name: Build

on:
  workflow_dispatch:

jobs:
  build-android:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      attestations: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          distribution: "temurin"
          java-version: "17"

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          channel: "stable"
          cache: true

      - name: Cache Pub dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.pub-cache
          key: ${{ runner.os }}-pub-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            ${{ runner.os }}-pub-

      - name: Cache Gradle
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-

      - name: Install dependencies
        run: flutter pub get

      - name: Configure Android signing
        run: |
          echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 --decode > android/app/upload-keystore.jks
          cat > android/key.properties << EOF
          storePassword=${{ secrets.ANDROID_STORE_PASSWORD }}
          keyPassword=${{ secrets.ANDROID_KEY_PASSWORD }}
          keyAlias=${{ secrets.ANDROID_KEY_ALIAS }}
          storeFile=upload-keystore.jks
          EOF

      - name: Build APKs
        run: flutter build apk --release --split-per-abi --dart-define=ENABLE_UPDATE_CHECK=true

      - name: Clean up keystore
        if: always()
        run: rm -f android/app/upload-keystore.jks android/key.properties

      - name: Package APKs
        run: |
          tar -czf plezy-android-arm64-v8a.tar.gz -C build/app/outputs/flutter-apk app-arm64-v8a-release.apk --transform 's/app-arm64-v8a-release.apk/plezy.apk/'
          tar -czf plezy-android-armeabi-v7a.tar.gz -C build/app/outputs/flutter-apk app-armeabi-v7a-release.apk --transform 's/app-armeabi-v7a-release.apk/plezy.apk/'
          tar -czf plezy-android-x86_64.tar.gz -C build/app/outputs/flutter-apk app-x86_64-release.apk --transform 's/app-x86_64-release.apk/plezy.apk/'

      - name: Attest APKs
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: |
            plezy-android-arm64-v8a.tar.gz
            plezy-android-armeabi-v7a.tar.gz
            plezy-android-x86_64.tar.gz

      - name: Upload APKs
        uses: actions/upload-artifact@v4
        with:
          name: android-apk
          path: |
            plezy-android-arm64-v8a.tar.gz
            plezy-android-armeabi-v7a.tar.gz
            plezy-android-x86_64.tar.gz

  build-ios:
    runs-on: macos-26
    permissions:
      id-token: write
      attestations: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          channel: "stable"
          cache: true

      - name: Cache Pub dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.pub-cache
          key: ${{ runner.os }}-pub-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            ${{ runner.os }}-pub-

      - name: Cache CocoaPods
        uses: actions/cache@v4
        with:
          path: |
            ios/Pods
            ~/Library/Caches/CocoaPods
            ~/.cocoapods
          key: ${{ runner.os }}-pods-${{ hashFiles('**/Podfile.lock') }}
          restore-keys: |
            ${{ runner.os }}-pods-

      - name: Install dependencies
        run: flutter pub get

      - name: Build iOS (no codesign)
        run: flutter build ios --release --no-codesign --dart-define=ENABLE_UPDATE_CHECK=true

      - name: Create IPA
        run: |
          mkdir -p Payload
          cp -r build/ios/iphoneos/Runner.app Payload/
          zip -r plezy-ios.ipa Payload

      - name: Attest IPA
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: plezy-ios.ipa

      - name: Upload IPA
        uses: actions/upload-artifact@v4
        with:
          name: ios-ipa
          path: plezy-ios.ipa

  build-macos:
    runs-on: macos-26
    permissions:
      id-token: write
      attestations: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          channel: "stable"
          cache: true

      - name: Cache Pub dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.pub-cache
          key: ${{ runner.os }}-pub-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            ${{ runner.os }}-pub-

      - name: Cache CocoaPods
        uses: actions/cache@v4
        with:
          path: |
            macos/Pods
            ~/Library/Caches/CocoaPods
            ~/.cocoapods
          key: ${{ runner.os }}-macos-pods-${{ hashFiles('**/Podfile.lock') }}
          restore-keys: |
            ${{ runner.os }}-macos-pods-

