main.yml

name: Atlas Release

on:
  push:
    branches:
      - main

permissions:
  contents: write

jobs:
  build-and-release:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [windows-latest, ubuntu-latest]
    timeout-minutes: 60

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Install dependencies (Windows)
        if: matrix.os == 'windows-latest'
        run: npm install
        shell: cmd

      - name: Install dependencies (Linux)
        if: matrix.os == 'ubuntu-latest'
        run: npm install
        shell: bash

      - name: Install Linux system dependencies
        if: matrix.os == 'ubuntu-latest'
        run: |
          sudo apt-get update
          sudo apt-get install -y libarchive-tools rpm
          # appimagetool (bundled by electron-builder to build the AppImage
          # target) is itself an AppImage and needs FUSE2 to run. Ubuntu
          # 24.04 ("noble", what ubuntu-latest currently points to) renamed
          # libfuse2 -> libfuse2t64; fall back to the old name in case the
          # runner image changes again.
          sudo apt-get install -y libfuse2t64 || sudo apt-get install -y libfuse2
        shell: bash

      - name: Build renderer
        if: matrix.os == 'windows-latest'
        run: npx vite build
        shell: cmd

      - name: Build renderer (Linux)
        if: matrix.os == 'ubuntu-latest'
        run: npx vite build
        shell: bash

      - name: Build extension zip (Windows)
        if: matrix.os == 'windows-latest'
        run: npm run build:extension
        shell: cmd

      - name: Build extension zip (Linux)
        if: matrix.os == 'ubuntu-latest'
        run: npm run build:extension
        shell: bash

      - name: Build and publish (Windows)
        if: matrix.os == 'windows-latest'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npx electron-builder --win --x64 -p always
        shell: cmd

      - name: Build and publish (Linux)
        if: matrix.os == 'ubuntu-latest'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npx electron-builder --linux --x64 -p always
        shell: bash

      - name: Verify Linux release assets
        if: matrix.os == 'ubuntu-latest'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          shopt -s nullglob
          linux_files=(release/*.deb release/*.AppImage release/*.pacman)
          if [ ${#linux_files[@]} -eq 0 ]; then
            echo "No Linux packages were produced in release/."
            exit 1
          fi

          tag="v$(node -p "require('./package.json').version")"
          linux_assets=$(gh release view "$tag" --json assets --jq '[.assets[].name | select(test("\\.(deb|AppImage|pacman)$"))] | length')
          if [ "$linux_assets" -eq 0 ]; then
            echo "Release $tag does not contain Linux assets."
            exit 1
          fi
        shell: bash

      - name: Upload Windows artifact
        if: matrix.os == 'windows-latest'
        uses: actions/upload-artifact@v4
        with:
          name: windows-installer
          path: release/*.exe
          if-no-files-found: warn

      - name: Upload Linux artifact
        if: always() && matrix.os == 'ubuntu-latest'
        uses: actions/upload-artifact@v4
        with:
          name: linux-installer
          path: |
            release/*.deb
            release/*.AppImage
            release/*.pacman
          if-no-files-found: error

  virus-scan:
    name: ClamAV scan of release artifacts
    needs: build-and-release
    runs-on: ubuntu-latest
    # Report-only by default: ClamAV can false-positive on unsigned/packed
    # Electron installers, so a detection should be surfaced loudly but not
    # block a release. Flip FAIL_ON_DETECTION to 'true' to make hits fail.
    env:
      FAIL_ON_DETECTION: 'false'
    steps:
      - name: Download Windows artifact
        uses: actions/download-artifact@v4
        with:
          name: windows-installer
          path: scan/windows
        continue-on-error: true

      - name: Download Linux artifact
        uses: actions/download-artifact@v4
        with:
          name: linux-installer
          path: scan/linux
        continue-on-error: true

      - name: Install ClamAV
        run: |
          sudo apt-get update
          sudo apt-get install -y clamav
          # freshclam holds a lock via the daemon; stop it so we can update.
          sudo systemctl stop clamav-freshclam || true

      - name: Update virus definitions
        run: sudo freshclam || echo "freshclam returned non-zero (definitions may already be current); continuing."

      - name: Scan artifacts
        id: scan
        run: |
          set +e
          shopt -s nullglob globstar
          files=(scan/**/*.exe scan/**/*.AppImage scan/**/*.deb scan/**/*.pacman)
          if [ ${#files[@]} -eq 0 ]; then
            echo "No release artifacts were downloaded to scan." | tee -a "$GITHUB_STEP_SUMMARY"
            echo "detections=0" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          echo "## ClamAV scan results" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "| Artifact | SHA-256 | Result |" >> "$GITHUB_STEP_SUMMARY"
          echo "| --- | --- | --- |" >> "$GITHUB_STEP_SUMMARY"

          total_infected=0
          for f in "${files[@]}"; do
            sha=$(sha256sum "$f" | awk '{print $1}')
            # --no-summary keeps output to one "FOUND"/"OK" line per file.
            out=$(clamscan --no-summary --stdout "$f" 2>&1)
            code=$?
            name=$(basename "$f")
            if [ $code -eq 0 ]; then
              result="✅ Clean"
            elif [ $code -eq 1 ]; then
              sig=$(echo "$out" | grep -o ': .* FOUND' | sed 's/^: //; s/ FOUND$//' | paste -sd '; ' -)
              result="🚨 INFECTED — ${sig:-detection}"
              total_infected=$((total_infected + 1))
            else
              result="⚠️ Scan error (exit $code)"
            fi
            echo "| \`$name\` | \`$sha\` | $result |" >> "$GITHUB_STEP_SUMMARY"
            echo "$name  $sha  $result"
          done

          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "_Report-only. For a multi-engine view, submit an artifact's SHA-256 at https://www.virustotal.com/gui/search_ ." >> "$GITHUB_STEP_SUMMARY"
          echo "detections=$total_infected" >> "$GITHUB_OUTPUT"

      - name: Enforce detection policy
        if: steps.scan.outputs.detections != '0' && env.FAIL_ON_DETECTION == 'true'
        run: |
          echo "ClamAV reported ${{ steps.scan.outputs.detections }} infected artifact(s) and FAIL_ON_DETECTION is true."
          exit 1