release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  build-windows:
    name: Build & Release (Windows)
    runs-on: windows-latest

    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          version: 10

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - name: Install dependencies
        run: pnpm install

      - name: Build
        run: pnpm build:win

      - name: Upload artifacts
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          # This job is the SOLE owner of the release body — the other jobs
          # upload files only, so nothing races or clobbers it. The macOS
          # note therefore lives here rather than in the macOS job: that one
          # is a 2-leg matrix (aarch64 + x86_64) and would append the same
          # text twice. GitHub prepends `body` to the generated notes, so
          # this lands at the top of the release page — exactly where people
          # are standing when they download the DMG and hit "damaged".
          body: |
            ### macOS: first launch says "damaged"? The download is fine.

            The DMG is ad-hoc signed but **not notarized** (that needs a paid
            Apple Developer ID). macOS quarantines every such download and
            shows the misleading *"InspectorRust.app is damaged and can't be
            opened"* instead of the usual unidentified-developer prompt.
            **Right-click → Open does _not_ clear this one.**

            Drag the app to Applications, then run this once:

            ```bash
            xattr -dr com.apple.quarantine /Applications/InspectorRust.app
            ```

            The app then launches normally, for good. To convince yourself the
            bundle is intact, run `codesign --verify --deep --strict /Applications/InspectorRust.app`
            — silence means the signature is valid and nothing is corrupted.
            The mounted DMG also carries these instructions as
            **! READ ME FIRST.txt**.

            ---
          files: |
            target/release/inspector-rust.exe
            target/release/bundle/msi/*.msi

  build-linux:
    name: Build & Release (Linux)
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Install Linux system dependencies
        # libfuse2 is needed by Tauri's AppImage bundling step.
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            patchelf \
            libxdo-dev \
            libxcb-shape0-dev \
            libxcb-xfixes0-dev \
            libssl-dev \
            libfuse2 \
            libudev-dev \
            libinput-dev \
            libasound2-dev \
            pkg-config

      - uses: pnpm/action-setup@v4
        with:
          version: 10

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - name: Install dependencies
        run: pnpm install

      - name: Build
        run: pnpm build:linux

      - name: Upload artifacts
        uses: softprops/action-gh-release@v2
        with:
          files: |
            target/release/inspector-rust
            target/release/bundle/deb/*.deb
            target/release/bundle/appimage/*.AppImage

  build-macos:
    # Apple Silicon only — see the x86_64 note below before re-adding Intel.
    name: Build & Release (macOS ${{ matrix.arch }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: aarch64
            runner: macos-14   # Apple Silicon (M-series)
            target: aarch64-apple-darwin
          #
          # ── Why there is no x86_64 (Intel) job ────────────────────────────
          # It is not "temporarily broken" — it is impossible with the current
          # ONNX Runtime dependency, and it never once produced an artifact.
          #
          # `ort-sys` 2.0.0-rc.12 ships prebuilt ONNX Runtime binaries for
          # exactly ONE Apple target: its own `build/download/dist.txt` lists
          # `aarch64-apple-darwin` and nothing else for macOS (pyke dropped
          # Intel macOS). So the build script hard-errors:
          #     "ort does not provide prebuilt binaries for the target
          #      x86_64-apple-darwin"
          # The `download-binaries` default cannot satisfy it, and the
          # xcframework fallback explicitly bails for non-arm Apple targets.
          #
          # Evidence it never worked: every release back to v0.100.0 carries
          # only `*_aarch64.dmg`, while every release RUN was red — the Intel
          # job failed each time and `fail-fast: false` let the real artifacts
          # upload around it. A permanently failing job that ships nothing is
          # worse than no job: it trains you to ignore red releases.
          #
          # To actually support Intel, one of these is required (each is a
          # deliberate piece of work, not a matrix line):
          #   a) `ort` with `load-dynamic` + bundle an x86_64
          #      libonnxruntime.dylib into the .app (upstream still publishes
          #      onnxruntime-osx-x86_64-*.tgz) and sign it with the bundle;
          #   b) feature-gate `cutout_ml.rs` off for x86_64 so the Intel build
          #      compiles without `ort` at all — Intel users then get every
          #      feature except the ML background cut-out;
          #   c) build ONNX Runtime from source in CI (slow, high maintenance).
    runs-on: ${{ matrix.runner }}

    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          version: 10

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.target }}

      - name: Install dependencies
        run: pnpm install

      - name: Build
        # Pass --target to tauri so the output lands under
        # target/<triple>/release/bundle/ and the DMG filename gets an
        # arch suffix (e.g. InspectorRust_<ver>_aarch64.dmg).
        # Bundles both app + dmg; the next step *re*-seals the .app and
        # rebuilds the DMG — tauri alone leaves a linker-only ad-hoc
        # signature that Gatekeeper reports as "damaged".
        run: pnpm --filter inspector-rust-macos tauri build --target ${{ matrix.target }}

      - name: Seal .app + rebuild DMG
        # Deep ad-hoc codesign (Info.plist + Resources sealed) + fresh DMG.
        # Without this, macOS shows "InspectorRust.app is damaged and can't
        # be opened" for every GitHub-release download. See
        # scripts/pack-macos-release-dmg.sh.
        run: bash scripts/pack-macos-release-dmg.sh ${{ matrix.target }}

      - name: Upload artifacts
        uses: softprops/action-gh-release@v2
        with:
          files: target/${{ matrix.target }}/release/bundle/dmg/*.dmg