release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write
  packages: write

env:
  GO_VERSION: "1.25"

jobs:
  build-agent:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: agent/go.sum

      - name: Build agent (windows/amd64)
        shell: bash
        run: |
          cd agent
          TAG="${{ github.event.release.tag_name || github.ref_name }}"
          GOOS=windows GOARCH=amd64 CGO_ENABLED=1 go build -ldflags="-s -w -H windowsgui -X main.Version=${TAG}" -o opsview-agent.exe .

      - name: Build installer
        shell: pwsh
        run: |
          $tag = "${{ github.event.release.tag_name || github.ref_name }}" -replace '^v', ''
          & 'C:\Program Files (x86)\Inno Setup 6\ISCC.exe' "/DMyAppVersion=$tag" agent\installer.iss

      - uses: actions/upload-artifact@v4
        with:
          name: opsview-agent-windows-amd64
          path: agent/opsview-agent-setup.exe

  build-viewer:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
            goos: windows
            goarch: amd64
            artifact: opsview-viewer-windows-amd64
            wails_flags: "-nsis"
          - os: ubuntu-22.04
            goos: linux
            goarch: amd64
            artifact: opsview-viewer-linux-amd64
            wails_flags: ""
          - os: macos-latest
            goos: darwin
            goarch: arm64
            artifact: opsview-viewer-darwin-arm64
            wails_flags: ""
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: viewer/go.sum

      - uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Install Wails
        run: go install github.com/wailsapp/wails/v2/cmd/wails@latest

      - name: Install NSIS
        if: matrix.goos == 'windows'
        shell: pwsh
        run: |
          choco install nsis -y
          echo "C:\Program Files (x86)\NSIS" | Out-File -FilePath $env:GITHUB_PATH -Append

      - name: Install Linux dependencies
        if: matrix.goos == 'linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.0-dev

      - name: Build viewer
        shell: bash
        run: |
          cd viewer
          TAG="${{ github.event.release.tag_name || github.ref_name }}"
          wails build ${{ matrix.wails_flags }} -platform ${{ matrix.goos }}/${{ matrix.goarch }} -ldflags "-X main.Version=$TAG"

      - name: Download Real-ESRGAN
        shell: bash
        run: |
          ESRGAN_VER="20220424"
          case "${{ matrix.goos }}" in
            darwin)  ESRGAN_OS="macos" ;;
            windows) ESRGAN_OS="windows" ;;
            linux)   ESRGAN_OS="ubuntu" ;;
          esac
          curl -L "https://github.com/xinntao/Real-ESRGAN/releases/download/v0.2.5.0/realesrgan-ncnn-vulkan-${ESRGAN_VER}-${ESRGAN_OS}.zip" -o esrgan.zip
          mkdir -p esrgan
          unzip -o esrgan.zip -d esrgan-tmp
          cp esrgan-tmp/realesrgan-ncnn-vulkan* esrgan/ || true
          cp -r esrgan-tmp/models esrgan/
          rm -rf esrgan-tmp esrgan.zip

      - name: Package viewer (Windows)
        if: matrix.goos == 'windows'
        shell: pwsh
        run: |
          Copy-Item "viewer/build/bin/opsview-viewer-amd64-installer.exe" "${{ matrix.artifact }}-setup.exe"
          New-Item -ItemType Directory -Force -Path dist-esrgan/esrgan | Out-Null
          Copy-Item -Recurse esrgan/* dist-esrgan/esrgan/
          Compress-Archive -Path dist-esrgan/esrgan -DestinationPath "${{ matrix.artifact }}-esrgan.zip"

      - name: Bundle Real-ESRGAN into app (macOS)
        if: matrix.goos == 'darwin'
        run: |
          mkdir -p "viewer/build/bin/opsview-viewer.app/Contents/Resources/esrgan"
          cp esrgan/realesrgan-ncnn-vulkan "viewer/build/bin/opsview-viewer.app/Contents/Resources/esrgan/"
          cp -r esrgan/models "viewer/build/bin/opsview-viewer.app/Contents/Resources/esrgan/"

