dev-release.yml

name: Dev Release

on:
  push:
    branches:
      - dev

permissions:
  contents: write

concurrency:
  group: dev-release-${{ github.sha }}
  cancel-in-progress: false

jobs:
  create-release:
    name: Create draft prerelease
    runs-on: ubuntu-latest
    outputs:
      release_id: ${{ steps.release.outputs.release_id }}
      tag: ${{ steps.version.outputs.tag }}
      version: ${{ steps.version.outputs.version }}

    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          ref: ${{ github.sha }}

      - name: Install Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
        with:
          cache: false

      - name: Calculate prerelease version
        id: version
        shell: bash
        run: |
          stable_version="$(cargo x version)"
          IFS=. read -r major minor patch <<<"$stable_version"
          version="${major}.${minor}.$((patch + 1))-dev.${GITHUB_RUN_NUMBER}"
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "tag=v$version" >> "$GITHUB_OUTPUT"

      - name: Create or find draft prerelease
        id: release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_TAG: ${{ steps.version.outputs.tag }}
          RELEASE_VERSION: ${{ steps.version.outputs.version }}
          RELEASE_COMMIT: ${{ github.sha }}
        run: |
          if release_json="$(
            gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${RELEASE_TAG}" 2>/dev/null
          )"; then
            if [[ "$(jq -r '.draft' <<<"$release_json")" != "true" ]]; then
              echo "Release $RELEASE_TAG is already published" >&2
              exit 1
            fi
            release_id="$(jq -r '.id' <<<"$release_json")"
          else
            body="$(cat <<EOF
          Development build from commit \`$RELEASE_COMMIT\` on the \`dev\` branch.

          This prerelease may be unstable and is intended for testing only.
          EOF
            )"
            release_id="$(
              gh api --method POST "repos/${GITHUB_REPOSITORY}/releases" \
                -f tag_name="$RELEASE_TAG" \
                -f target_commitish="$RELEASE_COMMIT" \
                -f name="ff-wizard $RELEASE_VERSION" \
                -f body="$body" \
                -F draft=true \
                -F prerelease=true \
                -F generate_release_notes=true \
                --jq '.id'
            )"
          fi

          echo "release_id=$release_id" >> "$GITHUB_OUTPUT"

  build:
    name: Build (${{ matrix.name }})
    needs: create-release
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      max-parallel: 1
      matrix:
        include:
          - name: Linux x86_64
            os: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
          - name: macOS aarch64
            os: macos-latest
            target: aarch64-apple-darwin
          - name: macOS x86_64
            os: macos-latest
            target: x86_64-apple-darwin
          - name: Windows x86_64
            os: windows-latest
            target: x86_64-pc-windows-msvc

    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          ref: ${{ github.sha }}

      - name: Install Linux dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install --yes \
            libappindicator3-dev \
            librsvg2-dev \
            libwebkit2gtk-4.1-dev \
            patchelf \
            xdg-utils

      - name: Install Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
        with:
          target: ${{ matrix.target }}
          cache-key: dev-release-${{ matrix.target }}

      - name: Install Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: crates/wizard/ff-wizard-ui/package-lock.json

      - name: Install frontend dependencies
        working-directory: crates/wizard/ff-wizard-ui
        run: npm ci

      - name: Build and upload prerelease bundles
        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.DEV_TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.DEV_TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          projectPath: crates/wizard
          tauriScript: node ff-wizard-ui/node_modules/@tauri-apps/cli/tauri.js
          args: >-
            --target ${{ matrix.target }}
            --config '{"version":"${{ needs.create-release.outputs.version }}","plugins":{"updater":{"endpoints":["https://coreinfraai.github.io/wizard/latest-dev.json"]}}}'
          releaseId: ${{ needs.create-release.outputs.release_id }}
          tagName: ${{ needs.create-release.outputs.tag }}
          releaseDraft: true
          prerelease: true
          uploadUpdaterJson: true
          updaterJsonPreferNsis: true
          uploadUpdaterSignatures: true
          releaseAssetNamePattern: "[name]-[version]-[platform]-[arch][setup][ext]"

  publish-release:
    name: Publish and verify immutable prerelease
    needs:
      - create-release
      - build
    runs-on: ubuntu-latest

    steps:
      - name: Publish prerelease
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_ID: ${{ needs.create-release.outputs.release_id }}
        run: |
          gh api --method PATCH \
            "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" \
            -F draft=false \
            -F prerelease=true

  publish-update-channel:
    name: Publish dev updater channel
    needs:
      - create-release
      - publish-release
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}

    steps:
      - name: Download updater metadata
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_TAG: ${{ needs.create-release.outputs.tag }}
        run: |
          mkdir site
          gh release download "$RELEASE_TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --pattern latest.json \
            --dir site
          mv site/latest.json site/latest-dev.json
          jq --exit-status '.version and (.platforms | length > 0)' site/latest-dev.json >/dev/null

      - name: Upload Pages artifact
        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
        with:
          path: site

      - name: Deploy GitHub Pages
        id: deployment
        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5