deploy.yml

name: Deploy

on:
   push:
      branches: [ "master", "feat/quads", "feat/quads-*" ]
   pull_request:
      # `master` covers shipping work; `feat/quads` is the long-lived
      # quad-migration integration branch (#326) that chunked PRs land
      # on before the final merge to master. The `feat/quads-*` glob
      # covers chunked PRs that target a previous chunk's branch
      # (stacked PRs). Without these, chunked PRs would have no CI
      # safety net.
      branches: [ "master", "feat/quads", "feat/quads-*" ]
   release:
      types: [published]

env:
  # Customize the CMake build type here (Release, Debug, RelWithDebInfo, etc.)
  BUILD_TYPE: Release
  AQT_VERSION: '==3.3.*'
  QT_VERSION: '6.9.3'
  ASSIMP_VERSION: '6.0.4'
  ASSIMP_DIR_VERSION: '6.0'
  OGRE_VERSION: '14.5.2'

jobs:
#  send-slack-notification:
#    runs-on: ubuntu-latest
#    steps:
#       - name: send slack message
#         uses: docker://technosophos/slack-notify
#         env:
#             SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
#             SLACK_MESSAGE: "Building QtMeshEditor in GitHub Actions - works! :D"

####################################################################
# Doc pins (README + website hook) must match CMakeLists project() VERSION
####################################################################

 verify-doc-versions:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Pinned GitHub Action refs match CMakeLists.txt
        run: ./scripts/sync-doc-versions-from-cmake.sh --check

####################################################################
# Asset Scan (runs first, before all builds)
####################################################################

 scan-assets-qtmesh:
    needs: verify-doc-versions
    # Validate repo assets using the published Docker image (latest).
    # Runs on PRs, pushes to master, and releases.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Scan media/ via Docker (ghcr.io/fernandotonon/qtmesh:latest)
        run: |
          set +e
          docker run --rm \
            -v "${{ github.workspace }}:/workspace" \
            -w /workspace \
            ghcr.io/fernandotonon/qtmesh:latest \
            scan --config /workspace/qtmesh.yml --json > qtmesh-scan-report.json
          scan_exit=$?
          set -e

          if [ "$scan_exit" -ne 0 ]; then
            echo "::warning::Docker asset scan reported issues (using latest published image)"
          fi

          if ! jq -e '.summary and .version' qtmesh-scan-report.json >/dev/null 2>&1; then
            echo "::warning::Docker scan output was not valid JSON. Cloud upload will be skipped."
            echo '{}' > qtmesh-scan-report.json
          fi

      - name: Upload scan report to QtMesh Cloud
        if: always()
        env:
          QTMESH_CLOUD_TOKEN: ${{ secrets.QTMESH_CLOUD_TOKEN }}
          QTMESH_CLOUD_API_URL: https://api.qtmesh.dev
          GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || '' }}
        run: |
          if [ -z "${QTMESH_CLOUD_TOKEN:-}" ]; then
            echo "::notice::QTMESH_CLOUD_TOKEN is not set. Skipping QtMesh Cloud upload."
            exit 0
          fi

          if ! jq -e '.summary and .version' qtmesh-scan-report.json >/dev/null 2>&1; then
            echo "::warning::No valid scan JSON payload found. Skipping QtMesh Cloud upload."
            exit 0
          fi

          if [ -n "${GITHUB_PR_NUMBER:-}" ]; then
            jq --arg branch "${GITHUB_REF_NAME}" \
               --arg sha "${GITHUB_SHA}" \
               --arg runId "${GITHUB_RUN_ID}" \
               --argjson pr "${GITHUB_PR_NUMBER}" \
               '. + {meta: {branch: $branch, commitSha: $sha, runId: $runId, prNumber: $pr}}' \
               qtmesh-scan-report.json > qtmesh-scan-upload.json
          else
            jq --arg branch "${GITHUB_REF_NAME}" \
               --arg sha "${GITHUB_SHA}" \
               --arg runId "${GITHUB_RUN_ID}" \
               '. + {meta: {branch: $branch, commitSha: $sha, runId: $runId}}' \
               qtmesh-scan-report.json > qtmesh-scan-upload.json
          fi

          upload_report() {
            local base_url="${1%/}"
            curl --silent --show-error --fail \
              -X POST "${base_url}/v1/ingest/scan" \
              -H "Authorization: Bearer ${QTMESH_CLOUD_TOKEN}" \
              -H "Content-Type: application/json" \
              --data-binary @qtmesh-scan-upload.json >/tmp/qtmesh-cloud-upload-response.json
          }

          if upload_report "${QTMESH_CLOUD_API_URL}"; then
            echo "QtMesh Cloud upload succeeded via ${QTMESH_CLOUD_API_URL}"
            cat /tmp/qtmesh-cloud-upload-response.json
          else
            echo "::warning::QtMesh Cloud upload failed via ${QTMESH_CLOUD_API_URL}."
          fi

      - name: Scan media/ via GitHub Action (root action.yml)
        uses: ./
        with:
          command: scan
          input-file: .
          options: --config /workspace/qtmesh.yml

####################################################################
# Windows Deploy
####################################################################

 build-n-cache-assimp-windows:
   needs: scan-assets-qtmesh
   runs-on: windows-latest
   steps:
    - name: Cache Assimp
      id: cache-assimp-windows
      uses: actions/cache@v3
      env:
        cache-name: cache-assimp-windows-mingw1310
      with:
        # It is caching the folder that also contains source and building files, maybe in the future it would be nice cache only the includes and dll
        path: |
               C:/PROGRA~2/Assimp
        key: ${{ runner.os }}-build-${{ env.cache-name }}

    - if: steps.cache-assimp-windows.outputs.cache-hit != 'true'
      name: Install Qt (for MinGW compiler)
      uses: jurplel/install-qt-action@v3
      with:
        aqtversion: ${{ env.AQT_VERSION }}
        version: ${{ env.QT_VERSION }}
        host: 'windows'
        target: 'desktop'
        arch: 'win64_mingw'
        tools: 'tools_cmake tools_mingw1310'

    - if: steps.cache-assimp-windows.outputs.cache-hit != 'true'
      name: Check out Assimp repo
      uses: actions/checkout@master
      with:
          repository: assimp/assimp
          ref: v${{ env.ASSIMP_VERSION }}
          path: ${{github.workspace}}/assimp

    - if: steps.cache-assimp-windows.outputs.cache-hit != 'true'
      name: Build Assimp repo
      env:
         CMAKE_GENERATOR: "MinGW Makefiles"
         PATH: "D:/a/QtMeshEditor/Qt/Tools/mingw1310_64/bin;D:/a/QtMeshEditor/Qt/Tools/CMake_64/bin;${{ env.PATH }}"
      run: |
        Write-Host "Building Assimp with Qt MinGW 13.1.0"
        Write-Host "gcc version: $(gcc.exe --version | Select-Object -First 1)"
        Write-Host "cmake version: $(cmake --version | Select-Object -First 1)"
        Set-Location "${{github.workspace}}/assimp"
        cmake -S . -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} -DCMAKE_GENERATOR="MinGW Makefiles" -DCMAKE_C_COMPILER="D:/a/QtMeshEditor/Qt/Tools/mingw1310_64/bin/gcc.exe" -DCMAKE_CXX_COMPILER="D:/a/QtMeshEditor/Qt/Tools/mingw1310_64/bin/g++.exe" -DASSIMP_WARNINGS_AS_ERRORS=OFF
        D:/a/QtMeshEditor/Qt/Tools/mingw1310_64/bin/mingw32-make.exe install -j8
        Copy-Item -Recurse -Force "C:/PROGRA~2/Assimp" "${{github.workspace}}/assimp-build"
      shell: powershell
            
 build-n-cache-ogre-windows:
    needs: build-n-cache-assimp-windows
    runs-on: windows-latest
    steps:
    - name: Cache Assimp
      id: cache-assimp-windows
      uses: actions/cache@v3
      env:
        cache-name: cache-assimp-windows-mingw1310
      with:
        path: |
               C:/PROGRA~2/Assimp
        key: ${{ runner.os }}-build-${{ env.cache-name }}

    - name: Cache Ogre
      id: cache-ogre-windows
      uses: actions/cache@v3
      env:
        cache-name: cache-ogre-windows
      with:
        path: ${{github.workspace}}/ogre-build/SDK
        # Need to delete manually if needed to rebuild. Until I find a better solution for detecting changes in the ogre repo.
        key: ${{ runner.os }}-build-${{ env.cache-name }}

    - if: steps.cache-ogre-windows.outputs.cache-hit != 'true'
      name: Install Doxygen
      shell: cmd
      run: |
        curl -L -o doxygen-installer.exe "https://www.doxygen.nl/files/doxygen-1.9.7-setup.exe"
        doxygen-installer.exe /VERYSILENT
            
    - if: steps.cache-ogre-windows.outputs.cache-hit != 'true'
      name: Check out ogre repo
      uses: actions/checkout@master
      with:
          repository: OGRECave/ogre
          ref: v${{ env.OGRE_VERSION }}
          path: ${{github.workspace}}/ogre

    - if: steps.cache-ogre-windows.outputs.cache-hit != 'true'
      name: Install Qt (for MinGW)
      uses: jurplel/install-qt-action@v3
      with:
        aqtversion: ${{ env.AQT_VERSION }}
        version: ${{ env.QT_VERSION }}
        host: 'windows'
        target: 'desktop'
        arch: 'win64_mingw'
        tools: 'tools_cmake tools_mingw1310'
        
    - if: steps.cache-ogre-windows.outputs.cache-hit != 'true'
      name: Add Qt MinGW to PATH for Ogre build
      run: |
        echo "D:/a/QtMeshEditor/Qt/Tools/mingw1310_64/bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
        echo "Added Qt MinGW 13.1.0 to PATH for Ogre build"
        where gcc.exe
        gcc --version
      shell: powershell
           
    - if: steps.cache-ogre-windows.outputs.cache-hit != 'true'
      name: Build Ogre3D
      shell: powershell
      env:
        CMAKE_GENERATOR: "MinGW Makefiles"
        ASSIMP_DIR: "C:/Program Files (x86)/Assimp/lib/cmake/assimp-${{ env.ASSIMP_DIR_VERSION }}/"
        PATH: "D:/a/QtMeshEditor/Qt/Tools/mingw1310_64/bin;D:/a/QtMeshEditor/Qt/Tools/CMake_64/bin;${{ env.PATH }}"
      run: |
        Write-Host "Verifying Ogre build tools:"
        Write-Host "gcc location: $((Get-Command gcc.exe).Source)"
        Write-Host "g++ location: $((Get-Command g++.exe).Source)"
        Write-Host "mingw32-make location: $((Get-Command mingw32-make.exe).Source)"
        Write-Host "cmake location: $((Get-Command cmake.exe).Source)"
        Set-Location "${{github.workspace}}/ogre"
        cmake -B "${{github.workspace}}/ogre-build" -S . -DDOXYGEN_EXECUTABLE="C:\Program Files\doxygen\bin\doxygen.exe" -DCMAKE_C_COMPILER="D:/a/QtMeshEditor/Qt/Tools/mingw1310_64/bin/gcc.exe" -DCMAKE_CXX_COMPILER="D:/a/QtMeshEditor/Qt/Tools/mingw1310_64/bin/g++.exe" -DCMAKE_CXX_STANDARD=17 -DOGRE_BUILD_PLUGIN_ASSIMP=ON -DOGRE_BUILD_PLUGIN_PCZ=ON -DOGRE_BUILD_PLUGIN_DOT_SCENE=ON -DOGRE_BUILD_RENDERSYSTEM_GL=ON -DOGRE_BUILD_RENDERSYSTEM_GL3PLUS=ON -DOGRE_BUILD_RENDERSYSTEM_GLES2=OFF -DOGRE_BUILD_RENDERSYSTEM_D3D9=OFF -DOGRE_BUILD_RENDERSYSTEM_D3D11=OFF -DOGRE_BUILD_TESTS=OFF -DOGRE_BUILD_TOOLS=OFF -DOGRE_BUILD_SAMPLES=OFF -DOGRE_BUILD_COMPONENT_CSHARP=OFF -DOGRE_BUILD_COMPONENT_JAVA=OFF -DOGRE_BUILD_COMPONENT_PYTHON=OFF -DOGRE_INSTALL_TOOLS=OFF -DOGRE_INSTALL_DOCS=OFF -DOGRE_INSTALL_SAMPLES=OFF -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}}
        Set-Location "${{github.workspace}}/ogre-build"
        D:/a/QtMeshEditor/Qt/Tools/mingw1310_64/bin/mingw32-make.exe install -j8
        
 build-windows:
    # The CMake configure and build commands are platform agnostic and should work equally well on Windows or Mac.
    # You can convert this to a matrix build if you need cross-platform coverage.
    # See: https://docs.github.com/en/free-pro-team@latest/actions/learn-github-actions/managing-complex-workflows#using-a-build-matrix
    needs: [build-n-cache-assimp-windows, build-n-cache-ogre-windows]
    runs-on: windows-latest
    steps:
    - uses: actions/checkout@v3
      with:
         submodules: true

