name: Release

# Build the Linux (amd64/arm64) and Windows (amd64) binaries whenever a GitHub
# Release is published, then attach the packaged archives to that release.
#
# Everything runs inside golang:1.22-bookworm — the same base image as the
# repo Dockerfile — so the CGO/Fyne toolchain matches the local release builds.
# The Windows binary is cross-compiled with MinGW-w64 from the same Linux job,
# which is why no windows-latest runner is needed.
on:
  release:
    types: [published]
  # Allow a manual run (from the Actions tab) to smoke-test the build without
  # publishing a release. Manual runs build the artifacts but upload nothing.
  workflow_dispatch:

permissions:
  contents: write # required to create the release and upload assets

jobs:
  release:
    runs-on: ubuntu-latest
    container:
      image: golang:1.22-bookworm
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install cross toolchain
        # Mirrors the package list in the repo Dockerfile: native gcc + X11/GL
        # headers for amd64, the aarch64 cross compiler with arm64 runtime libs,
        # and the MinGW-w64 toolchain for the Windows GUI binary. zip packages
        # the Windows archive.
        run: |
          dpkg --add-architecture arm64
          apt-get update
          apt-get install -y --no-install-recommends \
            ca-certificates \
            gcc \
            libc6-dev \
            gcc-aarch64-linux-gnu \
            libc6-dev-arm64-cross \
            linux-libc-dev-arm64-cross \
            gcc-mingw-w64-x86-64 \
            binutils-mingw-w64-x86-64 \
            pkg-config \
            libgl1-mesa-dev \
            xorg-dev \
            libgl1-mesa-dev:arm64 \
            libx11-dev:arm64 \
            libxcursor-dev:arm64 \
            libxrandr-dev:arm64 \
            libxinerama-dev:arm64 \
            libxi-dev:arm64 \
            libxxf86vm-dev:arm64 \
            zip
          rm -rf /var/lib/apt/lists/*

      - name: Derive version
        # For a release, use the tag without its leading "v" so the artifact
        # names and the injected app version match the release (the release
        # event still sets GITHUB_REF_TYPE=tag / GITHUB_REF_NAME=<tag>).
        # Otherwise fall back to the version in source (handled by the build
        # script).
        id: version
        run: |
          ref="${GITHUB_REF_NAME:-}"
          if [ "${GITHUB_REF_TYPE:-}" = "tag" ]; then
            echo "value=${ref#v}" >> "$GITHUB_OUTPUT"
          fi

      - name: Build and package
        env:
          VERSION: ${{ steps.version.outputs.value }}
        run: |
          chmod +x scripts/ci-build-release.sh
          scripts/ci-build-release.sh

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: gosentry-release
          path: |
            dist/linux/*.tar.gz
            dist/windows/*.zip

      - name: Attach assets to release
        # Only runs for the release event; the release already exists, so this
        # just uploads the built archives to it. Skipped on workflow_dispatch.
        if: github.event_name == 'release'
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.event.release.tag_name }}
          files: |
            dist/linux/*.tar.gz
            dist/windows/*.zip