release.yml

name: Release (Windows and macOS ARM64)

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  build-windows:
    runs-on: windows-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Derive version from tag
        shell: pwsh
        run: |
          $version = "${{ github.ref_name }}" -replace '^v', ''
          if ([string]::IsNullOrWhiteSpace($version)) {
            throw "Invalid tag: '${{ github.ref_name }}' (expected like v1.0.0)"
          }
          "VERSION=$version" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: |
            frontend/package-lock.json
            desktop/package-lock.json

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version-file: .python-version

      - name: Install uv
        shell: pwsh
        run: python -m pip install uv

      - name: Install frontend dependencies
        working-directory: frontend
        run: npm ci

      - name: Install desktop dependencies
        working-directory: desktop
        run: npm ci

      - name: Run Python tests on Windows
        env:
          PYTHONPATH: src
        run: uv run pytest -q

      - name: Set desktop app version
        working-directory: desktop
        run: npm version $env:VERSION --no-git-tag-version --allow-same-version

      - name: Build Windows installer
        working-directory: desktop
        run: npm run dist:win

      - name: Run desktop tests
        working-directory: desktop
        run: node --test tests/*.test.cjs

      - name: Upload Windows release files
        uses: actions/upload-artifact@v4
        with:
          name: release-windows
          if-no-files-found: error
          path: |
            desktop/dist/*Setup*.exe
            desktop/dist/*Setup*.exe.blockmap
            desktop/dist/latest.yml

  build-macos-arm64:
    runs-on: macos-15
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Verify Apple Silicon runner
        shell: bash
        run: |
          test "$(uname -m)" = "arm64"
          echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: |
            frontend/package-lock.json
            desktop/package-lock.json

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version-file: .python-version

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Rust build
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            native/wce_integrity/target
          key: macos-arm64-rust-${{ hashFiles('native/wce_integrity/Cargo.lock') }}

      - name: Install uv
        run: python -m pip install uv

      - name: Install frontend dependencies
        working-directory: frontend
        run: npm ci

      - name: Install desktop dependencies
        working-directory: desktop
        run: npm ci

      - name: Restore macOS native helper permissions
        run: chmod +x src/wechat_decrypt_tool/native/macos/universal/image_scan_helper

      - name: Set desktop app version
        working-directory: desktop
        run: npm version "$VERSION" --no-git-tag-version --allow-same-version

      - name: Build macOS DMG and ZIP
        working-directory: desktop
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: "false"
        run: npm run dist:mac

      - name: Run Python tests on macOS
        env:
          PYTHONPATH: src
        run: uv run pytest -q

      - name: Run desktop tests
        working-directory: desktop
        run: node --test tests/*.test.cjs

      - name: Smoke-test packaged macOS runtime
        working-directory: desktop
        run: npm run smoke:mac

      - name: Upload macOS release files
        uses: actions/upload-artifact@v4
        with:
          name: release-macos-arm64
          if-no-files-found: error
          path: |
            desktop/dist/*.dmg
            desktop/dist/*.zip
            desktop/dist/*.blockmap
            desktop/dist/latest-mac.yml

  publish-release:
    needs:
      - build-windows
      - build-macos-arm64
    runs-on: ubuntu-latest
    steps:
      - name: Checkout release history
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Download release files
        uses: actions/download-artifact@v4
        with:
          path: release-assets
          merge-multiple: true

      - name: Generate release notes from commits
        shell: bash
        run: |
          set -euo pipefail
          tag="${GITHUB_REF_NAME}"
          previous="$(git tag --list 'v*' --sort=-v:refname | grep -Fvx "$tag" | head -n 1 || true)"
          if [[ -n "$previous" ]]; then
            range="$previous..$tag"
          else
            range="$tag"
          fi
          {
            echo "## 更新内容 ($tag)"
            echo
            git log --no-merges --pretty=format:'- %s (%h)' --reverse -n 60 "$range"
            if [[ -n "$previous" ]]; then
              echo
              echo
              echo "完整变更: https://github.com/${GITHUB_REPOSITORY}/compare/${previous}...${tag}"
            fi
          } > release-notes.md

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          body_path: release-notes.md
          fail_on_unmatched_files: true
          files: release-assets/*