    - name: Cache Assimp
      id: cache-assimp-windows
      uses: actions/cache@v3
      env:
        cache-name: cache-assimp-windows-mingw1310
      with:
        # It is caching the folder that also contains source and building files, maybe in the future it would be nice cache only the includes and dll
        path: |
               C:/PROGRA~2/Assimp
        key: ${{ runner.os }}-build-${{ env.cache-name }}
    
    - name: Cache Ogre
      id: cache-ogre-windows
      uses: actions/cache@v3
      env:
        cache-name: cache-ogre-windows
      with:
        path: ${{github.workspace}}/ogre-build/SDK
        # Need to delete manually if needed to rebuild. Until I find a better solution for detecting changes in the ogre repo.
        key: ${{ runner.os }}-build-${{ env.cache-name }}

    - name: Install Qt
      uses: jurplel/install-qt-action@v3
      with:
        aqtversion: ${{ env.AQT_VERSION }}
        version: ${{ env.QT_VERSION }}
        host: 'windows'
        target: 'desktop'
        arch: 'win64_mingw'
        tools: 'tools_cmake tools_mingw1310'
        
    - name: Add Qt MinGW to PATH
      run: |
        echo "D:/a/QtMeshEditor/Qt/Tools/mingw1310_64/bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
        echo "Added Qt MinGW 13.1.0 to PATH"
        where gcc.exe
        gcc --version
      shell: powershell
     
    - name: Configure CMake
      env:
         OGRE_DIR: ${{github.workspace}}/ogre-build/SDK/CMake/
         CMAKE_GENERATOR: "MinGW Makefiles"
         ASSIMP_DIR: C:/PROGRA~2/Assimp
         PATH: "D:/a/QtMeshEditor/Qt/Tools/mingw1310_64/bin;D:/a/QtMeshEditor/Qt/Tools/CMake_64/bin;${{ env.PATH }}"
      run: |
        Write-Host "Verifying compiler paths:"
        Write-Host "gcc location: $((Get-Command gcc.exe).Source)"
        Write-Host "g++ location: $((Get-Command g++.exe).Source)"  
        Write-Host "mingw32-make location: $((Get-Command mingw32-make.exe).Source)"
        Write-Host "cmake location: $((Get-Command cmake.exe).Source)"
        gcc --version
        cmake --version
        cmake -S . -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} -DCMAKE_CXX_FLAGS="-g" -DCMAKE_C_FLAGS="-g" -DQT_QMAKE_EXECUTABLE=qmake -DCMAKE_C_COMPILER="D:/a/QtMeshEditor/Qt/Tools/mingw1310_64/bin/gcc.exe" -DCMAKE_CXX_COMPILER="D:/a/QtMeshEditor/Qt/Tools/mingw1310_64/bin/g++.exe" -DCMAKE_EXE_LINKER_FLAGS=-static -DQt6_DIR=D:/a/QtMeshEditor/Qt/${{env.QT_VERSION}}/mingw_64/lib/cmake/Qt6 -DQT_DIR=D:/a/QtMeshEditor/Qt/${{env.QT_VERSION}}/mingw_64/lib/cmake/Qt6 -DQt6GuiTools_DIR=D:/a/QtMeshEditor/Qt/${{env.QT_VERSION}}/mingw_64/lib/cmake/Qt6GuiTools -DOGRE_DIR=${{github.workspace}}/ogre-build/SDK/CMake/ -DASSIMP_DIR=C:/PROGRA~2/Assimp/lib/cmake/assimp-${{ env.ASSIMP_DIR_VERSION }}
      shell: powershell

    - name: Build
      env:
        PATH: "D:/a/QtMeshEditor/Qt/Tools/mingw1310_64/bin;D:/a/QtMeshEditor/Qt/Tools/CMake_64/bin;${{ env.PATH }}"
      run: |
        Write-Host "Using make from:"
        Write-Host "mingw32-make location: $((Get-Command mingw32-make.exe).Source)"
        mingw32-make --version
        D:/a/QtMeshEditor/Qt/Tools/mingw1310_64/bin/mingw32-make.exe install -j8
      shell: powershell

    - name: Upload debug symbols to Sentry
      if: github.event_name == 'release' && github.event.action == 'published'
      env:
        SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
        SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
        SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
      run: |
        cp "${{github.workspace}}/bin/QtMeshEditor.exe" "${{github.workspace}}/bin/QtMeshEditor.debug.exe"
        "D:/a/QtMeshEditor/Qt/Tools/mingw1310_64/bin/strip.exe" --strip-debug "${{github.workspace}}/bin/QtMeshEditor.exe"
        curl -sL https://sentry.io/get-cli/ | bash
        /usr/local/bin/sentry-cli debug-files upload --include-sources "${{github.workspace}}/bin/QtMeshEditor.debug.exe"
        rm -f "${{github.workspace}}/bin/QtMeshEditor.debug.exe"
      shell: bash

    - name: Copy assimp dll to the binary folder
      run: |
            Write-Host "Checking available DLL files:"
            Get-ChildItem C:/PROGRA~2/Assimp/bin
            if (Test-Path "C:/PROGRA~2/Assimp/bin/libassimp-6.dll") {
                Copy-Item "C:/PROGRA~2/Assimp/bin/libassimp-6.dll" "${{github.workspace}}/bin"
            } elseif (Test-Path "C:/PROGRA~2/Assimp/bin/libassimp.dll") {
                Copy-Item "C:/PROGRA~2/Assimp/bin/libassimp.dll" "${{github.workspace}}/bin"
            } else {
                Write-Host "Looking for any assimp dll files:"
                Copy-Item "C:/PROGRA~2/Assimp/bin/libassimp*.dll" "${{github.workspace}}/bin"
            }
      shell: powershell

    - name: Copy gcc dll to the binary folder
      run: |
            Write-Host "Using Qt MinGW 13.1.0 DLLs"
            $mingwBin = "D:/a/QtMeshEditor/Qt/Tools/mingw1310_64/bin"
            Write-Host "MinGW bin directory: $mingwBin"
            Get-ChildItem "$mingwBin/*.dll" | Where-Object { $_.Name -match "(libgcc|libstdc|libwinpthread)" }
            Copy-Item "$mingwBin/libgcc_s_seh-1.dll" "${{github.workspace}}/bin" -ErrorAction SilentlyContinue
            Copy-Item "$mingwBin/libstdc++-6.dll" "${{github.workspace}}/bin" -ErrorAction SilentlyContinue
            Copy-Item "$mingwBin/libwinpthread-1.dll" "${{github.workspace}}/bin" -ErrorAction SilentlyContinue
            Copy-Item "${{github.workspace}}/src/dependencies/zlib1.dll" "${{github.workspace}}/bin/zlib1__.dll" -ErrorAction SilentlyContinue
            Copy-Item "${{github.workspace}}/src/dependencies/zlib1.dll" "${{github.workspace}}/bin/libzlib.dll" -ErrorAction SilentlyContinue
      shell: powershell

    - name: Copy Qt QML modules for Inspector and Material Editor
      run: |
            $qtDir = "D:/a/QtMeshEditor/Qt/${{ env.QT_VERSION }}/mingw_64"
            $qmlDest = "${{github.workspace}}/bin/qml"
            New-Item -ItemType Directory -Force -Path $qmlDest | Out-Null
            Copy-Item -Recurse "$qtDir/qml/QtQuick" "$qmlDest/" -ErrorAction SilentlyContinue
            Copy-Item -Recurse "$qtDir/qml/QtQml" "$qmlDest/" -ErrorAction SilentlyContinue
            Write-Host "QML modules copied to $qmlDest"
            Get-ChildItem $qmlDest -Directory
            # Verify critical modules were copied
            if (-not (Test-Path "$qmlDest/QtQuick")) {
                Write-Error "Critical: QtQuick module not found after copy"
                exit 1
            }
            if (-not (Test-Path "$qmlDest/QtQml")) {
                Write-Error "Critical: QtQml module not found after copy"
                exit 1
            }
      shell: powershell

    - name: Copy Qt QML runtime libraries
      run: |
            $qtDir = "D:/a/QtMeshEditor/Qt/${{ env.QT_VERSION }}/mingw_64"
            $dest = "${{github.workspace}}/bin"
            foreach ($lib in @("Qt6QuickControls2", "Qt6QuickControls2Impl", "Qt6QuickControls2Basic",
                               "Qt6QuickControls2BasicStyleImpl", "Qt6QuickTemplates2", "Qt6QuickLayouts",
                               "Qt6QuickDialogs2", "Qt6QuickDialogs2Utils", "Qt6QuickDialogs2QuickImpl",
                               "Qt6OpenGL")) {
                $dll = "$qtDir/bin/${lib}.dll"
                if (Test-Path $dll) {
                    Copy-Item $dll $dest
                    Write-Host "Copied $lib.dll"
                }
            }
      shell: powershell

    - name: Remove test-only dance models from package
      run: |
            Remove-Item "${{github.workspace}}/bin/media/models/Twist Dance.fbx" -ErrorAction SilentlyContinue
            Remove-Item "${{github.workspace}}/bin/media/models/Rumba Dancing.fbx" -ErrorAction SilentlyContinue
            Remove-Item "${{github.workspace}}/bin/media/models/Hip Hop Dancing.fbx" -ErrorAction SilentlyContinue
      shell: powershell

    - name: Smoke-test CLI (bin directory)
      shell: powershell
      run: |
        $exe = "${{github.workspace}}\bin\qtmesh.exe"
        Write-Host "Running: $exe --version"
        $output = & $exe --version
        $exitCode = $LASTEXITCODE
        Write-Host "Output: $output"
        Write-Host "Exit code: $exitCode"
        if ($output -notmatch "qtmesh \d+\.\d+\.\d+") {
          Write-Error "CLI smoke test FAILED: output '$output' does not match expected 'qtmesh X.Y.Z'"
          exit 1
        }
        # Note: qtmesh.exe may exit with STATUS_DLL_NOT_FOUND (0xC0000135, -1073741515)
        # during ExitProcess() DLL unload on Windows — a known MinGW DLL detach artifact
        # when the exit happens before Ogre statics are initialised. This does not indicate
        # a functional failure; the version string was produced correctly.
        # Fail only on codes that mean a genuine crash (non-negative non-zero).
        if ($exitCode -gt 0) {
          Write-Error "CLI smoke test FAILED: exe exited with code $exitCode"
          exit 1
        }
        Write-Host "CLI smoke test PASSED"
        exit 0

    - name: Upload Artifact
      if: github.event_name == 'release' && github.event.action == 'published'
      uses: actions/upload-artifact@v4
      with:
        name: QtMeshEditor-${{github.ref_name}}-bin-Windows
        path: ${{github.workspace}}/bin

    - name: Compress File
      if: github.event_name == 'release' && github.event.action == 'published'
      run: Compress-Archive ${{github.workspace}}/bin QtMeshEditor-${{github.ref_name}}-bin-Windows.zip
      shell: powershell

    - name: Smoke-test CLI from zip
      if: github.event_name == 'release' && github.event.action == 'published'
      shell: powershell
      run: |
        $zipFile = "QtMeshEditor-${{github.ref_name}}-bin-Windows.zip"
        $testDir = "${{github.workspace}}\smoketest-zip"
        New-Item -ItemType Directory -Force -Path $testDir | Out-Null
        Expand-Archive -Path $zipFile -DestinationPath $testDir -Force
        $version = "${{github.ref_name}}".TrimStart("v")
        $exe = "$testDir\bin\qtmesh.exe"
        Write-Host "Running: $exe --version"
        $output = & $exe --version
        $exitCode = $LASTEXITCODE
        Write-Host "Output: $output"
        Write-Host "Exit code: $exitCode"
        if ($output -notmatch [regex]::Escape($version)) {
          Write-Error "Zip smoke test FAILED: expected version '$version' in output '$output'"
          exit 1
        }
        # STATUS_DLL_NOT_FOUND (0xC0000135, -1073741515) during DLL detach is a known MinGW artifact
        if ($exitCode -gt 0) {
          Write-Error "Zip smoke test FAILED: exe exited with code $exitCode"
          exit 1
        }
        Write-Host "Zip smoke test PASSED"
        exit 0

    - name: Uploadfile to release
      if: github.event_name == 'release' && github.event.action == 'published'
      uses: xresloader/upload-to-github-release@main
      env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
          file: QtMeshEditor-${{github.ref_name}}-bin-Windows.zip
          update_latest_release: true
          overwrite: false
          verbose: true

####################################################################
# Linux Deploy
####################################################################

 build-n-cache-assimp-linux:
    needs: scan-assets-qtmesh
    runs-on: ubuntu-latest
    steps:
    - name: change folder permissions
      run: |
            sudo chmod 777 /usr/local/lib
            sudo chmod 777 /usr/local/include
      
    - name: Cache Assimp
      id: cache-assimp-linux
      uses: actions/cache@v3
      env:
        cache-name: cache-assimp-linux
      with:
        # Assimp cache files are stored in `/home/runner/work/QtMeshEditor/QtMeshEditor/assimp` on Linux
        path: |
               /usr/local/lib/cmake/
               /usr/local/include/assimp
               /usr/local/include/contrib
               /usr/local/lib/pkgconfig/assimp.pc
               /usr/local/lib/libassimp*
               /usr/local/lib/libzlibstatic.a
        #key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('/home/runner/work/QtMeshEditor/QtMeshEditor/assimp') }}
        # Need to delete manually if needed to rebuild. Until I find a better solution for detecting changes in the assimp repo.
        key: ${{ runner.os }}-build-${{ env.cache-name }}