      - name: Install dependencies
        run: flutter pub get

      - name: Build macOS
        run: flutter build macos --release --dart-define=ENABLE_UPDATE_CHECK=true

      - name: Import Code Signing Certificate
        env:
          MACOS_CERTIFICATE_BASE64: ${{ secrets.MACOS_CERTIFICATE_BASE64 }}
          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          # Create temporary keychain
          KEYCHAIN_PATH=$RUNNER_TEMP/build.keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # Import certificate to keychain
          CERTIFICATE_PATH=$RUNNER_TEMP/certificate.p12
          echo "$MACOS_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
          security import $CERTIFICATE_PATH -k $KEYCHAIN_PATH -P "$MACOS_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

          # Add keychain to search list
          security list-keychains -d user -s $KEYCHAIN_PATH login.keychain

      - name: Sign Application
        env:
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          # Find the identity
          IDENTITY=$(security find-identity -v -p codesigning | grep "Developer ID Application" | head -1 | grep -o '".*"' | tr -d '"')
          echo "Signing with identity: $IDENTITY"

          APP_PATH="build/macos/Build/Products/Release/Plezy.app"

          # Sign all frameworks and dylibs first (inside-out signing)
          find "$APP_PATH/Contents/Frameworks" -name "*.framework" -o -name "*.dylib" | while read framework; do
            echo "Signing: $framework"
            codesign --force --sign "$IDENTITY" --timestamp --options runtime "$framework"
          done

          # Sign the app bundle itself
          echo "Signing app bundle: $APP_PATH"
          codesign --force --sign "$IDENTITY" --timestamp --options runtime --entitlements macos/Runner/Release.entitlements "$APP_PATH"

      - name: Verify Signature
        run: |
          APP_PATH="build/macos/Build/Products/Release/Plezy.app"
          echo "Verifying signature..."
          codesign -dvvv "$APP_PATH"
          codesign --verify --deep --strict --verbose=2 "$APP_PATH"

      - name: Notarize Application
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          APP_PATH="build/macos/Build/Products/Release/Plezy.app"

          # Create a temporary ZIP for notarization submission
          echo "Creating ZIP for notarization..."
          ditto -c -k --keepParent "$APP_PATH" notarization.zip

          # Submit for notarization
          echo "Submitting to Apple's notary service..."
          xcrun notarytool submit notarization.zip \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_APP_SPECIFIC_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait

          # Staple the notarization ticket to the app
          echo "Stapling notarization ticket..."
          xcrun stapler staple "$APP_PATH"

          # Verify stapling
          echo "Verifying notarization..."
          xcrun stapler validate "$APP_PATH"

      - name: Create DMG
        run: |
          mkdir -p dmg-staging
          cp -R build/macos/Build/Products/Release/Plezy.app dmg-staging/
          ln -s /Applications dmg-staging/Applications
          hdiutil create -format ULMO -srcfolder dmg-staging -volname "Plezy" plezy-macos.dmg

      - name: Attest macOS DMG
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: plezy-macos.dmg

      - name: Upload macOS DMG
        uses: actions/upload-artifact@v4
        with:
          name: macos-dmg
          path: plezy-macos.dmg

  build-windows-x64:
    runs-on: windows-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          channel: "stable"
          cache: true

      - name: Cache Pub dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~\AppData\Local\Pub\Cache
          key: ${{ runner.os }}-pub-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            ${{ runner.os }}-pub-

      - name: Install dependencies
        run: flutter pub get

      - name: Build Windows x64
        run: flutter build windows --release --dart-define=ENABLE_UPDATE_CHECK=true

      - name: Upload x64 build
        uses: actions/upload-artifact@v4
        with:
          name: windows-x64-build
          path: build/windows/x64/runner/Release/

  build-windows-arm64:
    runs-on: windows-11-arm
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Install 7-Zip
        run: choco install 7zip -y

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          channel: "master"
          cache: true

