              exit 1
            fi
            cp "$FILE" "$DEST"
          done

          # Raw win-x64 binary is an intermediate artifact only —
          # the installer replaces it as the Windows distribution unit
          rm -f "release-assets/OpenSSH-GUI-win-x64.exe"

          cp LICENSE release-assets/LICENSE

          # Assert all expected files are present before creating the release.
          # appicon.png and .desktop are required by openssh-gui-bin PKGBUILD source URLs.
          for EXPECTED in \
            "OpenSSH-GUI-linux-x64" \
            "OpenSSH-GUI-${VERSION}-Setup.exe" \
            "OpenSSH-GUI-osx-x64" \
            "OpenSSH-GUI-x86_64.AppImage" \
            "appicon.png" \
            "io.github.frequency403.openssh_gui.desktop"
          do
            if [[ ! -f "release-assets/$EXPECTED" ]]; then
              echo "::error::Expected release asset missing: $EXPECTED"
              exit 1
            fi
          done

          echo "Release assets:"
          ls -lah release-assets/

      - name: Publish GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ needs.prepare.outputs.tag }}
          files: release-assets/*
          generate_release_notes: true
          token: ${{ secrets.PAT_TOKEN }}
          
      - name: Trigger deployment
        uses: peter-evans/repository-dispatch@v4
        with:
          event-type: deploy
          token: ${{ secrets.PAT_TOKEN }}
          client-payload: '{"tag": "${{ needs.prepare.outputs.tag }}", "version": "${{ needs.prepare.outputs.version }}"}'