    - if: steps.cache-assimp-linux.outputs.cache-hit != 'true'
      name: Check out Assimp repo
      uses: actions/checkout@master
      with:
          repository: assimp/assimp
          ref: v${{ env.ASSIMP_VERSION }}
          path: /home/runner/work/QtMeshEditor/QtMeshEditor/assimp
            
    - if: steps.cache-assimp-linux.outputs.cache-hit != 'true'
      name: Build Assimp repo
      run: |
            cmake -B /home/runner/work/QtMeshEditor/QtMeshEditor/assimp-build -S /home/runner/work/QtMeshEditor/QtMeshEditor/assimp -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}}
            cd /home/runner/work/QtMeshEditor/QtMeshEditor/assimp-build/
            sudo make install -j8

 build-n-cache-ogre-linux:
    needs: build-n-cache-assimp-linux
    runs-on: ubuntu-latest
    steps:        
    - name: change folder permissions
      run: |
            sudo chmod 777 /usr/local/lib
            sudo chmod 777 /usr/local/include
            sudo chmod 777 /usr/local/share
      
    - name: Cache Ogre
      id: cache-ogre-linux
      uses: actions/cache@v3
      env:
        cache-name: cache-ogre-linux
      with:
        path: |
               /usr/local/lib/lib*
               /usr/local/share/OGRE/
               /usr/local/share/OGRE*
               /usr/local/include/OGRE/
               /usr/local/lib/OGRE/
               /usr/local/lib/pkgconfig/
        key: ${{ runner.os }}-build-${{ env.cache-name }}

    - if: steps.cache-ogre-linux.outputs.cache-hit != 'true'
      name: Cache Assimp
      id: cache-assimp-linux
      uses: actions/cache@v3
      env:
        cache-name: cache-assimp-linux
      with:
        # Assimp cache files are stored in `/home/runner/work/QtMeshEditor/assimp` on Linux/macOS
        path: |
               /usr/local/lib/cmake/
               /usr/local/include/assimp
               /usr/local/include/contrib
               /usr/local/lib/pkgconfig/assimp.pc
               /usr/local/lib/libassimp*
               /usr/local/lib/libzlibstatic.a
        #key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('/home/runner/work/QtMeshEditor/QtMeshEditor/assimp') }}
        # Need to delete manually if needed to rebuild. Until I find a better solution for detecting changes in the assimp repo.
        key: ${{ runner.os }}-build-${{ env.cache-name }}

    - if: steps.cache-ogre-linux.outputs.cache-hit != 'true'
      name: install openGL
      run: |
            sudo apt update
            sudo apt-get install freeglut3-dev libxrandr-dev
            
    - if: steps.cache-ogre-linux.outputs.cache-hit != 'true'
      name: Check out ogre repo
      uses: actions/checkout@master
      with:
          repository: OGRECave/ogre
          ref: v${{ env.OGRE_VERSION }}
          path: /home/runner/work/QtMeshEditor/QtMeshEditor/ogre
         
    - if: steps.cache-ogre-linux.outputs.cache-hit != 'true'
      name: Build Ogre3D repo
      run: |
            sudo cmake -B /home/runner/work/QtMeshEditor/QtMeshEditor/ogre-build \
            -S /home/runner/work/QtMeshEditor/QtMeshEditor/ogre \
            -DOGRE_BUILD_PLUGIN_ASSIMP=ON -Dassimp_DIR=/usr/local/lib/cmake/assimp-${{ env.ASSIMP_DIR_VERSION }} \
            -DOGRE_BUILD_PLUGIN_DOT_SCENE=ON -DOGRE_BUILD_RENDERSYSTEM_GL=ON \
            -DOGRE_BUILD_RENDERSYSTEM_GL3PLUS=ON -DOGRE_BUILD_RENDERSYSTEM_GLES2=OFF \
            -DOGRE_BUILD_TESTS=OFF -DOGRE_BUILD_TOOLS=OFF -DOGRE_BUILD_SAMPLES=OFF \
            -DOGRE_BUILD_COMPONENT_CSHARP=OFF -DOGRE_BUILD_COMPONENT_JAVA=OFF \
            -DOGRE_BUILD_COMPONENT_BULLET=OFF \
            -DOGRE_BUILD_COMPONENT_PYTHON=OFF -DOGRE_INSTALL_TOOLS=OFF \
            -DOGRE_INSTALL_DOCS=OFF -DOGRE_INSTALL_SAMPLES=OFF \
            -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}}
            cd /home/runner/work/QtMeshEditor/QtMeshEditor/ogre-build/
            sudo make install -j8
      
 build-linux:
    needs: [build-n-cache-assimp-linux, build-n-cache-ogre-linux]
    runs-on: ubuntu-latest
    env: 
      LD_LIBRARY_PATH: /usr/local/lib/:/usr/local/lib/OGRE/:/usr/local/lib/pkgconfig/
    steps:
    - uses: actions/checkout@v3.5.3
      with:
         submodules: true
           
    - name: Install Qt
      uses: jurplel/install-qt-action@v3
      with:
        aqtversion: ${{ env.AQT_VERSION }}
        version: ${{ env.QT_VERSION }}
        host: 'linux'
        target: 'desktop'
        arch: 'linux_gcc_64'

    - name: change folder permissions
      run: |
          sudo chmod 777 /usr/local/lib
          sudo chmod 777 /usr/local/include
          sudo chmod 777 /usr/local/share
        
    - name: Cache Assimp
      id: cache-assimp-linux
      uses: actions/cache@v3
      env:
        cache-name: cache-assimp-linux
      with:
        path: |
               /usr/local/lib/cmake/
               /usr/local/include/assimp
               /usr/local/include/contrib
               /usr/local/lib/pkgconfig/assimp.pc
               /usr/local/lib/libassimp*
               /usr/local/lib/libzlibstatic.a
        key: ${{ runner.os }}-build-${{ env.cache-name }}
        restore-keys: |
          ${{ runner.os }}-build-${{ env.cache-name }}-
    
    - name: Cache Ogre
      id: cache-ogre-linux
      uses: actions/cache@v3
      env:
        cache-name: cache-ogre-linux
      with:
        path: |
               /usr/local/lib/lib*
               /usr/local/share/OGRE/
               /usr/local/share/OGRE*
               /usr/local/include/OGRE/
               /usr/local/lib/OGRE/
               /usr/local/lib/pkgconfig/
        key: ${{ runner.os }}-build-${{ env.cache-name }}

    - name: Install Sentry dependencies
      run: sudo apt-get update && sudo apt-get install -y libcurl4-openssl-dev

    - name: Configure CMake
      run: |
            sudo cmake -S . -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} \
            -DCMAKE_CXX_FLAGS="-g" -DCMAKE_C_FLAGS="-g" \
            -DENABLE_STABLE_DIFFUSION=ON \
            -DASSIMP_DIR=/usr/local/lib/cmake/assimp-${{ env.ASSIMP_DIR_VERSION }} \
            -DASSIMP_INCLUDE_DIR=/usr/local/include/assimp \
            -DQt6_DIR=/home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/cmake/Qt6 \
            -DQT_DIR=/home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/cmake/Qt6 \
            -DQt6GuiTools_DIR=/home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/cmake/Qt6GuiTools

    - name: Build
      run: sudo make install -j8

    - name: Upload debug symbols to Sentry
      if: github.event_name == 'release' && github.event.action == 'published'
      env:
        SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
        SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
        SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
      run: |
        # Extract debug symbols, strip binary, upload to Sentry
        sudo objcopy --only-keep-debug ./bin/QtMeshEditor ./bin/QtMeshEditor.debug
        sudo strip --strip-debug --strip-unneeded ./bin/QtMeshEditor
        sudo objcopy --add-gnu-debuglink=./bin/QtMeshEditor.debug ./bin/QtMeshEditor
        curl -sL https://sentry.io/get-cli/ | bash
        sentry-cli debug-files upload --include-sources ./bin/QtMeshEditor.debug
        sudo rm -f ./bin/QtMeshEditor.debug

    - name: Add missing libraries
      run: |
            # Create the bin directory since cmake builds to build/bin but we need ./bin for the tests
            mkdir -p ./bin
            mkdir -p ./build/bin
            
            # Copy Qt ICU libraries to both locations
            sudo cp -R /home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/libicui18n.* ./bin
            sudo cp -R /home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/libicuuc.* ./bin
            sudo cp -R /home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/libicudata.* ./bin
            
            # Also copy to build/bin where cmake actually puts the executables
            sudo cp -R /home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/libicui18n.* ./build/bin/ || true
            sudo cp -R /home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/libicuuc.* ./build/bin/ || true
            sudo cp -R /home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/libicudata.* ./build/bin/ || true
            
            # Copy libraries to system locations
            sudo cp -R ./bin/*.so* /lib/x86_64-linux-gnu || true
            sudo cp -R /usr/local/lib/OGRE/* /lib/x86_64-linux-gnu || true
            sudo cp -R /usr/local/lib/OGRE/* ./bin || true
            sudo cp -R /usr/local/lib/OGRE/* ./build/bin/ || true
  
    - name: Manual Pack
      run: |
            echo "Creating folders 'n files"
            mkdir -p ./pack-deb/usr/bin
            mkdir -p ./pack-deb/usr/share/qtmesheditor/
            mkdir -p ./pack-deb/usr/share/qtmesheditor/cfg/
            mkdir -p ./pack-deb/usr/share/qtmesheditor/media/
            mkdir -p ./pack-deb/usr/share/qtmesheditor/platforms/
            mkdir -p ./pack-deb/usr/lib/qtmesheditor/
            mkdir -p ./pack-deb/usr/share/doc/qtmesheditor/
            mkdir ./pack-deb/DEBIAN/
            cp ./bin/DEBIAN-control ./pack-deb/DEBIAN/control
            cp ./bin/QtMeshEditor ./pack-deb/usr/share/qtmesheditor/qtmesheditor

            # Create proper launcher script
            printf '#!/bin/sh\nexport LD_LIBRARY_PATH="/usr/lib/qtmesheditor:${LD_LIBRARY_PATH}"\nexport QML2_IMPORT_PATH="/usr/share/qtmesheditor/qml:${QML2_IMPORT_PATH}"\n# Ogre requires X11 window handles; force XCB under Wayland\nexport QT_QPA_PLATFORM="${QT_QPA_PLATFORM:-xcb}"\nexec /usr/share/qtmesheditor/qtmesheditor "$@"\n' > ./pack-deb/usr/bin/qtmesheditor
            chmod 755 ./pack-deb/usr/bin/qtmesheditor

            # Create qtmesh symlink for CLI mode (name starts with "qtmesh" but not "qtmesheditor")
            ln -sf qtmesheditor ./pack-deb/usr/bin/qtmesh

            # Copy copyright file
            cp ./DEBIAN-copyright ./pack-deb/usr/share/doc/qtmesheditor/copyright

            cp -R ./bin/cfg/ ./pack-deb/usr/share/qtmesheditor/
            # Fix OGRE plugin path: CI build hardcodes /usr/local/lib/OGRE but
            # the .deb bundles plugins in /usr/lib/qtmesheditor/
            sed -i 's|^PluginFolder=.*|PluginFolder=/usr/lib/qtmesheditor|' ./pack-deb/usr/share/qtmesheditor/cfg/plugins.cfg
            sudo chmod -R 755 ./pack-deb/usr/share/qtmesheditor/cfg
            cp -R ./bin/media/ ./pack-deb/usr/share/qtmesheditor/
            # Remove large dance model files used only for testing
            rm -f ./pack-deb/usr/share/qtmesheditor/media/models/"Twist Dance.fbx"
            rm -f ./pack-deb/usr/share/qtmesheditor/media/models/"Rumba Dancing.fbx"
            rm -f ./pack-deb/usr/share/qtmesheditor/media/models/"Hip Hop Dancing.fbx"
            cp -R ./bin/platforms/ ./pack-deb/usr/share/qtmesheditor/
            if [ -d ./bin/tls ]; then
              cp -R ./bin/tls/ ./pack-deb/usr/share/qtmesheditor/tls/
            fi

            # Copy bundled libraries to private lib directory
            cp -R ./bin/*.so* ./pack-deb/usr/lib/qtmesheditor/

            # Bundle Assimp (built from source at /usr/local/lib, not in ./bin/)
            cp -R /usr/local/lib/libassimp.so* ./pack-deb/usr/lib/qtmesheditor/

            # Bundle Ogre component libs from /usr/local/lib/ that are not in the
            # OGRE plugin dir (e.g. libOgreMeshLodGenerator, libOgreOverlay, etc.)
            cp /usr/local/lib/libOgre*.so* ./pack-deb/usr/lib/qtmesheditor/ 2>/dev/null || true