      - name: Cache Pub dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~\AppData\Local\Pub\Cache
          key: ${{ runner.os }}-arm64-pub-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            ${{ runner.os }}-arm64-pub-

      - name: Install dependencies
        run: flutter pub get

      - name: Build Windows arm64
        run: flutter build windows --release --dart-define=ENABLE_UPDATE_CHECK=true

      - name: Upload arm64 build
        uses: actions/upload-artifact@v4
        with:
          name: windows-arm64-build
          path: build/windows/arm64/runner/Release/

  package-windows:
    needs: [build-windows-x64, build-windows-arm64]
    runs-on: windows-latest
    permissions:
      id-token: write
      attestations: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Download x64 build
        uses: actions/download-artifact@v4
        with:
          name: windows-x64-build
          path: build-x64

      - name: Download arm64 build
        uses: actions/download-artifact@v4
        with:
          name: windows-arm64-build
          path: build-arm64

      - name: Build installer and portables
        run: .\windows\build-installer.ps1 -X64BuildDir "build-x64" -Arm64BuildDir "build-arm64"

      - name: Attest Windows artifacts
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: |
            plezy-windows-x64-portable.7z
            plezy-windows-arm64-portable.7z
            plezy-windows-installer.exe

      - name: Upload x64 portable
        uses: actions/upload-artifact@v4
        with:
          name: windows-x64-portable
          path: plezy-windows-x64-portable.7z

      - name: Upload arm64 portable
        uses: actions/upload-artifact@v4
        with:
          name: windows-arm64-portable
          path: plezy-windows-arm64-portable.7z

      - name: Upload installer
        uses: actions/upload-artifact@v4
        with:
          name: windows-installer
          path: plezy-windows-installer.exe

  build-linux-x64:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      attestations: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          channel: "stable"
          cache: true

      - name: Cache Pub dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.pub-cache
          key: ${{ runner.os }}-pub-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            ${{ runner.os }}-pub-

      - name: Cache APT packages
        uses: awalsh128/cache-apt-pkgs-action@latest
        with:
          packages: clang cmake ninja-build pkg-config libgtk-3-dev liblzma-dev libstdc++-12-dev libasound2-dev libmpv-dev mpv libx11-dev libxext-dev libxrandr-dev libxcursor-dev libxi-dev libxss-dev libpulse-dev libdbus-1-dev libdrm-dev libgbm-dev libegl-dev libgl-dev libwayland-dev ruby ruby-dev rubygems build-essential rpm libarchive-tools imagemagick
          version: 1.1

      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y clang cmake ninja-build pkg-config libgtk-3-dev liblzma-dev libstdc++-12-dev libasound2-dev libmpv-dev mpv libx11-dev libxext-dev libxrandr-dev libxcursor-dev libxi-dev libxss-dev libpulse-dev libdbus-1-dev libdrm-dev libgbm-dev libegl-dev libgl-dev libwayland-dev ruby ruby-dev rubygems build-essential rpm libarchive-tools imagemagick

      - name: Install fpm
        run: sudo gem install fpm

      - name: Install dependencies
        run: flutter pub get

      - name: Build Linux x64
        run: flutter build linux --release --dart-define=ENABLE_UPDATE_CHECK=true

      - name: Create tarball
        run: |
          cd build/linux/x64/release/bundle
          tar -czf $GITHUB_WORKSPACE/plezy-linux-x64.tar.gz *

      - name: Build Linux Packages
        run: ARCH_SUFFIX=x64 OUTPUT_DIR=$GITHUB_WORKSPACE python3 linux/packaging/build-packages.py

      - name: Attest Linux x64 artifacts
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: |
            plezy-linux-x64.tar.gz
            plezy-linux-x64.deb
            plezy-linux-x64.rpm
            plezy-linux-x64.pkg.tar.zst

      - name: Upload Linux x64 artifacts
        uses: actions/upload-artifact@v4
        with:
          name: linux-x64
          path: |
            plezy-linux-x64.tar.gz
            plezy-linux-x64.deb
            plezy-linux-x64.rpm
            plezy-linux-x64.pkg.tar.zst

  build-linux-arm64:
    runs-on: ubuntu-24.04-arm
    permissions:
      id-token: write
      attestations: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          channel: "master"
          cache: true

