release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag to rebuild and release (e.g. v1.4.2)'
        required: true
        type: string
      os_filter:
        description: 'OS(es) to build (comma-separated: windows, linux, darwin). Leave empty for all.'
        required: false
        type: string
        default: ''

permissions:
  contents: write
  actions: write

jobs:
  setup:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    env:
      OS_FILTER: ${{ inputs.os_filter }}
    steps:
      - name: Set build matrix
        id: set-matrix
        run: |
          FULL='[
            {"os":"ubuntu-latest","goos":"linux","goarch":"amd64","cc":"gcc"},
            {"os":"ubuntu-latest","goos":"linux","goarch":"arm64","cc":"aarch64-linux-gnu-gcc"},
            {"os":"macos-latest","goos":"darwin","goarch":"amd64","cc":"clang"},
            {"os":"macos-latest","goos":"darwin","goarch":"arm64","cc":"clang"},
            {"os":"windows-latest","goos":"windows","goarch":"amd64","cc":"gcc","ext":".exe"},
            {"os":"ubuntu-latest","goos":"windows","goarch":"386","cc":"i686-w64-mingw32-gcc","ext":".exe"}
          ]'
          FILTER="$OS_FILTER"
          if [ -z "$FILTER" ]; then
            MATRIX="$FULL"
          else
            MATRIX=$(echo "$FULL" | jq -c --arg f "$FILTER" \
              '[.[] | . as $e | select(($f | split(",") | map(ltrimstr(" ") | rtrimstr(" "))) | contains([$e.goos]))]')
          fi
          echo "matrix=$(echo "$MATRIX" | jq -c '.')" >> "$GITHUB_OUTPUT"

  build:
    needs: setup
    strategy:
      matrix:
        include: ${{ fromJson(needs.setup.outputs.matrix) }}
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag || github.ref_name }}
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Install gcc (Linux)
        if: matrix.os == 'ubuntu-latest'
        run: sudo apt-get install -y gcc gcc-aarch64-linux-gnu gcc-mingw-w64-i686

      - name: Set up sqlite3 headers for Linux CGO build
        if: matrix.os == 'ubuntu-latest'
        run: |
          go mod download
          SQLITE3_DIR=$(go list -m -json github.com/mattn/go-sqlite3 | grep '"Dir"' | sed 's/.*: "\(.*\)",\?/\1/')
          mkdir -p /tmp/cgo-headers
          cp "${SQLITE3_DIR}/sqlite3-binding.h" /tmp/cgo-headers/sqlite3.h
          echo "CGO_CFLAGS=-I/tmp/cgo-headers" >> "$GITHUB_ENV"

      - name: Install gcc (Windows)
        if: matrix.os == 'windows-latest'
        run: choco install mingw --no-progress

      - name: Set up sqlite3 headers for Windows CGO build
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: |
          go mod download
          $sqlite3Dir = go list -m -json github.com/mattn/go-sqlite3 | ConvertFrom-Json | Select-Object -ExpandProperty Dir
          $headersDir = New-Item -ItemType Directory -Path (Join-Path $env:TEMP "cgo-headers") -Force
          Copy-Item (Join-Path $sqlite3Dir "sqlite3-binding.h") -Destination (Join-Path $headersDir.FullName "sqlite3.h")
          $posixPath = $headersDir.FullName.Replace('\', '/')
          Add-Content $env:GITHUB_ENV "CGO_CFLAGS=-I$posixPath"

      - name: Build binary
        env:
          CGO_ENABLED: "1"
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CC: ${{ matrix.cc }}
        run: go build -ldflags="-s -w -X main.Version=${{ inputs.tag || github.ref_name }}" -o bin/memoryweb_${{ matrix.goos }}_${{ matrix.goarch }}/memoryweb${{ matrix.ext }} .