            # Copy Qt QML modules for Material Editor
            QT_DIR="/home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64"
            mkdir -p ./pack-deb/usr/share/qtmesheditor/qml
            cp -R "$QT_DIR/qml/QtQuick" ./pack-deb/usr/share/qtmesheditor/qml/
            cp -R "$QT_DIR/qml/QtQml" ./pack-deb/usr/share/qtmesheditor/qml/

            # Copy Qt QML runtime libraries
            for lib in QuickControls2 QuickControls2Impl QuickControls2Basic QuickControls2BasicStyleImpl \
                       QuickDialogs2 QuickDialogs2Utils QuickDialogs2QuickImpl \
                       QuickTemplates2 QuickLayouts Quick QmlModels QmlMeta QmlWorkerScript Qml QmlCore \
                       OpenGL; do
                cp -R "$QT_DIR/lib/libQt6${lib}.so"* ./pack-deb/usr/lib/qtmesheditor/ 2>/dev/null || true
            done

            dpkg-deb --build --root-owner-group pack-deb
            mv pack-deb.deb qtmesheditor_amd64.deb
    
    - uses: actions/upload-artifact@v4
      if: github.event_name == 'release' && github.event.action == 'published'
      with:
        name: linux-binaries
        path: ${{github.workspace}}/*.deb

    - if: github.event_name == 'release' && github.event.action == 'published'
      uses: xresloader/upload-to-github-release@main
      env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
          file: ${{github.workspace}}/*.deb
          update_latest_release: true
          overwrite: false
          verbose: true

####################################################################
# Unit Tests - on Linux 
####################################################################
      
 unit-tests-linux:
    # Skip unit tests on release — they already ran on the PR and master push
    if: github.event_name != 'release'
    needs: [build-n-cache-assimp-linux, build-n-cache-ogre-linux]
    runs-on: ubuntu-latest
    permissions: read-all
    env: 
          LD_LIBRARY_PATH: gcc_64/lib/:/usr/local/lib/:/usr/local/lib/OGRE/:/usr/local/lib/pkgconfig/:/lib/x86_64-linux-gnu/
          QT_QPA_PLATFORM: xcb
          QT_DEBUG_PLUGINS: 0
          DISPLAY: :99
    steps:
    - uses: actions/checkout@v3.5.3
      with:
         submodules: true
         fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis

    - name: Fix broken apt repositories
      run: |
            # Remove Microsoft repos that frequently return 403/signature errors on GitHub runners
            sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list /etc/apt/sources.list.d/azure-cli.list || true
            sudo apt-get update || true

    - name: Install Qt
      uses: jurplel/install-qt-action@v3
      with:
        aqtversion: ${{ env.AQT_VERSION }}
        version: ${{ env.QT_VERSION }}
        host: 'linux'
        target: 'desktop'
        arch: 'linux_gcc_64'

    - name: change folder permissions
      run: |
            sudo chmod 777 /usr/local/lib
            sudo chmod 777 /usr/local/include
            sudo chmod 777 /usr/local/share
        
    - name: Cache Assimp
      id: cache-assimp-linux
      uses: actions/cache@v3
      env:
        cache-name: cache-assimp-linux
      with:
        path: |
               /usr/local/lib/cmake/
               /usr/local/include/assimp
               /usr/local/include/contrib
               /usr/local/lib/pkgconfig/assimp.pc
               /usr/local/lib/libassimp*
               /usr/local/lib/libzlibstatic.a
        key: ${{ runner.os }}-build-${{ env.cache-name }}
        restore-keys: |
          ${{ runner.os }}-build-${{ env.cache-name }}-
 
    - name: Cache Ogre
      id: cache-ogre-linux
      uses: actions/cache@v3
      env:
        cache-name: cache-ogre-linux
      with:
        path: |
               /usr/local/lib/lib*
               /usr/local/share/OGRE/
               /usr/local/share/OGRE*
               /usr/local/include/OGRE/
               /usr/local/lib/OGRE/
               /usr/local/lib/pkgconfig/
        key: ${{ runner.os }}-build-${{ env.cache-name }}

    - name: Install Build Wrapper
      uses: SonarSource/sonarqube-scan-action/install-build-wrapper@v4
      env:
        SONAR_HOST_URL: https://sonarcloud.io

    - name: Install sonar-scanner
      run: |
        npm install -g sonar-scanner

    - name: Setup ccache
      # Cache compiler outputs across CI runs so the test build (the
      # slowest step in this job, dominated by ~500 .cpp compiles)
      # gets near-instant replays for files that haven't changed.
      # The cache survives across PRs via the shared key prefix.
      uses: hendrikmuhs/ccache-action@v1.2
      with:
        key: sonar-tests-${{ runner.os }}
        max-size: 2G
        # ccache wraps gcc/g++ so build-wrapper still sees every
        # invocation it needs to record for SonarCloud.
        create-symlink: true

    - name: Setup headless environment for Qt tests
      run: |
            sudo apt-get update
            sudo apt-get install -y libxcb-cursor0 libxcb-xinerama0 libx11-dev xvfb \
                mesa-utils libgl1-mesa-dri libegl-mesa0 libgbm1 libglx-mesa0
            # Start Xvfb with GLX support for Ogre GL initialization
            Xvfb :99 -screen 0 1024x768x24 +extension GLX > /dev/null 2>&1 &
            sleep 3
            echo "DISPLAY=:99" >> $GITHUB_ENV
            echo "QT_QPA_PLATFORM=xcb" >> $GITHUB_ENV
            # Force Mesa software rendering (llvmpipe) - avoids DRI3 hardware errors in CI
            echo "LIBGL_ALWAYS_SOFTWARE=1" >> $GITHUB_ENV
            echo "MESA_GL_VERSION_OVERRIDE=3.3" >> $GITHUB_ENV

    - name: Configure CMake for Tests
      env:
        # ccache + coverage flags interact awkwardly: the default
        # hash includes the absolute build directory and source mtimes,
        # which guarantees a cache miss on every CI run since the runner
        # is ephemeral. Loosening these makes the cache effective without
        # affecting correctness — gcov still emits .gcda at runtime, so
        # coverage data is regenerated per test run regardless.
        CCACHE_SLOPPINESS: pch_defines,time_macros,include_file_mtime,include_file_ctime
        CCACHE_NOHASHDIR: "true"
      run: |
            mkdir build
            cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug \
            -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
            -DCMAKE_C_COMPILER_LAUNCHER=ccache \
            -DASSIMP_DIR=/usr/local/lib/cmake/assimp-${{ env.ASSIMP_DIR_VERSION }} \
            -DASSIMP_INCLUDE_DIR=/usr/local/include/assimp \
            -DQt6_DIR=/home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/cmake/Qt6 \
            -DQT_DIR=/home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/cmake/Qt6 \
            -DQt6GuiTools_DIR=/home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/cmake/Qt6GuiTools \
            -DBUILD_TESTS=ON -DCMAKE_CXX_FLAGS="--coverage -fprofile-arcs -ftest-coverage -O0 -DCOVERAGE_BUILD" \
            -DCMAKE_C_FLAGS="--coverage -fprofile-arcs -ftest-coverage -O0 -DCOVERAGE_BUILD" \
            -DCMAKE_EXE_LINKER_FLAGS="--coverage" \
            -DBUILD_QT_MESH_EDITOR=OFF \
            -DENABLE_SENTRY=OFF \
            -DENABLE_PS1_RIP=ON

    - name: Run build-wrapper
      env:
        CCACHE_SLOPPINESS: pch_defines,time_macros,include_file_mtime,include_file_ctime
        CCACHE_NOHASHDIR: "true"
      run: |
          echo "=== Running build-wrapper for SonarCloud analysis ==="

          # NB: no `make clean` — ccache handles correctness via its hash,
          # and incremental builds let unchanged TUs replay as cached hits.
          # build-wrapper still records every compile invocation it sees
          # (ccache wraps the compiler, so build-wrapper's intercept is
          # transparent to the cache layer).

          # Run build-wrapper to capture compilation into a named directory
          build-wrapper-linux-x86-64 --out-dir build-wrapper-output make -C build -j$(nproc)

          echo "=== ccache statistics ==="
          ccache -s || true

          echo "=== Build wrapper completed ==="
          ls -la build-wrapper-output/ || echo "Build wrapper output directory not created"
          ls -la build-wrapper-output/build-wrapper-dump.json 2>/dev/null || echo "build-wrapper-dump.json not found"

    - name: Add missing libraries
      run: |
            # Debug build puts executables in build/debug/, Release in build/bin/
            mkdir -p ./bin
            mkdir -p ./build/bin
            mkdir -p ./build/debug

            # Copy Qt ICU libraries
            sudo cp -R /home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/libicui18n.* ./bin
            sudo cp -R /home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/libicuuc.* ./bin
            sudo cp -R /home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/libicudata.* ./bin

            sudo cp -R /home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/libicui18n.* ./build/debug/ || true
            sudo cp -R /home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/libicuuc.* ./build/debug/ || true
            sudo cp -R /home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/libicudata.* ./build/debug/ || true

            sudo cp -R /home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/libicui18n.* ./build/bin/ || true
            sudo cp -R /home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/libicuuc.* ./build/bin/ || true
            sudo cp -R /home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/libicudata.* ./build/bin/ || true

            # Copy libraries to system locations
            sudo cp -R ./bin/*.so* /lib/x86_64-linux-gnu || true
            sudo cp -R /usr/local/lib/OGRE/* /lib/x86_64-linux-gnu || true
            sudo cp -R /usr/local/lib/OGRE/* ./bin || true
            sudo cp -R /usr/local/lib/OGRE/* ./build/bin/ || true
            sudo cp -R /usr/local/lib/OGRE/* ./build/debug/ || true

    - name: Run Comprehensive Test Suite
      env:
         QT_QPA_PLATFORM: xcb
         QT_DEBUG_PLUGINS: 0
         DISPLAY: :99
         LIBGL_ALWAYS_SOFTWARE: 1
         MESA_GL_VERSION_OVERRIDE: "3.3"
      run: |
            # Disable errexit so test crashes (SIGSEGV=139) don't abort the step.
            # We track failures/crashes manually and check at the end.
            set +e
            export QT_QPA_PLATFORM="xcb"
            export QT_DEBUG_PLUGINS=0
            export LIBGL_ALWAYS_SOFTWARE=1
            export MESA_GL_VERSION_OVERRIDE=3.3
            sudo cp -R /home/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/gcc_64/lib/ /lib/x86_64-linux-gnu/
            export DISPLAY=:99
            
            # Function to find test executable path
            find_test() {
                local test_name=$1
                if [ -f "./build/debug/$test_name" ]; then
                    echo "./build/debug/$test_name"
                elif [ -f "./build/bin/$test_name" ]; then
                    echo "./build/bin/$test_name"
                elif [ -f "./bin/$test_name" ]; then
                    echo "./bin/$test_name"
                else
                    echo ""
                fi
            }

            # Function to run a test executable (optionally with gtest_filter)
            run_test() {
                local test_name=$1
                local output_file=$2
                local filter=${3:-}
                local test_path
                test_path=$(find_test "$test_name")

                if [ -z "$test_path" ]; then
                    echo "ERROR: $test_name not found in ./build/debug/, ./build/bin/, or ./bin/"
                    find build -name "$test_name" -type f 2>/dev/null || true
                    return 1
                fi

                echo "Found $test_name at $test_path"
                local exit_code=0
                local expected_tests
                if [ -n "$filter" ]; then
                    expected_tests=$(count_listed_tests "$test_path" "$filter")
                else
                    expected_tests=$(count_listed_tests "$test_path")
                fi
                if [ -n "$filter" ]; then
                    $test_path --gtest_output=xml:$output_file --gtest_filter="$filter"
                else
                    $test_path --gtest_output=xml:$output_file
                fi

                exit_code=$?
                if [ $exit_code -ne 0 ]; then
                    return $exit_code
                fi

                local actual_tests
                actual_tests=$(count_testcases_in_xml "$output_file")
                if [ "$actual_tests" -ne "$expected_tests" ]; then
                    echo "ERROR: $test_name ran $actual_tests/$expected_tests discovered test(s)."
                    return 1
                fi

                local skipped_count
                skipped_count=$(count_skipped_in_xml "$output_file")
                if [ "$skipped_count" -gt 0 ]; then
                    echo "ERROR: $test_name produced $skipped_count skipped test(s)."
                    SKIPPED_TESTS=$((SKIPPED_TESTS + skipped_count))
                    return 1
                fi

                return 0
            }

            TOTAL_SUITES=0
            PASSED_SUITES=0
            CRASHED_SUITES=0
            FAILED_SUITES=0
            SKIPPED_TESTS=0