      - name: Cache Pub dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.pub-cache
          key: ${{ runner.os }}-arm64-pub-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            ${{ runner.os }}-arm64-pub-

      - name: Cache APT packages
        uses: awalsh128/cache-apt-pkgs-action@latest
        with:
          packages: clang cmake ninja-build pkg-config libgtk-3-dev liblzma-dev libstdc++-12-dev libasound2-dev libmpv-dev mpv libx11-dev libxext-dev libxrandr-dev libxcursor-dev libxi-dev libxss-dev libpulse-dev libdbus-1-dev libdrm-dev libgbm-dev libegl-dev libgl-dev libwayland-dev ruby ruby-dev rubygems build-essential rpm libarchive-tools imagemagick
          version: 1.1

      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y clang cmake ninja-build pkg-config libgtk-3-dev liblzma-dev libstdc++-12-dev libasound2-dev libmpv-dev mpv libx11-dev libxext-dev libxrandr-dev libxcursor-dev libxi-dev libxss-dev libpulse-dev libdbus-1-dev libdrm-dev libgbm-dev libegl-dev libgl-dev libwayland-dev ruby ruby-dev rubygems build-essential rpm libarchive-tools imagemagick

      - name: Install fpm
        run: sudo gem install fpm

      - name: Install dependencies
        run: flutter pub get

      - name: Build Linux arm64
        run: flutter build linux --release --dart-define=ENABLE_UPDATE_CHECK=true

      - name: Find bundle directory
        id: find-bundle
        run: |
          BUNDLE_DIR=$(find build/linux -path "*/release/bundle" -type d | head -1)
          echo "bundle_dir=$BUNDLE_DIR" >> $GITHUB_OUTPUT

      - name: Create tarball
        run: |
          cd ${{ steps.find-bundle.outputs.bundle_dir }}
          tar -czf $GITHUB_WORKSPACE/plezy-linux-arm64.tar.gz *

      - name: Build Linux Packages
        run: |
          BUILD_DIR=${{ steps.find-bundle.outputs.bundle_dir }} \
          ARCH_SUFFIX=arm64 \
          OUTPUT_DIR=$GITHUB_WORKSPACE \
          python3 linux/packaging/build-packages.py

      - name: Attest Linux arm64 artifacts
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: |
            plezy-linux-arm64.tar.gz
            plezy-linux-arm64.deb
            plezy-linux-arm64.rpm
            plezy-linux-arm64.pkg.tar.zst

      - name: Upload Linux arm64 artifacts
        uses: actions/upload-artifact@v4
        with:
          name: linux-arm64
          path: |
            plezy-linux-arm64.tar.gz
            plezy-linux-arm64.deb
            plezy-linux-arm64.rpm
            plezy-linux-arm64.pkg.tar.zst

  create-release:
    needs: [build-android, build-ios, build-macos, package-windows, build-linux-x64, build-linux-arm64]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts

      - name: Display structure of downloaded files
        run: ls -R artifacts

      - name: Create Release
        uses: softprops/action-gh-release@v1
        with:
          files: |
            artifacts/android-apk/plezy-android-arm64-v8a.tar.gz
            artifacts/android-apk/plezy-android-armeabi-v7a.tar.gz
            artifacts/android-apk/plezy-android-x86_64.tar.gz
            artifacts/ios-ipa/plezy-ios.ipa
            artifacts/macos-dmg/plezy-macos.dmg
            artifacts/windows-x64-portable/plezy-windows-x64-portable.7z
            artifacts/windows-arm64-portable/plezy-windows-arm64-portable.7z
            artifacts/windows-installer/plezy-windows-installer.exe
            artifacts/linux-x64/*
            artifacts/linux-arm64/*
          draft: true
          prerelease: false
          generate_release_notes: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}