      - name: Import signing certificate
        if: matrix.goos == 'darwin' && env.HAS_CERT == 'true'
        env:
          HAS_CERT: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 != '' }}
        run: |
          echo "${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }}" | base64 --decode > cert.p12
          KEYCHAIN=build.keychain-db
          security create-keychain -p actions $KEYCHAIN
          security set-keychain-settings -lut 900 $KEYCHAIN
          security unlock-keychain -p actions $KEYCHAIN
          security import cert.p12 -k $KEYCHAIN -P "${{ secrets.APPLE_CERTIFICATE_PASSWORD }}" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple: -s -k actions $KEYCHAIN
          security list-keychains -d user -s $KEYCHAIN login.keychain
          rm cert.p12

      - name: Sign app
        if: matrix.goos == 'darwin' && env.HAS_CERT == 'true'
        env:
          HAS_CERT: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 != '' }}
        run: |
          # Sign third-party esrgan binary first
          codesign --force --options runtime \
            --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" \
            viewer/build/bin/opsview-viewer.app/Contents/Resources/esrgan/realesrgan-ncnn-vulkan
          # Sign the entire app bundle
          codesign --deep --force --options runtime \
            --sign "${{ secrets.APPLE_SIGNING_IDENTITY }}" \
            --entitlements viewer/build/entitlements.plist \
            viewer/build/bin/opsview-viewer.app

      - name: Notarize app
        if: matrix.goos == 'darwin' && env.HAS_CERT == 'true'
        env:
          HAS_CERT: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 != '' }}
        run: |
          ditto -c -k --keepParent viewer/build/bin/opsview-viewer.app notarize.zip
          xcrun notarytool submit notarize.zip \
            --apple-id "${{ secrets.APPLE_ID }}" \
            --password "${{ secrets.APPLE_ID_PASSWORD }}" \
            --team-id "${{ secrets.APPLE_TEAM_ID }}" \
            --wait
          xcrun stapler staple viewer/build/bin/opsview-viewer.app
          rm notarize.zip

      - name: Package viewer (macOS)
        if: matrix.goos == 'darwin'
        run: |
          mkdir -p dmg-stage
          cp -R viewer/build/bin/opsview-viewer.app dmg-stage/
          ln -s /Applications dmg-stage/Applications
          hdiutil create -volname "OpsView Viewer" \
            -srcfolder dmg-stage \
            -ov -format UDZO \
            ${{ matrix.artifact }}.dmg
          rm -rf dmg-stage

      - name: Package viewer (Linux)
        if: matrix.goos == 'linux'
        run: |
          cd viewer/build/bin
          mkdir -p esrgan
          cp ../../../esrgan/realesrgan-ncnn-vulkan esrgan/
          chmod +x esrgan/realesrgan-ncnn-vulkan
          cp -r ../../../esrgan/models esrgan/
          tar czf ../../../${{ matrix.artifact }}.tar.gz opsview-viewer esrgan/

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact }}
          path: |
            ${{ matrix.artifact }}-setup.exe
            ${{ matrix.artifact }}-esrgan.zip
            ${{ matrix.artifact }}.dmg
            ${{ matrix.artifact }}.tar.gz

      - name: Cleanup keychain
        if: matrix.goos == 'darwin' && always()
        run: security delete-keychain build.keychain-db 2>/dev/null || true

  build-relay-docker:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Extract tag
        id: tag
        run: echo "version=${{ github.event.release.tag_name || github.ref_name }}" >> "$GITHUB_OUTPUT"

      - name: Build and push relay image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: relay/Dockerfile
          platforms: linux/amd64
          push: true
          tags: |
            ghcr.io/${{ github.repository_owner }}/opsview-relay:${{ steps.tag.outputs.version }}
            ghcr.io/${{ github.repository_owner }}/opsview-relay:latest

  release:
    needs: [build-agent, build-viewer]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          pattern: opsview-*
          merge-multiple: true

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.event.release.tag_name || github.ref_name }}
          generate_release_notes: true
          append_body: true
          files: |
            artifacts/*.dmg
            artifacts/*-setup.exe
            artifacts/*.tar.gz
            artifacts/*.zip