            # Suites that create a real OgreWidget + GL context are known to SIGSEGV
            # under Mesa/Xvfb on CI (same root cause as the skipped MCP GL tests).
            # Crashes in these suites are treated as warnings, not build failures.
            GL_CRASH_ALLOWLIST="SpaceCameraWidgetIntegrationTest OgreWidgetTest ViewCubeControllerOgreTest"

            is_gl_crash_allowed() {
                local suite="$1"
                for allowed in $GL_CRASH_ALLOWLIST; do
                    [ "$suite" = "$allowed" ] && return 0
                done
                return 1
            }

            count_skipped_in_xml() {
                local xml_file=$1
                if [ ! -f "$xml_file" ]; then
                    echo "0"
                    return 0
                fi
                # Treat any non-executed gtest result as a CI failure.
                # gtest may encode these as result="skipped", status="notrun",
                # or result="suppressed" (e.g., disabled tests).
                grep -E '<testcase[^>]*(result="skipped"|status="notrun"|result="suppressed")' "$xml_file" | wc -l
            }

            count_testcases_in_xml() {
                local xml_file=$1
                if [ ! -f "$xml_file" ]; then
                    echo "0"
                    return 0
                fi
                grep '<testcase ' "$xml_file" | wc -l
            }

            count_listed_tests() {
                local test_path=$1
                local filter=${2:-}
                if [ -n "$filter" ]; then
                    $test_path --gtest_filter="$filter" --gtest_list_tests 2>/dev/null | grep -E '^  [^[:space:]]' | wc -l
                else
                    $test_path --gtest_list_tests 2>/dev/null | grep -E '^  [^[:space:]]' | wc -l
                fi
            }

            # === Run UnitTests: each test suite in its own process ===
            # This prevents a crash in one suite (e.g. Ogre GL init segfault)
            # from killing all subsequent suites and losing their coverage data.
            # Fix ownership so tests can run without sudo (sudo masks signal exit codes)
            sudo chown -R $(whoami) build/ 2>/dev/null || true
            UNIT_TEST_PATH=$(find_test "UnitTests")
            if [ -n "$UNIT_TEST_PATH" ]; then
                echo "=== Running UnitTests suites in isolation ==="
                # Get list of test suites
                SUITES=$($UNIT_TEST_PATH --gtest_list_tests 2>/dev/null | grep -E '^\w' | sed 's/\.$//' | sort -u)
                EXPECTED_UNIT_TESTS=$(count_listed_tests "$UNIT_TEST_PATH")
                ACTUAL_UNIT_TESTS=0

                for suite in $SUITES; do
                    TOTAL_SUITES=$((TOTAL_SUITES + 1))
                    echo "--- Running suite: $suite ---"
                    # Run without sudo so signal exit codes (e.g. 139 for SIGSEGV) propagate correctly.
                    # sudo can mask crash exit codes, reporting 0 for segfaulted children.
                    suite_xml="test-results-${suite}.xml"
                    expected_suite_tests=$(count_listed_tests "$UNIT_TEST_PATH" "${suite}.*")
                    $UNIT_TEST_PATH --gtest_filter="${suite}.*" --gtest_output=xml:${suite_xml} 2>&1
                    exit_code=$?
                    if [ $exit_code -eq 0 ]; then
                        actual_suite_tests=$(count_testcases_in_xml "$suite_xml")
                        ACTUAL_UNIT_TESTS=$((ACTUAL_UNIT_TESTS + actual_suite_tests))
                        if [ "$actual_suite_tests" -ne "$expected_suite_tests" ]; then
                            echo "ERROR: Suite $suite ran $actual_suite_tests/$expected_suite_tests discovered test(s)."
                            FAILED_SUITES=$((FAILED_SUITES + 1))
                            continue
                        fi
                        skipped_count=$(count_skipped_in_xml "$suite_xml")
                        if [ "$skipped_count" -gt 0 ]; then
                            echo "ERROR: Suite $suite produced $skipped_count skipped test(s)."
                            SKIPPED_TESTS=$((SKIPPED_TESTS + skipped_count))
                            FAILED_SUITES=$((FAILED_SUITES + 1))
                        else
                            PASSED_SUITES=$((PASSED_SUITES + 1))
                        fi
                    elif [ $exit_code -ge 128 ]; then
                        signal=$(($exit_code - 128))
                        if is_gl_crash_allowed "$suite"; then
                            echo "WARNING: Suite $suite CRASHED (signal $signal) — known GL/Xvfb issue on CI, not counted as failure."
                            PASSED_SUITES=$((PASSED_SUITES + 1))
                            # Roll the suite's expected count into the running total
                            # so the overall ACTUAL == EXPECTED post-check doesn't
                            # mistake a whitelisted crash for missing tests.
                            ACTUAL_UNIT_TESTS=$((ACTUAL_UNIT_TESTS + expected_suite_tests))
                        else
                            echo "WARNING: Suite $suite CRASHED (signal $signal). Coverage data saved by signal handler."
                            CRASHED_SUITES=$((CRASHED_SUITES + 1))
                        fi
                    else
                        echo "ERROR: Suite $suite failed (exit code $exit_code)"
                        FAILED_SUITES=$((FAILED_SUITES + 1))
                    fi
                done

                if [ "$ACTUAL_UNIT_TESTS" -ne "$EXPECTED_UNIT_TESTS" ]; then
                    echo "ERROR: UnitTests executed $ACTUAL_UNIT_TESTS/$EXPECTED_UNIT_TESTS discovered test(s)."
                    FAILED_SUITES=$((FAILED_SUITES + 1))
                fi
                echo "=== UnitTests summary: $PASSED_SUITES/$TOTAL_SUITES suites passed, $FAILED_SUITES failed, $CRASHED_SUITES crashed, $SKIPPED_TESTS skipped tests ==="
                echo "=== UnitTests cases: $ACTUAL_UNIT_TESTS/$EXPECTED_UNIT_TESTS executed ==="
            else
                echo "ERROR: UnitTests not found!"
                FAILED_SUITES=$((FAILED_SUITES + 1))
            fi

            # === Run other test executables ===
            echo "Running MaterialEditorQML Unit Tests..."
            run_test "MaterialEditorQML_test" "test-results-materialeditor.xml" || FAILED_SUITES=$((FAILED_SUITES + 1))

            echo "Running MaterialEditorQML QML Integration Tests..."
            run_test "MaterialEditorQML_qml_test" "test-results-qml.xml" || FAILED_SUITES=$((FAILED_SUITES + 1))

            echo "Running MaterialEditorQML Performance Tests..."
            run_test "MaterialEditorQML_perf_test" "test-results-perf.xml" || FAILED_SUITES=$((FAILED_SUITES + 1))

            echo "Running QML Component Tests..."
            run_test "MaterialEditorQML_qml_test_runner" "test-results-qml-component.xml" || FAILED_SUITES=$((FAILED_SUITES + 1))

            if [ "$CRASHED_SUITES" -gt 0 ]; then
                echo "WARNING: $CRASHED_SUITES test suite(s) crashed, but coverage data was preserved"
            fi
            if [ "$SKIPPED_TESTS" -gt 0 ]; then
                echo "ERROR: $SKIPPED_TESTS test(s) were skipped"
            fi

            # Save failure count for post-coverage check
            echo "FAILED_SUITES=$FAILED_SUITES" >> $GITHUB_ENV
            echo "CRASHED_SUITES=$CRASHED_SUITES" >> $GITHUB_ENV
            echo "SKIPPED_TESTS=$SKIPPED_TESTS" >> $GITHUB_ENV

    # Note: MCP GL-heavy integration coverage is currently represented by
    # UnitTests (MCPServerTest suite). Dedicated GL integration execution remains
    # constrained in headless Mesa/Xvfb environments due Ogre GL3Plus crashes.

    - name: Upload Test Results
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: test-results
        path: |
          test-results-*.xml
          
    - name: Set up Python 3.8 for gcovr
      uses: actions/setup-python@v4
      with:
        python-version: 3.8
        
    - name: install gcovr
      run: |
        pip install gcovr==7.2

    - name: Generate coverage data
      run: |
        echo "=== Coverage Generation Debug Info ==="
        echo "Current directory: $(pwd)"

        GCDA_COUNT=$(find build -name "*.gcda" -type f 2>/dev/null | wc -l)
        echo "Found $GCDA_COUNT .gcda files"

        if [ "$GCDA_COUNT" -eq 0 ]; then
            echo "ERROR: No .gcda files found! Tests may not have run with coverage."
            exit 1
        fi

        echo "=== Generating SonarQube coverage XML via gcovr ==="
        gcovr --root . \
              --filter 'src/' \
              --exclude 'src/OgreXML/' \
              --exclude 'src/dependencies/' \
              --exclude '.*/(LLMManager|LLMWorker|ModelDownloader|SDManager|AIChatManager)\.cpp' \
              --exclude '.*/(AIChatManager|SDManager|SDWorker)\.h' \
              --exclude '.*_test\.cpp' \
              --exclude '.*TestHelpers\.h' \
              --exclude '.*QtAppEnvironment_test\.cpp' \
              --exclude '.*_autogen' \
              --exclude '.*/ui_files/' \
              --exclude '.*/moc_' \
              --exclude '.*qrc_.*\.cpp' \
              --exclude-throw-branches \
              --exclude-unreachable-branches \
              --gcov-ignore-errors=no_working_dir_found \
              --sonarqube=coverage.xml \
              --gcov-executable gcov \
              build \
              2>&1 | tail -20

        echo "=== Validating coverage files ==="
        if [ -f coverage.xml ] && [ -s coverage.xml ]; then
            echo "coverage.xml exists and has content ($(wc -c < coverage.xml) bytes)"
            echo "Files with coverage data:"
            grep -c '<file' coverage.xml || echo "0 files"
            echo "=== Coverage summary ==="
            COVERED=$(grep -o 'covered="true"' coverage.xml | wc -l)
            UNCOVERED=$(grep -o 'covered="false"' coverage.xml | wc -l)
            TOTAL=$((COVERED + UNCOVERED))
            if [ "$TOTAL" -gt 0 ]; then
                PCT=$((COVERED * 100 / TOTAL))
                echo "Lines: $COVERED/$TOTAL covered (~${PCT}%)"
            fi
        else
            echo "ERROR: coverage.xml is missing or empty!"
            exit 1
        fi

    - name: Run sonar-scanner
      env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      run: |
          echo "=== SonarCloud Analysis Setup ==="

          # Ensure compile_commands.json is available for C++ analysis
          if [ -f build/compile_commands.json ]; then
            cp build/compile_commands.json .
            echo "Copied compile_commands.json from build/"
          fi

          # Check build-wrapper output
          BW_DIR="build-wrapper-output"
          if [ -d "$BW_DIR" ]; then
            echo "Build-wrapper output found at: $BW_DIR"
            ls -la "$BW_DIR"/ | head -5
          else
            echo "WARNING: Build-wrapper output not found at $BW_DIR"
            find . -name "build-wrapper-dump.json" -type f 2>/dev/null | head -5
          fi

          # Check coverage files
          echo "=== Coverage files ==="
          ls -la coverage.xml 2>/dev/null || echo "coverage.xml not found"

          echo "=== Running SonarCloud analysis ==="
          # Keep coverage exclusions in sonar-project.properties as the single source of truth.
          sonar-scanner \
            -Dsonar.projectKey=fernandotonon_QtMeshEditor \
            -Dsonar.organization=fernandotonon \
            -Dsonar.host.url=https://sonarcloud.io \
            -Dsonar.token="$SONAR_TOKEN" \
            -Dsonar.sources=src/ \
            -Dsonar.tests=src/,tests/ \
            -Dsonar.test.inclusions=**/*_test.cpp,**/test_*.cpp,tests/**/*.cpp \
            -Dsonar.exclusions=**/OgreXML/**,**/dependencies/**,**/*_autogen/**,**/CMakeFiles/**,**/ui_files/**,**/moc_*,**/_deps/** \
            -Dsonar.coverageReportPaths=coverage.xml \
            -Dsonar.c.file.suffixes=.c \
            -Dsonar.cpp.file.suffixes=.cpp,.cc,.cxx,.c++,.hpp,.hh,.hxx,.h++,.h \
            -Dsonar.objc.file.suffixes=.m,.mm \
            -Dsonar.cfamily.build-wrapper-output=$BW_DIR \
            -Dsonar.cfamily.cache.enabled=true \
            -Dsonar.cfamily.threads=4 \
            -Dsonar.verbose=true

            
    - name: Upload Coverage Reports
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: coverage-reports
        path: |
          coverage.xml

    - name: Fail if tests failed
      if: always()
      run: |
        if [ "${SKIPPED_TESTS:-0}" -gt 0 ]; then
          echo "ERROR: $SKIPPED_TESTS test(s) were skipped in CI"
          exit 1
        fi
        if [ "${FAILED_SUITES:-0}" -gt 0 ]; then
          echo "ERROR: $FAILED_SUITES test suite(s) failed"
          exit 1
        fi
        if [ "${CRASHED_SUITES:-0}" -gt 0 ]; then
          echo "ERROR: $CRASHED_SUITES test suite(s) crashed"
          exit 1
        fi
        echo "All test suites passed"

