build.yml

name: Build and Release

on:
  push:
    branches:
      - main
    tags:
      - 'v*'
  workflow_dispatch:

env:
  GO_VERSION: '1.24'
  NODE_VERSION: '20'
  APP_NAME: 'SkillUI'

jobs:
  # ==================== Linux Build ====================
  build-linux:
    name: Build Linux ${{ matrix.goarch }}
    runs-on: ${{ matrix.runner }}
    strategy:
      matrix:
        include:
          - goarch: amd64
            runner: ubuntu-22.04
            artifact_name: SkillUI-linux-amd64
            asset_name: SkillUI-linux-amd64.tar.gz
          - goarch: arm64
            runner: ubuntu-22.04-arm
            artifact_name: SkillUI-linux-arm64
            asset_name: SkillUI-linux-arm64.tar.gz

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install Wails
        run: go install github.com/wailsapp/wails/v2/cmd/wails@latest

      - name: Install frontend dependencies
        run: |
          cd frontend
          npm install

      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev libappindicator3-dev librsvg2-dev

      - name: Build Wails app
        run: |
          wails build -platform linux/${{ matrix.goarch }} -trimpath -ldflags "-s -w"

      - name: Package Linux build
        run: |
          cd build/bin
          tar -czf ../../${{ matrix.asset_name }} SkillUI

      - name: Upload Linux build artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact_name }}
          path: ${{ matrix.asset_name }}
          retention-days: 30

  # ==================== Windows Build ====================
  build-windows:
    name: Build Windows amd64
    runs-on: windows-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install Wails
        run: go install github.com/wailsapp/wails/v2/cmd/wails@latest

      - name: Install frontend dependencies
        run: |
          cd frontend
          npm install

      - name: Build Wails app
        run: |
          wails build -platform windows/amd64 -trimpath -ldflags "-s -w" -nsis

      - name: Package Windows build
        run: |
          cd build/bin
          7z a ../../SkillUI-windows-amd64.zip SkillUI.exe
          cd ../..

      - name: Upload ZIP artifact
        uses: actions/upload-artifact@v4
        with:
          name: SkillUI-windows-amd64
          path: SkillUI-windows-amd64.zip
          retention-days: 30

      - name: Upload NSIS Installer artifact
        uses: actions/upload-artifact@v4
        with:
          name: SkillUI-windows-amd64-installer
          path: build/bin/*-amd64-installer.exe
          retention-days: 30

  # ==================== macOS Build with Signing ====================
  build-macos:
    name: Build macOS ${{ matrix.goarch }}
    runs-on: macos-latest
    strategy:
      matrix:
        include:
          - goarch: amd64
            artifact_name: SkillUI-darwin-amd64
            asset_name: SkillUI-darwin-amd64.dmg
          - goarch: arm64
            artifact_name: SkillUI-darwin-arm64
            asset_name: SkillUI-darwin-arm64.dmg

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install Wails
        run: go install github.com/wailsapp/wails/v2/cmd/wails@latest

      - name: Install frontend dependencies
        run: |
          cd frontend
          npm install

      - name: Import Code Signing Certificates
        env:
          CORP_MACOS_CERTIFICATE: ${{ secrets.CORP_MACOS_CERTIFICATE }}
          CORP_MACOS_CERTIFICATE_PASSWORD: ${{ secrets.CORP_MACOS_CERTIFICATE_PASSWORD }}
        run: |
          # Create temporary keychain
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)

          # Create keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # Import certificate
          echo "$CORP_MACOS_CERTIFICATE" | base64 --decode > $RUNNER_TEMP/certificate.p12
          security import $RUNNER_TEMP/certificate.p12 -P "$CORP_MACOS_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security list-keychain -d user -s $KEYCHAIN_PATH

          # Find signing identity
          SIGNING_IDENTITY=$(security find-identity -v -p codesigning $KEYCHAIN_PATH | grep "Developer ID Application" | head -1 | awk -F'"' '{print $2}')
          echo "SIGNING_IDENTITY=$SIGNING_IDENTITY" >> $GITHUB_ENV
          echo "Found signing identity: $SIGNING_IDENTITY"

      - name: Build Wails app
        run: |
          wails build -platform darwin/${{ matrix.goarch }} -trimpath -ldflags "-s -w"

      - name: Sign macOS Application
        run: |
          APP_PATH="build/bin/SkillUI.app"

