build.yml

name: build

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: write

jobs:
  build:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      # Fetches the vendored single-headers (not committed) and clones
      # UniversalSpeech. Speech is linked only once its static lib is built from
      # that clone; otherwise the build runs without speech.
      - name: Download dependencies
        shell: cmd
        run: download-deps.bat

      - name: Build and test
        shell: cmd
        run: build.bat test

      - name: Package dist
        shell: pwsh
        run: Compress-Archive -Path dist\* -DestinationPath FastSMRW.zip -Force

      # build.bat already builds FastSMRWInstaller.exe when Inno Setup is present
      # (it is on the windows-latest image). Fail loudly if it somehow didn't.
      - name: Check installer built
        shell: pwsh
        run: if (-not (Test-Path FastSMRWInstaller.exe)) { throw "FastSMRWInstaller.exe not produced" }

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: FastSMRW
          path: |
            FastSMRW.zip
            FastSMRWInstaller.exe

      # Rolling 'latest' release updated on every push to main. NOT a prerelease:
      # GitHub's /releases/latest URL only resolves to a full release, so marking
      # this prerelease made that page 404 for everyone while no stable release
      # exists. --latest keeps it the repo's Latest release.
      - name: Update 'latest' release
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release delete latest --cleanup-tag --yes 2>$null
          gh release create latest FastSMRW.zip FastSMRWInstaller.exe --latest --target $env:GITHUB_SHA `
            --title "Latest (main)" --notes "Automated build of main ($env:GITHUB_SHA)."

      # Versioned release on a v* tag.
      - name: Publish tagged release
        if: startsWith(github.ref, 'refs/tags/v')
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release create $env:GITHUB_REF_NAME FastSMRW.zip FastSMRWInstaller.exe --title $env:GITHUB_REF_NAME --generate-notes

  # Android front end (android/): builds the shared C++ core for the NDK + the
  # Compose app into a sideloadable APK, and attaches it to the same 'latest' /
  # tagged releases the Windows job creates. Runs after 'build' so the release
  # already exists when we upload. Signing uses the release key when the
  # FASTSMRW_RELEASE_* secrets are set, else falls back to debug signing.
  android:
    runs-on: ubuntu-latest
    needs: build
    env:
      KEYSTORE_B64: ${{ secrets.FASTSMRW_RELEASE_STORE_FILE_B64 }}
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"

      # The vendored single-header libs aren't committed; fetch them to deps/ at
      # the repo root, where the Android CMake build (like the Windows build)
      # expects them. UniversalSpeech is Windows-only and not needed here.
      - name: Fetch native dependencies
        run: |
          mkdir -p deps/nlohmann deps/miniaudio deps/stb_vorbis
          curl -fsSL -o deps/nlohmann/json.hpp https://github.com/nlohmann/json/releases/download/v3.11.3/json.hpp
          curl -fsSL -o deps/miniaudio/miniaudio.h https://raw.githubusercontent.com/mackron/miniaudio/0.11.21/miniaudio.h
          curl -fsSL -o deps/stb_vorbis/stb_vorbis.c https://raw.githubusercontent.com/nothings/stb/master/stb_vorbis.c

      - name: Install NDK and CMake
        run: yes | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" "ndk;27.0.12077973" "cmake;3.22.1"

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Decode release keystore
        if: env.KEYSTORE_B64 != ''
        run: |
          echo "$KEYSTORE_B64" | base64 -d > "$RUNNER_TEMP/release.jks"
          {
            echo "FASTSMRW_RELEASE_STORE_FILE=$RUNNER_TEMP/release.jks"
            echo "FASTSMRW_RELEASE_STORE_PASSWORD=${{ secrets.FASTSMRW_RELEASE_STORE_PASSWORD }}"
            echo "FASTSMRW_RELEASE_KEY_ALIAS=${{ secrets.FASTSMRW_RELEASE_KEY_ALIAS }}"
            echo "FASTSMRW_RELEASE_KEY_PASSWORD=${{ secrets.FASTSMRW_RELEASE_KEY_PASSWORD }}"
          } >> "$GITHUB_ENV"

      - name: Build release APK
        working-directory: android
        run: |
          chmod +x gradlew
          ./gradlew :app:assembleRelease --no-daemon

      - name: Upload APK artifact
        uses: actions/upload-artifact@v4
        with:
          name: FastSMRW-Android
          path: android/app/build/outputs/apk/release/FastSMRW.apk
          if-no-files-found: error

      - name: Attach APK to 'latest' release
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload latest android/app/build/outputs/apk/release/FastSMRW.apk --clobber