    - name: Scan repository assets with qtmesh scan
      if: success()
      env:
        DISPLAY: :99
        QT_QPA_PLATFORM: xcb
        LIBGL_ALWAYS_SOFTWARE: 1
        MESA_GL_VERSION_OVERRIDE: "3.3"
      run: |
        TEST_BIN=""
        if [ -f "./build/debug/QtMeshEditor" ]; then
          TEST_BIN="./build/debug/QtMeshEditor"
        elif [ -f "./build/bin/QtMeshEditor" ]; then
          TEST_BIN="./build/bin/QtMeshEditor"
        elif [ -f "./bin/QtMeshEditor" ]; then
          TEST_BIN="./bin/QtMeshEditor"
        fi
        if [ -z "$TEST_BIN" ]; then
          echo "No QtMeshEditor binary found, skipping scan"
          exit 0
        fi
        echo "Scanning repository assets using qtmesh.yml..."
        "$TEST_BIN" --cli scan || {
          echo "::warning::Asset scan found errors (see qtmesh.yml)"
          true
        }

####################################################################
# MacOS Deploy
####################################################################

 build-n-cache-assimp-macos:
    needs: scan-assets-qtmesh
    runs-on: macos-latest
    steps:
    - name: change folder permissions
      run: |
            sudo mkdir /usr/local/lib
            sudo mkdir /usr/local/include
            sudo chmod 777 /usr/local/lib
            sudo chmod 777 /usr/local/include

    - name: Cache Assimp
      id: cache-assimp-macos
      uses: actions/cache@v3
      env:
        cache-name: cache-assimp-macos
      with:
        path: |
               /usr/local/lib/cmake
               /usr/local/include/assimp
               /usr/local/include/contrib
               /usr/local/lib/pkgconfig/assimp.pc
               /usr/local/lib/libassimp*
               /usr/local/lib/libzlibstatic.a
        #key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('/home/runner/work/QtMeshEditor/QtMeshEditor/assimp') }}
        # Need to delete manually if needed to rebuild. Until I find a better solution for detecting changes in the assimp repo.
        key: ${{ runner.os }}-build-${{ env.cache-name }}
        restore-keys: |
          ${{ runner.os }}-build-${{ env.cache-name }}-
          
    - if: steps.cache-assimp-macos.outputs.cache-hit != 'true'
      name: Check out Assimp repo
      uses: actions/checkout@master
      with:
          repository: assimp/assimp
          ref: v${{ env.ASSIMP_VERSION }}
          path: /Users/runner/work/QtMeshEditor/QtMeshEditor/assimp
      
    - if: steps.cache-assimp-macos.outputs.cache-hit != 'true'
      name: Build Assimp repo
      run: |
            cmake -B /Users/runner/work/QtMeshEditor/QtMeshEditor/assimp-build -S /Users/runner/work/QtMeshEditor/QtMeshEditor/assimp -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}}
            cd /Users/runner/work/QtMeshEditor/QtMeshEditor/assimp-build/
            sudo make install -j8

 build-n-cache-ogre-macos:
    needs: build-n-cache-assimp-macos
    runs-on: macos-latest
    steps:    
    - name: change folder permissions
      run: |
          sudo mkdir /usr/local/lib
          sudo mkdir /usr/local/include
          sudo chmod 777 /usr/local/lib
          sudo chmod 777 /usr/local/include

    - name: Cache Assimp
      id: cache-assimp-macos
      uses: actions/cache@v3
      env:
        cache-name: cache-assimp-macos
      with:
        path: |
               /usr/local/lib/cmake
               /usr/local/include/assimp
               /usr/local/include/contrib
               /usr/local/lib/pkgconfig/assimp.pc
               /usr/local/lib/libassimp*
               /usr/local/lib/libzlibstatic.a
        key: ${{ runner.os }}-build-${{ env.cache-name }}
        restore-keys: |
          ${{ runner.os }}-build-${{ env.cache-name }}-
      
    - name: Cache Ogre
      id: cache-ogre-macos
      uses: actions/cache@v3
      env:
        cache-name: cache-ogre-macos
      with:
        path: ${{github.workspace}}/ogre/SDK
        key: ${{ runner.os }}-build-${{ env.cache-name }}
    
    - if: steps.cache-ogre-macos.outputs.cache-hit != 'true'
      name: Check out ogre repo
      uses: actions/checkout@master
      with:
          repository: OGRECave/ogre
          ref: v${{ env.OGRE_VERSION }}
          path: ${{github.workspace}}/ogre
         
    - if: steps.cache-ogre-macos.outputs.cache-hit != 'true'
      name: Build Ogre3D repo
      run: |
            cd ${{github.workspace}}/ogre/
            sudo cmake -S . -DOGRE_BUILD_PLUGIN_ASSIMP=ON -Dassimp_DIR=/usr/local/lib/cmake/assimp-${{ env.ASSIMP_DIR_VERSION }}/ \
            -DOGRE_BUILD_PLUGIN_DOT_SCENE=ON -DOGRE_BUILD_RENDERSYSTEM_GL=ON -DOGRE_BUILD_RENDERSYSTEM_GL3PLUS=ON \
            -DOGRE_BUILD_RENDERSYSTEM_GLES2=OFF -DOGRE_BUILD_TESTS=OFF -DOGRE_BUILD_TOOLS=OFF -DOGRE_BUILD_SAMPLES=OFF \
            -DOGRE_BUILD_COMPONENT_CSHARP=OFF -DOGRE_BUILD_COMPONENT_JAVA=OFF -DOGRE_BUILD_COMPONENT_PYTHON=OFF \
            -DOGRE_INSTALL_TOOLS=OFF -DOGRE_INSTALL_DOCS=OFF -DOGRE_INSTALL_SAMPLES=OFF -DOGRE_BUILD_LIBS_AS_FRAMEWORKS=OFF \
            -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}}
            sudo make install -j8

 build-macos:
    needs: [build-n-cache-assimp-macos, build-n-cache-ogre-macos]
    runs-on: macos-latest
    steps:
    - name: change folder permissions
      run: |
            sudo mkdir -p /usr/local/lib
            sudo mkdir -p /usr/local/include
            sudo chmod -R 777 /usr/local/lib
            sudo chmod -R 777 /usr/local/include

    - uses: actions/checkout@v3
      with:
         submodules: true
         
    - run: |
            cd ${{github.workspace}}/src/dependencies/ogre-procedural
            git checkout master
            git pull
            
    - name: Install Qt
      uses: jurplel/install-qt-action@v3
      with:
        aqtversion: ${{ env.AQT_VERSION }}
        version: ${{ env.QT_VERSION }}
        host: 'mac'
        target: 'desktop'
        arch: 'clang_64'
        tools: 'tools_cmake'

    - name: Debug Qt Installation
      run: |
        echo "=== Qt Installation Debug ==="
        echo "Qt installation directory:"
        ls -la /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/
        echo "Looking for lib directories:"
        find /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/ -name "lib" -type d
        echo "Looking for QtWidgets.framework:"
        find /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/ -name "QtWidgets.framework" -type d
        echo "Architecture of current runner:"
        uname -m
        echo "Available Qt architectures:"
        file /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/*/bin/qmake 2>/dev/null || echo "qmake not found"

    - name: Cache Assimp
      id: cache-assimp-macos
      uses: actions/cache@v3
      env:
        cache-name: cache-assimp-macos
      with:
        path: |
               /usr/local/lib/cmake
               /usr/local/include/assimp
               /usr/local/include/contrib
               /usr/local/lib/pkgconfig/assimp.pc
               /usr/local/lib/libassimp*
               /usr/local/lib/libzlibstatic.a
        key: ${{ runner.os }}-build-${{ env.cache-name }}
      
    - name: Cache Ogre
      id: cache-ogre-macos
      uses: actions/cache@v3
      env:
        cache-name: cache-ogre-macos
      with:
        path: ${{github.workspace}}/ogre/SDK
        key: ${{ runner.os }}-build-${{ env.cache-name }}
    
    - name: Configure CMake
      env:
         OGRE_DIR: ${{github.workspace}}/ogre/SDK/CMake/
      run: |
            # Detect the actual Qt path structure
            if [ -d "/Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/macos" ]; then
                QT_ARCH_DIR="macos"
            elif [ -d "/Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/clang_64" ]; then
                QT_ARCH_DIR="clang_64"
            else
                echo "ERROR: Could not find Qt installation directory"
                ls -la /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/
                exit 1
            fi
            
            echo "Using Qt architecture directory: $QT_ARCH_DIR"
            
            # Configure with dynamic architecture detection and proper universal binary support
            sudo cmake -S . \
            -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} \
            -DCMAKE_CXX_FLAGS="-g" -DCMAKE_C_FLAGS="-g" \
            -DENABLE_STABLE_DIFFUSION=ON \
            -DCMAKE_OSX_ARCHITECTURES="$(uname -m)" \
            -DCMAKE_OSX_DEPLOYMENT_TARGET=11.0 \
            -DASSIMP_DIR=/usr/local/lib/cmake/assimp-${{ env.ASSIMP_DIR_VERSION }} \
            -DASSIMP_INCLUDE_DIR=/usr/local/include/assimp \
            -DQt6_DIR=/Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/cmake/Qt6 \
            -DQT_DIR=/Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/cmake/Qt6 \
            -DQt6GuiTools_DIR=/Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/cmake/Qt6GuiTools \
            -DOGRE_DIR=${{github.workspace}}/ogre/SDK/CMake/

    - name: Build
      # Build your program with the given configuration
      run: |
            sudo make install -j8

    - name: Upload debug symbols to Sentry
      if: github.event_name == 'release' && github.event.action == 'published'
      env:
        SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
        SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
        SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
      run: |
        BIN_PATH="${{github.workspace}}/bin/QtMeshEditor.app/Contents/MacOS/QtMeshEditor"
        sudo dsymutil "$BIN_PATH" -o "${{github.workspace}}/bin/QtMeshEditor.dSYM"
        sudo strip "$BIN_PATH"
        curl -sL https://sentry.io/get-cli/ | bash
        sentry-cli debug-files upload --include-sources "${{github.workspace}}/bin/QtMeshEditor.dSYM"

    - name: Copy Qt libs to app folder
      run: |
            # Detect the actual Qt path structure
            if [ -d "/Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/macos" ]; then
                QT_ARCH_DIR="macos"
            elif [ -d "/Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/clang_64" ]; then
                QT_ARCH_DIR="clang_64"
            else
                echo "ERROR: Could not find Qt installation directory"
                exit 1
            fi
            
            echo "Copying Qt frameworks from: /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/"
            
            # Create proper macOS app bundle structure
            sudo mkdir -p ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks
            sudo mkdir -p ${{github.workspace}}/bin/QtMeshEditor.app/Contents/PlugIns/platforms
            
            # Copy Qt frameworks to proper Frameworks directory
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtWidgets.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtCore.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtGui.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtDBus.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtQuickWidgets.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtQuick.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtQml.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtQmlModels.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtQmlMeta.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtNetwork.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtOpenGL.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtQuickControls2.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/ || echo "QtQuickControls2 not found, continuing..."
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtQuickControls2Impl.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/ || echo "QtQuickControls2Impl not found, continuing..."
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtQuickControls2Basic.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/ || echo "QtQuickControls2Basic not found, continuing..."
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtQuickControls2BasicStyleImpl.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/ || echo "QtQuickControls2BasicStyleImpl not found, continuing..."
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtQuickDialogs2.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/ || echo "QtQuickDialogs2 not found, continuing..."
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtQuickDialogs2Utils.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/ || echo "QtQuickDialogs2Utils not found, continuing..."
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtQuickDialogs2QuickImpl.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/ || echo "QtQuickDialogs2QuickImpl not found, continuing..."
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtQuickTemplates2.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/ || echo "QtQuickTemplates2 not found, continuing..."
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtQuickLayouts.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/ || echo "QtQuickLayouts not found, continuing..."
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtQmlCore.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/ || echo "QtQmlCore not found, continuing..."
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/lib/QtQmlWorkerScript.framework ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/ || echo "QtQmlWorkerScript not found, continuing..."
            
            # Copy plugins to proper PlugIns directory
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/plugins/platforms/* ${{github.workspace}}/bin/QtMeshEditor.app/Contents/PlugIns/platforms/
            # Qt 6: HTTPS / QNetworkAccessManager needs TLS plugins (qsecuretransportbackend, etc.)
            sudo mkdir -p ${{github.workspace}}/bin/QtMeshEditor.app/Contents/PlugIns/tls
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/plugins/tls/* ${{github.workspace}}/bin/QtMeshEditor.app/Contents/PlugIns/tls/

            # Copy QML plugins for QtQuick components
            sudo mkdir -p ${{github.workspace}}/bin/QtMeshEditor.app/Contents/PlugIns/qml
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/qml/QtQuick ${{github.workspace}}/bin/QtMeshEditor.app/Contents/PlugIns/qml/
            sudo cp -R /Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/qml/QtQml ${{github.workspace}}/bin/QtMeshEditor.app/Contents/PlugIns/qml/

            # Copy Assimp libraries to MacOS directory
            sudo cp -R /usr/local/lib/libassimp* ${{github.workspace}}/bin/QtMeshEditor.app/Contents/MacOS/ || echo "Assimp libraries not found, continuing..."