          # Sign all frameworks and libraries first
          find "$APP_PATH" -name "*.dylib" -o -name "*.framework" | while read lib; do
            codesign --force --options runtime --sign "$SIGNING_IDENTITY" "$lib" || true
          done

          # Sign the main executable
          codesign --force --options runtime --sign "$SIGNING_IDENTITY" "$APP_PATH/Contents/MacOS/SkillUI"

          # Sign the entire app bundle
          codesign --force --options runtime --sign "$SIGNING_IDENTITY" "$APP_PATH"

          # Verify the signature
          codesign --verify --verbose=4 "$APP_PATH"

      - name: Create DMG
        run: |
          # Install create-dmg
          brew install create-dmg

          # Create DMG
          create-dmg \
            --volname "SkillUI" \
            --volicon "build/bin/SkillUI.app/Contents/Resources/iconfile.icns" \
            --window-pos 200 120 \
            --window-size 600 400 \
            --icon-size 100 \
            --icon "SkillUI.app" 150 185 \
            --hide-extension "SkillUI.app" \
            --app-drop-link 450 185 \
            --no-internet-enable \
            "${{ matrix.asset_name }}" \
            "build/bin/SkillUI.app" || true

          # Fallback: if create-dmg fails, use hdiutil
          if [ ! -f "${{ matrix.asset_name }}" ]; then
            hdiutil create -volname "SkillUI" -srcfolder "build/bin/SkillUI.app" -ov -format UDZO "${{ matrix.asset_name }}"
          fi

      - name: Sign DMG
        run: |
          codesign --force --sign "$SIGNING_IDENTITY" "${{ matrix.asset_name }}"

      - name: Notarize macOS Application
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          # Submit for notarization
          xcrun notarytool submit "${{ matrix.asset_name }}" \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait

          # Staple the notarization ticket
          xcrun stapler staple "${{ matrix.asset_name }}"

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact_name }}
          path: ${{ matrix.asset_name }}
          retention-days: 30



  # ==================== Create Release ====================
  create-release:
    name: Create Release
    needs: [build-linux, build-windows, build-macos]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      contents: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Display structure of downloaded files
        run: ls -R artifacts

      - name: Prepare release files
        run: |
          mkdir -p release
          # Linux
          cp artifacts/SkillUI-linux-amd64/SkillUI-linux-amd64.tar.gz release/
          cp artifacts/SkillUI-linux-arm64/SkillUI-linux-arm64.tar.gz release/
          # Windows
          cp artifacts/SkillUI-windows-amd64/SkillUI-windows-amd64.zip release/
          cp artifacts/SkillUI-windows-amd64-installer/*.exe release/ || true
          # macOS
          cp artifacts/SkillUI-darwin-amd64/SkillUI-darwin-amd64.dmg release/
          cp artifacts/SkillUI-darwin-arm64/SkillUI-darwin-arm64.dmg release/

          ls -la release/

      - name: Create Release
        uses: softprops/action-gh-release@v2
        with:
          files: release/*
          draft: false
          prerelease: false
          generate_release_notes: true
          body: |
            ## Release Notes

            ${{ github.event.head_commit.message }}

            ## Downloads

            ### Windows
            - `SkillUI-windows-amd64.zip` - Portable version
            - `SkillUI-*-amd64-installer.exe` - NSIS Installer

            ### Linux
            - `SkillUI-linux-amd64.tar.gz` - x86_64
            - `SkillUI-linux-arm64.tar.gz` - ARM64

            ### macOS (Signed & Notarized)
            - `SkillUI-darwin-arm64.dmg` - Apple Silicon ⭐ Recommended for M1/M2/M3
            - `SkillUI-darwin-amd64.dmg` - Intel

            ## Installation

            Please refer to the [README.md](https://github.com/${{ github.repository }}/blob/main/README.md) for detailed installation instructions.

        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # ==================== Notify Build Status ====================
  notify:
    name: Notify Build Status
    needs: [build-linux, build-windows, build-macos]
    runs-on: ubuntu-latest
    if: always()

    steps:
      - name: Check build status
        run: |
          if [ "${{ needs.build-linux.result }}" == "success" ] && \
             [ "${{ needs.build-windows.result }}" == "success" ] && \
             [ "${{ needs.build-macos.result }}" == "success" ]; then
            echo "✅ All builds successful!"
          else
            echo "❌ Some builds failed!"
            echo "Linux: ${{ needs.build-linux.result }}"
            echo "Windows: ${{ needs.build-windows.result }}"
            echo "macOS: ${{ needs.build-macos.result }}"
            exit 1
          fi