name: Build & Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      publish:
        description: 'Publish to GitHub Releases'
        required: false
        type: boolean
        default: false

concurrency:
  group: build-${{ github.ref }}
  cancel-in-progress: true

env:
  PNPM_VERSION: '10.24.0'
  NODE_VERSION: '22'
  CI_RELEASE_TAG: ci-build-${{ github.run_id }}

jobs:
  check:
    name: Lint & Typecheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm typecheck
      - run: pnpm lint
      - run: pnpm typecheck:all

  test:
    name: Unit Tests
    runs-on: ubuntu-latest
    needs: check
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm test:unit
      - run: pnpm test:integration

  build-macos:
    if: false
    name: macOS (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    needs: test
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: arm64
            runner: macos-14
            builder_args: --mac --arm64
          - arch: x64
            runner: macos-15
            builder_args: --mac --x64
    steps:
      - uses: actions/checkout@v4

  build-windows:
    if: false
    name: Windows (${{ matrix.arch }})
    runs-on: windows-latest
    needs: test
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x64-ia32
            builder_args: --win --x64 --ia32
          - arch: arm64
            builder_args: --win --arm64
    steps:
      - uses: actions/checkout@v4

  build-linux:
    name: Linux (${{ matrix.arch }})
    runs-on: ubuntu-latest
    needs: test
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x64
            builder_args: --linux --x64
          - arch: arm64
            builder_args: --linux --arm64
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Install snapcraft (x64 only)
        if: matrix.arch == 'x64'
        run: sudo snap install snapcraft --classic
      - name: Build electron-vite
        run: pnpm exec electron-vite build
      - name: Package
        run: pnpm exec electron-builder ${{ matrix.builder_args }} --config electron-builder.yml --publish never
      - name: Upload release files
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release view "$CI_RELEASE_TAG" >/dev/null 2>&1 || \
            gh release create "$CI_RELEASE_TAG" \
              --draft \
              --prerelease \
              --title "CI Build $GITHUB_RUN_ID" \
              --notes "Temporary build artifact transport for Cloudflare publication." \
              --target "$GITHUB_SHA"
          gh release upload "$CI_RELEASE_TAG" \
            build/release/*.AppImage \
            build/release/*.deb \
            build/release/*.rpm \
            build/release/latest-linux.yml \
            --clobber

  release:
    name: Publish Release
    runs-on: ubuntu-latest
    needs: [build-linux]
    if: startsWith(github.ref, 'refs/tags/v') || github.event.inputs.publish == 'true'
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4