name: release

# Canonical tag-triggered desktop release built and published on Forgejo.
# GitLab CI (.gitlab-ci.yml) and GitHub Actions (.github/workflows/release.yml)
# remain alternate builders; all three converge on publish-forgejo-release.mjs
# so the Forgejo feed is the single update source.
#
# Required repository secrets:
#   FORGEJO_TOKEN              — PAT with write:package + write:repository
#   WIN_CSC_LINK               — base64 Authenticode PFX (public-trust)
#   WIN_CSC_KEY_PASSWORD       — PFX password
#   WIN_CSC_EXPECTED_SIGNER_SUBJECT — exact certificate subject
# Release fails closed when signing material is absent.

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:

jobs:
  release-windows:
    runs-on: windows
    defaults: { run: { shell: pwsh } }
    steps:
      - name: checkout
        env: { CI_TOKEN: "${{ github.token }}" }
        run: |
          $u = [Uri]$env:GITHUB_SERVER_URL
          $url = "$($u.Scheme)://actions:$($env:CI_TOKEN)@$($u.Authority)/$($env:GITHUB_REPOSITORY).git"
          if (-not (Test-Path .git)) { git init -q . }
          if (git remote | Select-String -Quiet '^origin$') { git remote set-url origin $url } else { git remote add origin $url }
          git fetch -q --depth 1 origin $env:GITHUB_REF
          git checkout -q -f FETCH_HEAD
          git clean -qfdx

      - name: 버전 정본 대조
        run: |
          node scripts/ci/sync-version.mjs --check --tag "$env:GITHUB_REF_NAME"

      - name: 의존성 설치
        run: npm ci

      - name: 데스크톱 빌드 (서명 필수)
        env:
          WIN_CSC_LINK: "${{ secrets.WIN_CSC_LINK }}"
          WIN_CSC_KEY_PASSWORD: "${{ secrets.WIN_CSC_KEY_PASSWORD }}"
          WIN_CSC_EXPECTED_SIGNER_SUBJECT: "${{ secrets.WIN_CSC_EXPECTED_SIGNER_SUBJECT }}"
        run: |
          if (-not $env:WIN_CSC_LINK -or -not $env:WIN_CSC_KEY_PASSWORD) {
            throw "WIN_CSC_LINK / WIN_CSC_KEY_PASSWORD 가 없으면 stable 릴리스를 게시할 수 없습니다."
          }
          if ($env:WIN_CSC_EXPECTED_SIGNER_SUBJECT -match '(?i)Everything2EverythingDev') {
            throw "로컬 개발 인증서는 production 서명 identity가 아닙니다."
          }
          npm run build --workspace=@d3ro/desktop
          Push-Location apps/desktop
          npx electron-builder --win --x64 --config electron-builder.yml --publish never
          Pop-Location

      - name: Windows 산출물 검증
        env:
          WIN_CSC_EXPECTED_SIGNER_SUBJECT: "${{ secrets.WIN_CSC_EXPECTED_SIGNER_SUBJECT }}"
        run: |
          $releaseVersion = node -p "require('./release/product-version.json').version"
          & scripts/ci/verify-windows-release-artifact.ps1 -ExpectedVersion $releaseVersion -ExpectedSignerSubject $env:WIN_CSC_EXPECTED_SIGNER_SUBJECT -ReleaseDirectory "apps/desktop/release/$releaseVersion"

      - name: Forgejo 릴리스 + feed 게시
        env:
          FORGEJO_TOKEN: "${{ secrets.FORGEJO_TOKEN }}"
          FORGEJO_REPO: "${{ github.server_url }}/${{ github.repository }}"
        run: |
          node scripts/ci/publish-forgejo-release.mjs