            # macdeployqt scans -qmldir for QML imports and bundles the module
            # plugins (Controls, Layouts, Dialogs, ...) the manual copy misses —
            # without it the inspector panel renders blank on installed bundles.
            MACDEPLOYQT="/Users/runner/work/QtMeshEditor/Qt/${{ env.QT_VERSION }}/$QT_ARCH_DIR/bin/macdeployqt"
            if [ -x "$MACDEPLOYQT" ]; then
                echo "Running macdeployqt against app bundle..."
                deploy_log=$(mktemp)
                sudo "$MACDEPLOYQT" "${{github.workspace}}/bin/QtMeshEditor.app" \
                    -qmldir="${{github.workspace}}/qml" \
                    -verbose=2 \
                    -no-strip > "$deploy_log" 2>&1
                rc=$?
                tail -60 "$deploy_log"
                rm -f "$deploy_log"
                if [ $rc -ne 0 ]; then
                    echo "::error::macdeployqt exited with status $rc"
                    exit $rc
                fi
            else
                echo "::error::macdeployqt not found at $MACDEPLOYQT"
                exit 1
            fi

            # Fix QML plugin rpaths so they resolve Qt frameworks inside the
            # bundle. macdeployqt leaves the original Qt-SDK rpath
            # (@loader_path/../../../lib) on the plugins, which at runtime
            # points to Contents/PlugIns/qml/lib/ — a directory that doesn't
            # exist in the bundle. Plugins fail to load with
            #   "plugin qtquickcontrols2plugin not found"
            # because their dependent frameworks (QtQuickControls2 etc.) can't
            # be resolved. Adding @executable_path/../Frameworks — which always
            # resolves to Contents/Frameworks for any dylib loaded by the
            # main executable — makes Qt's frameworks visible to the plugins.
            echo "Fixing QML plugin rpaths..."
            APP_BUNDLE="${{github.workspace}}/bin/QtMeshEditor.app"
            find "$APP_BUNDLE/Contents/PlugIns/qml" -name "*.dylib" -type f 2>/dev/null | while read -r plugin; do
                sudo install_name_tool -add_rpath @executable_path/../Frameworks "$plugin" 2>/dev/null || true
                sudo install_name_tool -add_rpath @loader_path/../../../../Frameworks "$plugin" 2>/dev/null || true
            done
            # Also fix regular Qt plugins (platforms, tls, etc.) and CA-root
            # drivers for the same reason.
            find "$APP_BUNDLE/Contents/PlugIns" -maxdepth 3 -name "*.dylib" -type f \
                ! -path "*/qml/*" 2>/dev/null | while read -r plugin; do
                sudo install_name_tool -add_rpath @executable_path/../Frameworks "$plugin" 2>/dev/null || true
            done

    - name: Prepare for packing
      run: |
            sudo cp -R ${{github.workspace}}/bin/media ${{github.workspace}}/bin/QtMeshEditor.app/Contents/MacOS/media
            # Remove large dance model files used only for testing
            sudo rm -f ${{github.workspace}}/bin/QtMeshEditor.app/Contents/MacOS/media/models/"Twist Dance.fbx"
            sudo rm -f ${{github.workspace}}/bin/QtMeshEditor.app/Contents/MacOS/media/models/"Rumba Dancing.fbx"
            sudo rm -f ${{github.workspace}}/bin/QtMeshEditor.app/Contents/MacOS/media/models/"Hip Hop Dancing.fbx"
            sudo cp -R ${{github.workspace}}/bin/cfg ${{github.workspace}}/bin/QtMeshEditor.app/Contents/MacOS/cfg
            sudo cp -R ${{github.workspace}}/resources/icon.icns ${{github.workspace}}/bin/QtMeshEditor.app/Contents/MacOS/media
            sudo mkdir -p ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Resources

            # Create qt.conf to help Qt find plugins in the bundle.
            # QmlImports (Qt 6.5+) supersedes Qml2Imports (deprecated), but
            # we set both for compat with anything still keying off the older
            # name during plugin discovery.
            echo -e "[Paths]\nPlugins = PlugIns\nQmlImports = PlugIns/qml\nQml2Imports = PlugIns/qml" | sudo tee ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Resources/qt.conf
            sudo cp -R ${{github.workspace}}/resources/icon.icns ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Resources
            sudo cp -R ${{github.workspace}}/bin/Info.plist ${{github.workspace}}/bin/QtMeshEditor.app/Contents/
            
            # Fix library paths for proper app bundle structure.
            # macdeployqt may have already added these rpaths, so ignore
            # "would duplicate path" errors.
            sudo install_name_tool -add_rpath @executable_path/../Frameworks ${{github.workspace}}/bin/QtMeshEditor.app/Contents/MacOS/QtMeshEditor 2>/dev/null || true
            sudo install_name_tool -add_rpath @loader_path/ ${{github.workspace}}/bin/QtMeshEditor.app/Contents/MacOS/QtMeshEditor 2>/dev/null || true

            # Fix all dylibs in MacOS directory to use @rpath for their dependencies
            echo "Fixing dylib install names and rpaths..."
            for dylib in ${{github.workspace}}/bin/QtMeshEditor.app/Contents/MacOS/*.dylib; do
                if [ -f "$dylib" ]; then
                    dylib_name=$(basename "$dylib")
                    echo "Processing $dylib_name"

                    # Change the install name to use @rpath
                    sudo install_name_tool -id "@rpath/$dylib_name" "$dylib" 2>/dev/null || true

                    # Add rpath to find other dylibs in the same directory
                    sudo install_name_tool -add_rpath @loader_path/ "$dylib" 2>/dev/null || true

                    # Fix references to build machine paths
                    otool -L "$dylib" 2>/dev/null | grep -E "runner|build|SDK" | awk '{print $1}' | while read -r dep; do
                        dep_name=$(basename "$dep")
                        echo "  Fixing dependency: $dep -> @rpath/$dep_name"
                        sudo install_name_tool -change "$dep" "@rpath/$dep_name" "$dylib" 2>/dev/null || true
                    done
                fi
            done

    - name: Code Sign Application (for Sequoia compatibility)
      run: |
            echo "=== Code Signing for macOS Sequoia Compatibility ==="
            
            # Debug: Show app bundle structure
            echo "App bundle structure:"
            find ${{github.workspace}}/bin/QtMeshEditor.app -type f -name "Qt*" | head -20
            echo ""
            echo "Framework structure:"
            ls -la ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/ || echo "No Frameworks directory"
            ls -la ${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/QtCore.framework/ || echo "No QtCore.framework"
            
            # Simplified signing approach - sign everything we can find
            echo "=== Signing all binaries in app bundle ==="
            
            # Sign Qt frameworks - try both versioned and direct paths
            echo "Signing Qt frameworks..."
            for framework in QtCore QtGui QtWidgets QtDBus QtQuickWidgets QtQuick QtQml QtQmlModels QtQmlMeta QtNetwork QtOpenGL QtQuickControls2 QtQuickControls2Impl QtQuickControls2Basic QtQuickControls2BasicStyleImpl QtQuickDialogs2 QtQuickDialogs2Utils QtQuickDialogs2QuickImpl QtQuickTemplates2 QtQuickLayouts QtQmlCore QtQmlWorkerScript; do
                framework_path="${{github.workspace}}/bin/QtMeshEditor.app/Contents/Frameworks/${framework}.framework"
                if [ -d "$framework_path" ]; then
                    echo "Processing $framework framework..."
                    
                    # Try to sign the versioned executable
                    if [ -f "$framework_path/Versions/Current/$framework" ]; then
                        echo "Signing versioned executable: $framework_path/Versions/Current/$framework"
                        sudo codesign --force --sign - "$framework_path/Versions/Current/$framework" 2>/dev/null || echo "Failed to sign versioned executable"
                    fi
                    
                    # Try to sign the direct executable
                    if [ -f "$framework_path/$framework" ]; then
                        echo "Signing direct executable: $framework_path/$framework"
                        sudo codesign --force --sign - "$framework_path/$framework" 2>/dev/null || echo "Failed to sign direct executable"
                    fi
                    
                    # Sign the framework bundle (this is the most important)
                    echo "Signing framework bundle: $framework_path"
                    sudo codesign --force --sign - "$framework_path" 2>/dev/null || echo "Failed to sign framework bundle"
                else
                    echo "Framework $framework not found"
                fi
            done
            
            # Sign all dylibs in the app bundle
            echo "Signing dynamic libraries..."
            find ${{github.workspace}}/bin/QtMeshEditor.app -name "*.dylib" -type f | while read -r dylib; do
                echo "Signing dylib: $dylib"
                sudo codesign --force --sign - "$dylib" 2>/dev/null || echo "Failed to sign $dylib"
            done
            
            # Sign all executables in the app bundle
            echo "Signing executables..."
            find ${{github.workspace}}/bin/QtMeshEditor.app -type f -perm /111 | while read -r exec_file; do
                # Skip if it's a directory or symlink
                if [ -f "$exec_file" ] && [ ! -L "$exec_file" ]; then
                    # Check if it's a binary file (not a script)
                    if file "$exec_file" | grep -q -E "(Mach-O|executable|shared library)"; then
                        echo "Signing executable: $exec_file"
                        sudo codesign --force --sign - "$exec_file" 2>/dev/null || echo "Failed to sign $exec_file"
                    fi
                fi
            done
            
            # Sign the main executable specifically
            echo "Signing main executable..."
            main_exec="${{github.workspace}}/bin/QtMeshEditor.app/Contents/MacOS/QtMeshEditor"
            if [ -f "$main_exec" ]; then
                echo "Signing main executable: $main_exec"
                sudo codesign --force --sign - "$main_exec" || echo "Failed to sign main executable (non-fatal)"
            else
                echo "Main executable not found at $main_exec"
                ls -la ${{github.workspace}}/bin/QtMeshEditor.app/Contents/MacOS/
            fi
            
            # Finally sign the entire app bundle
            echo "Signing app bundle..."
            sudo codesign --force --sign - ${{github.workspace}}/bin/QtMeshEditor.app || echo "Failed to sign app bundle (non-fatal)"
            
            echo "Code signing process completed"
            
            # Verify the signing
            echo "Verifying code signature..."
            codesign --verify --verbose ${{github.workspace}}/bin/QtMeshEditor.app || echo "Verification failed (non-fatal)"
            
    - name: Verify App Bundle
      run: |
            # Verify the app bundle structure
            ls -la ${{github.workspace}}/bin/QtMeshEditor.app/Contents/MacOS/
            file ${{github.workspace}}/bin/QtMeshEditor.app/Contents/MacOS/QtMeshEditor

    - name: Pack
      run: | 
            brew install create-dmg
            sudo create-dmg \
            --volname "QtMeshEditor Installer" \
            --volicon "${{github.workspace}}/resources/icon.icns" \
            --window-pos 200 120 \
            --window-size 800 400 \
            --icon-size 100 \
            --icon "QtMeshEditor.app" 200 190 \
            --app-drop-link 600 185 \
            QtMeshEditor-${{github.ref_name}}-MacOS.dmg \
            ${{github.workspace}}/bin/QtMeshEditor.app
    
    - if: github.event_name == 'release' && github.event.action == 'published'
      uses: actions/upload-artifact@v4
      with:
        name: QtMeshEditor-MacOS
        path: ${{github.workspace}}/QtMeshEditor-${{github.ref_name}}-MacOS.dmg
        
    - if: github.event_name == 'release' && github.event.action == 'published'
      uses: xresloader/upload-to-github-release@main
      env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
          file: QtMeshEditor-${{github.ref_name}}-MacOS.dmg
          update_latest_release: true
          overwrite: false
          verbose: true

####################################################################
# Notify Sentry of new release (associate commits for source context)
####################################################################

 notify-sentry:
    needs: [build-windows, build-linux, build-macos]
    runs-on: ubuntu-latest
    if: github.event_name == 'release' && github.event.action == 'published'
    steps:
    - uses: actions/checkout@v3
      with:
        fetch-depth: 0

    - name: Install sentry-cli
      run: |
        curl -sL https://sentry.io/get-cli/ | bash

    - name: Create Sentry release and associate commits
      env:
        SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
        SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
        SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
      run: |
        VERSION="qtmesheditor@${{ github.ref_name }}"
        echo "Creating Sentry release: $VERSION"
        sentry-cli releases new "$VERSION"
        sentry-cli releases set-commits "$VERSION" --auto
        sentry-cli releases finalize "$VERSION"
        echo "Sentry release $VERSION created and finalized"

####################################################################
# Update Homebrew Cask after macOS release
####################################################################

 update-homebrew-cask:
    needs: build-macos
    runs-on: ubuntu-latest
    if: github.event_name == 'release' && github.event.action == 'published'
    steps:
    - name: Wait for DMG to be available
      run: |
        echo "Waiting for DMG to be uploaded to release..."
        sleep 30

    - name: Download DMG from release
      run: |
        VERSION="${{ github.ref_name }}"
        DMG_URL="https://github.com/fernandotonon/QtMeshEditor/releases/download/${VERSION}/QtMeshEditor-${VERSION}-MacOS.dmg"
        echo "Downloading DMG from: $DMG_URL"

        # Retry download up to 5 times with increasing delays
        for i in 1 2 3 4 5; do
          if curl -L -f -o QtMeshEditor.dmg "$DMG_URL"; then
            echo "Download successful"
            break
          else
            echo "Download attempt $i failed, waiting..."
            sleep $((i * 30))
          fi
        done

        if [ ! -f QtMeshEditor.dmg ]; then
          echo "Failed to download DMG after all retries"
          exit 1
        fi

