name: Release & Code Signing CA Pipeline

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

jobs:
  build-and-sign-windows:
    runs-on: windows-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js 22
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Typecheck & Test
        run: |
          npm run typecheck
          npm run test --workspace=@d3ro/api-client

      # Azure Trusted Signing (Artifact Signing) for SmartScreen Reputation
      - name: Setup Azure Trusted Signing
        if: env.AZURE_CLIENT_ID != ''
        uses: azure/trusted-signing-action@v0.4.1
        with:
          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
          azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          trusted-signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE }}

      - name: Build and Package Windows (NSIS + RFC 3161 TSA)
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RFC3161_TSA_SERVER: "http://timestamp.digicert.com"
        run: |
          npm run build --workspace=@d3ro/desktop
          npx electron-builder --win --config apps/desktop/electron-builder.yml

      - name: Upload Windows Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: d3ro-voice-windows
          path: apps/desktop/release/*/*.exe

  build-and-sign-macos:
    runs-on: macos-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js 22
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Setup Apple Developer ID Certificate
        if: env.APPLE_CERTIFICATE != ''
        env:
          APPLE_CERTIFICATE: ${{ secrets.MAC_CSC_LINK }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
        run: |
          echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12
          security create-keychain -p "" build.keychain
          security default-keychain -s build.keychain
          security unlock-keychain -p "" build.keychain
          security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
          security set-key-partition-list -S apple-tool:,apple: -s -k "" build.keychain

      - name: Build, Sign, and Notarize macOS (Gatekeeper CA)
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          npm run build --workspace=@d3ro/desktop
          npx electron-builder --mac --config apps/desktop/electron-builder.yml

      - name: Upload macOS Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: d3ro-voice-macos
          path: apps/desktop/release/*/*.dmg