release.yml

name: '跨平台 Release 打包'

# 触发时机：
#   1. 用户在 GitHub 上「发布」一个版本（Release published / 从草稿发布）——主路径；
#   2. 推送 v* 标签；
#   3. 手动触发（可指定标签）。
#   4. main/master 分支推送或 PR：只构建、不上传，用于合并前校验。
on:
  workflow_dispatch:
    inputs:
      tag:
        description: '要构建并上传的版本标签，例如 v1.0.20260920；留空则跟随当前分支或标签'
        required: false
        type: string
  push:
    tags:
      - 'v*'
    branches:
      - main
      - master
  release:
    types: [published, released]
  pull_request:
    branches: [main, master]

permissions:
  contents: write

# 同一标签可能同时被「推标签」和「发布 Release」触发，串行执行避免重复上传
concurrency:
  group: 'tauri-release-${{ github.workflow }}-${{ github.ref }}'
  cancel-in-progress: false

jobs:
  publish-tauri:
    name: '${{ matrix.label }}'
    runs-on: ${{ matrix.platform }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # Windows x64：NSIS 安装包，双击即装即用（缺失 WebView2 时安装器会自动补齐）
          - platform: windows-latest
            label: 'Windows x64 · NSIS'
            args: '--target x86_64-pc-windows-msvc --bundles nsis'
            rust-targets: ''
          # macOS：universal dmg 同时含 x64 + arm64，ad-hoc 签名，无需开发者证书
          - platform: macos-latest
            label: 'macOS Universal · dmg（ad-hoc 签名）'
            args: '--target universal-apple-darwin --bundles dmg'
            rust-targets: 'aarch64-apple-darwin,x86_64-apple-darwin'
          # Linux x64：AppImage，内置 GTK/WebKit 运行时
          - platform: ubuntu-latest
            label: 'Linux x64 · AppImage'
            args: '--target x86_64-unknown-linux-gnu --bundles appimage'
            rust-targets: ''
          # Linux arm64：GitHub 原生 ARM runner，避免 QEMU 全量模拟编译
          - platform: ubuntu-24.04-arm
            label: 'Linux arm64 · AppImage'
            args: '--target aarch64-unknown-linux-gnu --bundles appimage'
            rust-targets: ''
    steps:
      - name: '检出代码'
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.inputs.tag || github.event.release.tag_name || github.ref }}

      - name: '安装 Node.js'
        uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: package-lock.json

      - name: '校验版本号与发布标签一致'
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          INPUT_TAG: ${{ github.event.inputs.tag }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          if [ "$EVENT_NAME" = "pull_request" ]; then
            echo 'PR 校验：跳过发布标签一致性检查。'
            exit 0
          fi
          version="$(node -p "require('./src-tauri/tauri.conf.json').version")"
          tag="${INPUT_TAG:-}"
          if [ "$EVENT_NAME" = "workflow_dispatch" ] && [ -z "$tag" ]; then
            echo '手动触发且未指定标签：只构建，跳过一致性校验。'
            exit 0
          fi
          [ -n "$tag" ] || tag="${RELEASE_TAG:-$REF_NAME}"
          echo "源码版本号: v${version}"
          echo "发布标签:   ${tag:-<未指定>}"
          if [ -z "${tag}" ] || [ "${tag}" = "main" ] || [ "${tag}" = "master" ]; then
            echo '未指定发布标签，跳过一致性校验。'
            exit 0
          fi
          if [ "${tag}" != "v${version}" ]; then
            echo "::error::发布标签 ${tag} 与源码版本号 v${version} 不一致，请先把版本号改成 ${tag#v} 再发布。"
            exit 1
          fi

      - name: '安装 Rust 工具链'
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.rust-targets }}

      - name: '缓存 Rust 编译产物'
        uses: swatinem/rust-cache@v2
        with:
          workspaces: './src-tauri -> target'

      - name: '安装 Linux 打包依赖'
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            build-essential file xdg-utils patchelf \
            libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev

      - name: '安装前端依赖'
        run: npm ci --no-audit --no-fund

      - name: '构建安装包并上传到 Release'
        if: github.event_name == 'release' || github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
        uses: tauri-apps/tauri-action@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # ad-hoc 签名：不需要 Apple 开发者证书，dmg 可正常分发（首次打开需右键 → 打开）
          APPLE_SIGNING_IDENTITY: '-'
        with:
          tagName: 'v__VERSION__'
          releaseName: 'SimpleWebShell Desktop v__VERSION__'
          releaseBody: |
            ## SimpleWebShell Desktop v__VERSION__

            ### 安装包（随版本自动构建，双击即用）
            | 平台 | 安装包 |
            | --- | --- |
            | Windows x64 | `*-x64-setup.exe`（NSIS 安装向导） |
            | macOS Universal（Apple Silicon + Intel） | `*_universal.dmg`（ad-hoc 签名） |
            | Linux x64 | `*_amd64.AppImage` |
            | Linux arm64 | `*_arm64.AppImage` |

            ### 使用方式
            - Windows：双击 `-setup.exe`，按向导完成安装。
            - macOS：打开 dmg，把应用拖入「应用程序」；ad-hoc 签名未做公证，首次启动请右键 → 打开。
            - Linux：先执行 `chmod +x *.AppImage`，再双击运行（AppImage 已内置 GTK/WebKit 运行时）。

            完整性校验见 `SHA256SUMS.txt`、`checksums-md5.txt`、`checksums-sha1.txt`。
          releaseDraft: false
          prerelease: false
          # 由 Release 事件触发时，直接挂到用户已发布的 Release 上，不改写其标题与说明
          releaseId: ${{ github.event.release.id }}
          args: ${{ matrix.args }}
          retryAttempts: 3

      - name: '构建安装包（PR / 分支校验，不上传 Release）'
        if: github.event_name != 'release' && github.event_name != 'workflow_dispatch' && !(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
        shell: bash
        run: npm run tauri build -- ${{ matrix.args }}

      - name: '上传安装包工件（供 SHA256 汇总）'
        uses: actions/upload-artifact@v7
        with:
          name: 'tauri-${{ matrix.platform }}'
          path: |
            src-tauri/target/*/release/bundle/nsis/*-setup.exe
            src-tauri/target/*/release/bundle/dmg/*.dmg
            src-tauri/target/*/release/bundle/appimage/*.AppImage
          if-no-files-found: error
          retention-days: 1

  checksums:
    name: '生成校验文件'
    needs: publish-tauri
    runs-on: ubuntu-latest
    steps:
      - name: '汇总各平台安装包工件'
        uses: actions/download-artifact@v8
        with:
          pattern: 'tauri-*'
          path: artifacts
          merge-multiple: true
      - name: '生成 SHA256/MD5/SHA1 校验文件'
        run: |
          set -euo pipefail
          cd artifacts
          find . -type f \
            ! -name 'SHA256SUMS.txt' \
            ! -name 'checksums-md5.txt' \
            ! -name 'checksums-sha1.txt' -print0 \
            | sort -z | xargs -0 -r sha256sum > SHA256SUMS.txt
          find . -type f \
            ! -name 'SHA256SUMS.txt' \
            ! -name 'checksums-md5.txt' \
            ! -name 'checksums-sha1.txt' -print0 \
            | sort -z | xargs -0 -r md5sum > checksums-md5.txt
          find . -type f \
            ! -name 'SHA256SUMS.txt' \
            ! -name 'checksums-md5.txt' \
            ! -name 'checksums-sha1.txt' -print0 \
            | sort -z | xargs -0 -r sha1sum > checksums-sha1.txt
          cat SHA256SUMS.txt checksums-md5.txt checksums-sha1.txt
      - name: '上传到 Release'
        if: github.event_name == 'release' || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) || (github.event_name == 'workflow_dispatch' && github.event.inputs.tag != '')
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ github.event.inputs.tag || github.event.release.tag_name || github.ref_name }}
          files: |
            artifacts/SHA256SUMS.txt
            artifacts/checksums-md5.txt
            artifacts/checksums-sha1.txt
          fail_on_unmatched_files: true