    - name: Calculate SHA256
      id: sha256
      run: |
        SHA256=$(shasum -a 256 QtMeshEditor.dmg | awk '{print $1}')
        echo "SHA256: $SHA256"
        echo "sha256=$SHA256" >> $GITHUB_OUTPUT

    - name: Clone Homebrew tap repository
      run: |
        git clone https://x-access-token:${{ secrets.HOMEBREW_TAP_TOKEN }}@github.com/fernandotonon/homebrew-qtmesheditor.git
        cd homebrew-qtmesheditor
        git config user.name "GitHub Actions Bot"
        git config user.email "actions@github.com"

    - name: Update Cask file
      run: |
        VERSION="${{ github.ref_name }}"
        SHA256="${{ steps.sha256.outputs.sha256 }}"
        CASK_FILE="homebrew-qtmesheditor/Casks/qtmesheditor.rb"

        echo "Updating cask to version $VERSION with SHA256 $SHA256"

        # Only update version and sha256 — the cask file contains CLI symlink
        # stanzas (binary, postflight/uninstall_postflight for qtmesh) that
        # must be preserved. sed only touches the matching lines.
        sed -i "s/version '.*'/version '$VERSION'/" "$CASK_FILE"
        sed -i "s/sha256 '.*'/sha256 '$SHA256'/" "$CASK_FILE"

        echo "Updated cask file:"
        cat "$CASK_FILE"

    - name: Commit and push changes
      run: |
        cd homebrew-qtmesheditor
        git add Casks/qtmesheditor.rb
        git commit -m "Update QtMeshEditor to ${{ github.ref_name }}" || echo "No changes to commit"
        git push

####################################################################
# WinGet Publish (after Windows build)
####################################################################

 winget-publish:
    needs: build-windows
    if: github.event_name == 'release' && github.event.action == 'published'
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - name: Submit WinGet manifest
        shell: pwsh
        env:
          WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
        run: |
          $ErrorActionPreference = "Stop"

          if (-not $env:WINGET_TOKEN) {
            Write-Host "::error::WINGET_TOKEN secret is missing. Configure it in repo secrets with a classic PAT that has 'public_repo' scope."
            exit 1
          }

          # Sanity-check the token before wingetcreate uses it. A revoked or
          # scope-less PAT shows up here as a clear 401/403 instead of
          # wingetcreate's generic "Failed to connect to GitHub".
          Write-Host "Validating WINGET_TOKEN against GitHub API..."
          $headers = @{
            Authorization = "token $env:WINGET_TOKEN"
            Accept        = "application/vnd.github+json"
            "User-Agent"  = "QtMeshEditor-CI"
          }
          try {
            $userResp = Invoke-WebRequest -Uri "https://api.github.com/user" -Headers $headers -UseBasicParsing
            $scopes = $userResp.Headers['X-OAuth-Scopes']
            $login  = ($userResp.Content | ConvertFrom-Json).login
            # X-OAuth-Scopes is only populated for classic PATs.
            # Fine-grained PATs return an empty / missing scopes header.
            # wingetcreate --submit has consistently been observed to
            # fail with "Resource not accessible by personal access token"
            # when given a fine-grained PAT, regardless of its
            # configured fine-grained permissions on microsoft/winget-pkgs
            # (the fork step uses an API endpoint fine-grained tokens
            # can't reach). Fail fast with a clear remediation.
            if ($scopes) {
              Write-Host "Token OK for user '$login' with classic PAT scopes: $scopes"
              if (($scopes -notmatch 'public_repo') -and ($scopes -notmatch '\brepo\b')) {
                Write-Host "::error::WINGET_TOKEN is a classic PAT but has scopes '$scopes'; wingetcreate --submit needs 'public_repo' or 'repo'."
                Write-Host "::error::Regenerate the token at https://github.com/settings/tokens/new with 'public_repo' checked and update the WINGET_TOKEN repo secret."
                exit 1
              }
            } else {
              Write-Host "::error::WINGET_TOKEN validates as user '$login' but reports NO X-OAuth-Scopes — this is a fine-grained PAT."
              Write-Host "::error::wingetcreate --submit requires a CLASSIC PAT with 'public_repo' scope; fine-grained PATs cannot fork / open PRs against microsoft/winget-pkgs."
              Write-Host "::error::Regenerate at https://github.com/settings/tokens/new (NOT /tokens/new?type=beta) with 'public_repo' checked and update WINGET_TOKEN."
              exit 1
            }
          } catch {
            Write-Host "::error::Token validation failed: $($_.Exception.Message). Rotate WINGET_TOKEN (classic PAT with 'public_repo')."
            exit 1
          }

          # Download wingetcreate standalone exe from GitHub releases
          $wgcUrl = "https://github.com/microsoft/winget-create/releases/latest/download/wingetcreate.exe"
          Invoke-WebRequest -Uri $wgcUrl -OutFile wingetcreate.exe

          $rawTag = "${{ github.event.release.tag_name }}"
          $ver = $rawTag -replace '^v', ''
          $url = "https://github.com/fernandotonon/QtMeshEditor/releases/download/${rawTag}/QtMeshEditor-${rawTag}-bin-Windows.zip"

          # Wait for the release asset to be downloadable (GitHub CDN propagation).
          # Treat "still not available after all retries" as a hard error —
          # wingetcreate would otherwise fail later with a confusing message.
          Write-Host "Waiting for release asset to be available..."
          $assetReady = $false
          for ($attempt = 1; $attempt -le 10; $attempt++) {
            try {
              $resp = Invoke-WebRequest -Uri $url -Method Head -ErrorAction Stop
              Write-Host "Asset available (attempt $attempt)"
              $assetReady = $true
              break
            } catch {
              Write-Host "Attempt ${attempt}: asset not yet available, waiting 30s..."
              Start-Sleep -Seconds 30
            }
          }
          if (-not $assetReady) {
            Write-Host "::error::Release asset $url never became available."
            exit 1
          }

          # wingetcreate --submit goes through the GitHub Contents API (PUT
          # /contents/:path), which works with a classic PAT that only has
          # `public_repo` scope. The previous approach (manual `git clone` +
          # `git push` to the fork) required write-access on the fork via
          # git-over-HTTPS, a different permission path that was 403-denied.
          #
          # Retry up to three times on transient failures — wingetcreate's
          # "Failed to connect to GitHub" sometimes hits during runner DNS
          # flakes or microsoft/winget-pkgs being under load after a release.
          # We capture stderr so we can detect the "Resource not accessible
          # by personal access token" auth failure and bail immediately
          # (retrying that is pointless; the token lacks permissions).
          $submitOk = $false
          $authErrorSeen = $false
          $lastOutput = @()
          for ($attempt = 1; $attempt -le 3; $attempt++) {
            Write-Host "Submitting WinGet manifest for version $ver (attempt $attempt)..."
            $output = & .\wingetcreate.exe update FernandoTonon.QtMeshEditor `
              --version $ver `
              --urls $url `
              --submit `
              --token $env:WINGET_TOKEN 2>&1
            $lastOutput = $output
            # Echo the tool's output so users can read it in the logs.
            $output | ForEach-Object { Write-Host $_ }
            if ($LASTEXITCODE -eq 0) {
              $submitOk = $true
              break
            }
            if ($output -match 'Resource not accessible by personal access token') {
              $authErrorSeen = $true
              break
            }
            Write-Host "::warning::wingetcreate exited $LASTEXITCODE on attempt $attempt."
            if ($attempt -lt 3) {
              Start-Sleep -Seconds 30
            }
          }
          if (-not $submitOk) {
            if ($authErrorSeen) {
              Write-Host "::error::wingetcreate reported 'Resource not accessible by personal access token'."
              Write-Host "::error::This means WINGET_TOKEN lacks the required scope to fork microsoft/winget-pkgs and open a PR."
              Write-Host "::error::Fix: regenerate a CLASSIC PAT at https://github.com/settings/tokens/new with 'public_repo' checked, update the WINGET_TOKEN repo secret, then re-run this job."
            } else {
              Write-Host "::error::wingetcreate submit failed after 3 attempts. Check:"
              Write-Host "::error:: 1. WINGET_TOKEN is still valid and has 'public_repo' scope."
              Write-Host "::error:: 2. The user's fork of microsoft/winget-pkgs hasn't diverged."
              Write-Host "::error:: 3. https://www.githubstatus.com for GitHub API availability."
            }
            exit 1
          }
          Write-Host "WinGet PR submitted successfully."

          # Echo the created PR's URL at the top of our own action log
          # so it's easy to find from the release build later. We do NOT
          # post a comment on the winget-pkgs PR itself: winget's review
          # flow is driven by wingetbot and Microsoft maintainers, and
          # external contributor comments don't add value (and could
          # risk tripping keyword-based automation).
          foreach ($line in $lastOutput) {
            if ($line -match 'Pull request.*?(https://github\.com/microsoft/winget-pkgs/pull/\d+)') {
              Write-Host "::notice::WinGet PR created: $($Matches[1])"
              break
            }
          }

####################################################################
# Snap Store Publish (after Linux .deb is built)
####################################################################

 snap-publish:
    needs: build-linux
    if: github.event_name == 'release' && github.event.action == 'published'
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3.5.3

    - uses: actions/download-artifact@v4
      with:
        name: linux-binaries
        path: .

    - name: Verify snap input artifact
      run: test -f ./qtmesheditor_amd64.deb

    - uses: snapcore/action-build@3bdaa03e1ba6bf59a65f84a751d943d549a54e79 # v1
      id: build

    - uses: snapcore/action-publish@214b86e5ca036ead1668c79afb81e550e6c54d40 # v1
      env:
        SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_TOKEN }}
      with:
        snap: ${{ steps.build.outputs.snap }}
        release: stable

####################################################################
# Docker Image Publish (after Linux .deb is built)
####################################################################

 docker-publish:
    needs: build-linux
    runs-on: ubuntu-latest
    if: github.event_name == 'release' && github.event.action == 'published'
    permissions:
      contents: read
      packages: write
    env:
      REGISTRY_GHCR: ghcr.io
      GHCR_IMAGE: fernandotonon/qtmesh
      DOCKERHUB_IMAGE: fernandotr1/qtmesh
    steps:
      - uses: actions/checkout@v4

      - name: Download .deb artifact from build-linux
        uses: actions/download-artifact@v4
        with:
          name: linux-binaries
          path: .

      - name: Prepare .deb for Docker build
        run: |
          shopt -s nullglob
          debs=(./*.deb)
          if [ "${#debs[@]}" -ne 1 ]; then
            echo "Expected exactly one .deb, found ${#debs[@]}" >&2
            ls -la ./*.deb 2>/dev/null || true
            exit 1
          fi
          mv "${debs[0]}" ./qtmesheditor.deb
          ls -la ./qtmesheditor.deb

      - name: Extract version from downloaded package
        id: version
        run: |
          VERSION=$(dpkg-deb -f ./qtmesheditor.deb Version | sed 's/-.*//')
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Extracted version: $VERSION"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY_GHCR }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Compute Docker tags
        id: tags
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          TAGS="${{ env.REGISTRY_GHCR }}/${{ env.GHCR_IMAGE }}:${VERSION}"
          TAGS="${TAGS},${{ env.REGISTRY_GHCR }}/${{ env.GHCR_IMAGE }}:latest"
          TAGS="${TAGS},${{ env.DOCKERHUB_IMAGE }}:${VERSION}"
          TAGS="${TAGS},${{ env.DOCKERHUB_IMAGE }}:latest"
          echo "tags=$TAGS" >> "$GITHUB_OUTPUT"

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          build-args: |
            VERSION=${{ steps.version.outputs.version }}
          tags: ${{ steps.tags.outputs.tags }}
          labels: |
            org.opencontainers.image.title=qtmesh
            org.opencontainers.image.description=qtmesh CLI - 3D mesh conversion, optimization, and animation tools
            org.opencontainers.image.version=${{ steps.version.outputs.version }}
            org.opencontainers.image.source=https://github.com/fernandotonon/QtMeshEditor

      - name: Verify image
        run: |
          IMAGE="${{ env.REGISTRY_GHCR }}/${{ env.GHCR_IMAGE }}:${{ steps.version.outputs.version }}"
          # Check for missing shared libraries before running
          echo "=== Checking for missing shared libraries ==="
          docker run --rm --entrypoint bash "$IMAGE" -c \
            'LD_LIBRARY_PATH=/usr/lib/qtmesheditor ldd /usr/share/qtmesheditor/qtmesheditor 2>&1 | grep "not found" && exit 1 || echo "All libraries found"'
          # Run --help to verify CLI works end-to-end
          docker run --rm "$IMAGE" --help

      - name: Scan repository assets via Docker
        run: |
          IMAGE="${{ env.REGISTRY_GHCR }}/${{ env.GHCR_IMAGE }}:${{ steps.version.outputs.version }}"
          echo "=== Scanning repository assets via Docker ==="
          docker run --rm \
            -v "${{ github.workspace }}:/workspace" \
            "$IMAGE" scan --config /workspace/qtmesh.yml --json || {
            echo "::warning::Docker asset scan reported issues"
            true
          }