release.yml

name: Release
on:
  push:
    branches: [master]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check-version:
    name: Check Version Bump
    runs-on: ubuntu-latest
    outputs:
      is_new_version: ${{ steps.check.outputs.is_new_version }}
      version: ${{ steps.check.outputs.version }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - name: Check if version is new
        id: check
        run: |
          VERSION=$(node -p "require('./package.json').version")
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
          if git tag --list | grep -q "^v${VERSION}$"; then
            echo "Tag v${VERSION} already exists, skipping release"
            echo "is_new_version=false" >> $GITHUB_OUTPUT
          else
            echo "Tag v${VERSION} not found, proceeding with release"
            echo "is_new_version=true" >> $GITHUB_OUTPUT
          fi

  prepare:
    name: Prepare Release
    needs: check-version
    if: needs.check-version.outputs.is_new_version == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      release_body: ${{ steps.release_notes.outputs.release_body }}
      release_id: ${{ steps.create-release.outputs.result }}

    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Build Release Notes
        id: release_notes
        run: |
          bash scripts/build-release-notes.sh
          {
            echo 'release_body<<EOF'
            cat release-notes.md
            echo EOF
          } >> $GITHUB_OUTPUT

      - name: Create draft release
        id: create-release
        uses: actions/github-script@v7
        env:
          VERSION: ${{ needs.check-version.outputs.version }}
          RELEASE_BODY: ${{ steps.release_notes.outputs.release_body }}
        with:
          script: |
            const { data } = await github.rest.repos.createRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              tag_name: `v${process.env.VERSION}`,
              name: `SqlKit v${process.env.VERSION}`,
              body: process.env.RELEASE_BODY || '',
              draft: true,
              prerelease: false
            })
            return data.id

  build:
    name: ${{ matrix.name }}
    needs: [check-version, prepare]
    if: needs.check-version.outputs.is_new_version == 'true'
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: macOS
            platform: macos-latest
            args: --target universal-apple-darwin
            target: aarch64-apple-darwin,x86_64-apple-darwin
          - name: Windows
            platform: windows-latest
            args: ''
            target: x86_64-pc-windows-msvc
          - name: Linux
            platform: ubuntu-latest
            args: ''
            target: ''

    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v5

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Setup Node
        uses: actions/setup-node@v5
        with:
          node-version: lts/*
          cache: npm

      - name: Install Linux dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libssl-dev

      - name: Install dependencies
        run: npm ci

      - name: Lint check
        run: npm run lint:check

      - name: Run tests
        run: npm run test:ci

      - name: Build frontend
        run: npm run build

      - name: Import Apple Developer Certificate
        if: runner.os == 'macOS'
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
          security create-keychain -p "SqlKit2024!" build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p "SqlKit2024!" build.keychain
          security set-keychain-settings -t 3600 -u build.keychain
          security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "SqlKit2024!" build.keychain

      - name: Extract Signing Identity
        if: runner.os == 'macOS'
        run: |
          CERT_INFO=$(security find-identity -v -p codesigning build.keychain | grep "Apple Development" || security find-identity -v -p codesigning build.keychain | grep "Developer ID")
          CERT_ID=$(echo "$CERT_INFO" | awk -F'"' '{print $2}')
          echo "CERT_ID=$CERT_ID" >> $GITHUB_ENV
          echo "Signing identity: $CERT_ID"

      - name: Build and Upload Artifacts
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          releaseId: ${{ needs.prepare.outputs.release_id }}
          includeUpdaterJson: true
          args: ${{ matrix.args }}
  build-bridge:
    name: Build JDBC Bridge
    needs: [check-version, prepare]
    if: needs.check-version.outputs.is_new_version == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v5

      - name: Setup JDK 25
        uses: actions/setup-java@v4
        with:
          java-version: '25'
          distribution: temurin
          cache: maven

      - name: Build bridge JAR
        run: |
          VERSION=${{ needs.check-version.outputs.version }}
          mvn -f jdbc-bridge/pom.xml clean package -DskipTests -Drevision=$VERSION

      - name: Upload bridge JAR artifact
        uses: actions/upload-artifact@v4
        with:
          name: jdbc-bridge
          path: jdbc-bridge/target/jdbc-bridge-*.jar
          if-no-files-found: error

  publish:
    name: Publish Release
    needs: [check-version, prepare, build, build-bridge]
    if: needs.check-version.outputs.is_new_version == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v5

      - name: Download bridge JAR artifact
        uses: actions/download-artifact@v4
        with:
          name: jdbc-bridge
          path: bridge-artifact

      - name: Prepare bridge JAR for upload
        run: |
          VERSION=${{ needs.check-version.outputs.version }}
          ls -la bridge-artifact/

      - name: Upload bridge JAR to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION=${{ needs.check-version.outputs.version }}
          gh release upload \
            v${{ needs.check-version.outputs.version }} \
            bridge-artifact/jdbc-bridge-${VERSION}.jar \
            --clobber
      - name: Publish draft release
        uses: actions/github-script@v7
        env:
          release_id: ${{ needs.prepare.outputs.release_id }}
        with:
          script: |
            github.rest.repos.updateRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              release_id: Number(process.env.release_id),
              draft: false,
              prerelease: false
            })