      - name: Sign Windows binary
        if: matrix.goos == 'windows' && matrix.os == 'windows-latest'
        shell: pwsh
        env:
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
        run: |
          $certPath = Join-Path $env:TEMP "signing_cert.pfx"
          $certPassword = $env:WINDOWS_CERTIFICATE_PASSWORD

          if ([string]::IsNullOrEmpty($env:WINDOWS_CERTIFICATE)) {
            # No stored cert — generate a self-signed code-signing certificate
            Write-Host "WINDOWS_CERTIFICATE secret not set; generating a self-signed certificate."
            $certPassword = "memoryweb-selfsigned"
            $cert = New-SelfSignedCertificate `
              -Type Custom `
              -Subject "CN=memoryweb" `
              -KeyUsage DigitalSignature `
              -FriendlyName "memoryweb self-signed" `
              -CertStoreLocation "Cert:\CurrentUser\My" `
              -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3", "2.5.29.19={text}")
            $securePassword = ConvertTo-SecureString -String $certPassword -Force -AsPlainText
            Export-PfxCertificate -Cert "Cert:\CurrentUser\My\$($cert.Thumbprint)" `
              -FilePath $certPath -Password $securePassword | Out-Null
            Write-Host "Self-signed cert generated (thumbprint: $($cert.Thumbprint))"
          } else {
            # Use the stored PFX secret (base64-encoded)
            $certBytes = [System.Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
            [System.IO.File]::WriteAllBytes($certPath, $certBytes)
            Write-Host "Using stored certificate from WINDOWS_CERTIFICATE secret."
          }

          try {
            $signtool = Get-ChildItem -Path "C:\Program Files (x86)\Windows Kits\10\bin" `
              -Recurse -Filter "signtool.exe" |
              Where-Object { $_.FullName -match "x64" } |
              Sort-Object FullName -Descending |
              Select-Object -First 1 -ExpandProperty FullName
            if (-not $signtool) { throw "signtool.exe not found" }
            Write-Host "Using signtool: $signtool"
            & $signtool sign `
              /fd SHA256 `
              /td SHA256 `
              /tr http://timestamp.digicert.com `
              /f $certPath `
              /p $certPassword `
              "bin\memoryweb_${{ matrix.goos }}_${{ matrix.goarch }}\memoryweb.exe"
            if ($LASTEXITCODE -ne 0) { throw "signtool failed with exit code $LASTEXITCODE" }
            Write-Host "Binary signed successfully."
          } finally {
            Remove-Item $certPath -Force -ErrorAction SilentlyContinue
          }

      - name: Upload binary artifact
        uses: actions/upload-artifact@v4
        with:
          name: bin-${{ matrix.goos }}-${{ matrix.goarch }}
          path: bin/

  release:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag || github.ref_name }}
          fetch-depth: 0

      - name: Fetch hooks from main if not present at tag
        run: |
          if [ ! -d hooks ] || [ -z "$(find hooks -maxdepth 1 -name '*.sh' 2>/dev/null)" ]; then
            git fetch origin main
            git checkout origin/main -- hooks/
          fi

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Download all binary artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: bin-*
          path: bin/
          merge-multiple: true

      - name: Create archives and checksums
        run: |
          set -e
          mkdir -p dist
          VERSION="${{ inputs.tag || github.ref_name }}"
          for dir in bin/memoryweb_*/; do
            name=$(basename "$dir")
            suffix="${name#memoryweb_}"
            goos="${suffix%%_*}"
            goarch="${suffix#*_}"
            cp -r hooks "bin/${name}/"
            if [ "$goos" = "windows" ]; then
              (cd bin && zip -r "../dist/memoryweb_${VERSION}_${goos}_${goarch}.zip" "$name/")
            else
              tar -czf "dist/memoryweb_${VERSION}_${goos}_${goarch}.tar.gz" -C bin "$name"
            fi
          done
          cd dist && sha256sum ./* > checksums.txt

      - name: Delete existing release assets (backfill mode)
        if: github.event_name == 'workflow_dispatch'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${{ inputs.tag }}"
          OS_FILTER="${{ inputs.os_filter }}"
          gh release view "$TAG" --json assets --jq '.assets[].name' | while read -r asset; do
            if [ -z "$OS_FILTER" ]; then
              echo "Deleting existing asset: $asset"
              gh release delete-asset "$TAG" "$asset" --yes || true
            else
              IFS=',' read -ra OSES <<< "$OS_FILTER"
              for os in "${OSES[@]}"; do
                os=$(echo "$os" | tr -d ' ')
                if echo "$asset" | grep -q "_${os}_"; then
                  echo "Deleting existing asset: $asset"
                  gh release delete-asset "$TAG" "$asset" --yes || true
                  break
                fi
              done
            fi
          done

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ inputs.tag || github.ref_name }}
          files: dist/*
          generate_release_notes: ${{ github.event_name != 'workflow_dispatch' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Trigger Homebrew tap update
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${{ inputs.tag || github.ref_name }}"
          gh workflow run update-homebrew.yml \
            --repo corbym/memoryweb \
            -f tag="${VERSION}"