      - name: Attach APK to tagged release
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload "$GITHUB_REF_NAME" android/app/build/outputs/apk/release/FastSMRW.apk --clobber

  # Linux front end (linux/): builds the shared C++ core + GTK app, runs the
  # unit tests and the headless C-ABI smoke test, and attaches a tarball of the
  # run folder to the same 'latest' / tagged releases the Windows job creates.
  linux:
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: actions/checkout@v4

      - name: Install build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y g++ pkg-config libgtk-3-dev libcurl4-openssl-dev \
            libspeechd-dev libgstreamer1.0-dev

      - name: Build, test, and smoke-test
        run: |
          chmod +x linux/*.sh
          ./linux/build.sh test smoke

      - name: Package tarball
        run: tar -czf FastSMRW-Linux.tar.gz -C dist/linux .

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: FastSMRW-Linux
          path: FastSMRW-Linux.tar.gz
          if-no-files-found: error

      - name: Attach tarball to 'latest' release
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload latest FastSMRW-Linux.tar.gz --clobber

      - name: Attach tarball to tagged release
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload "$GITHUB_REF_NAME" FastSMRW-Linux.tar.gz --clobber

  # macOS front end (macos/): builds the shared C++ core + AppKit app into a
  # FastSMRW.dmg and attaches it to the same 'latest' / tagged releases (the asset
  # the in-app updater looks for). Runs after 'build' so the release exists.
  # Developer-ID signing + notarization happen only when the MACOS_* secrets are
  # set; otherwise it's an ad-hoc DMG (installable, but Gatekeeper warns).
  macos:
    runs-on: macos-latest
    needs: build
    env:
      CERT_B64: ${{ secrets.MACOS_CERT_P12_B64 }}
      NOTARY_KEY_B64: ${{ secrets.MACOS_NOTARY_KEY_B64 }}
    steps:
      - uses: actions/checkout@v4

      - name: Install XcodeGen
        run: brew install xcodegen

      - name: Import signing certificate
        if: env.CERT_B64 != ''
        env:
          CERT_PASSWORD: ${{ secrets.MACOS_CERT_PASSWORD }}
        run: |
          KEYCHAIN="$RUNNER_TEMP/build.keychain-db"
          security create-keychain -p actions "$KEYCHAIN"
          security set-keychain-settings -lut 21600 "$KEYCHAIN"
          security unlock-keychain -p actions "$KEYCHAIN"
          echo "$CERT_B64" | base64 -d > "$RUNNER_TEMP/cert.p12"
          security import "$RUNNER_TEMP/cert.p12" -k "$KEYCHAIN" -P "$CERT_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple: -s -k actions "$KEYCHAIN"
          security list-keychains -d user -s "$KEYCHAIN" login.keychain-db
          echo "MACOS_SIGN_IDENTITY=${{ secrets.MACOS_SIGN_IDENTITY }}" >> "$GITHUB_ENV"

      - name: Store notary credentials
        if: env.NOTARY_KEY_B64 != ''
        run: |
          echo "$NOTARY_KEY_B64" | base64 -d > "$RUNNER_TEMP/notary.p8"
          xcrun notarytool store-credentials notary \
            --key "$RUNNER_TEMP/notary.p8" \
            --key-id "${{ secrets.MACOS_NOTARY_KEY_ID }}" \
            --issuer "${{ secrets.MACOS_NOTARY_ISSUER }}"
          echo "MACOS_NOTARY_PROFILE=notary" >> "$GITHUB_ENV"

      - name: Build DMG
        run: ./macos/package-dmg.sh

      - name: Upload DMG artifact
        uses: actions/upload-artifact@v4
        with:
          name: FastSMRW-macOS
          path: dist/FastSMRW.dmg
          if-no-files-found: error

      - name: Attach DMG to 'latest' release
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload latest dist/FastSMRW.dmg --clobber

      - name: Attach DMG to tagged release
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload "$GITHUB_REF_NAME" dist/FastSMRW.dmg --clobber

  ios:
    # Compile check only: proves the iOS app + core still build. No artifact —
    # distribution is TestFlight, set up separately.
    runs-on: macos-latest
    needs: build
    steps:
      - uses: actions/checkout@v4

      - name: Install XcodeGen
        run: brew install xcodegen

      - name: Fetch dependencies
        run: ./macos/fetch-deps.sh

      - name: Generate project
        working-directory: ios
        run: xcodegen generate

      - name: Build for simulator
        working-directory: ios
        run: |
          xcodebuild -project FastSMRW.xcodeproj -scheme FastSMRW \
            -configuration Debug -destination 'generic/platform=iOS Simulator' \
            CODE_SIGNING_ALLOWED=NO build