GitLite/.gitea/workflows/app_builder.yaml

name: "publish"

on:
  release:
    types: [published]

jobs:
  publish-tauri:
    permissions:
      contents: write
    environment: production
    env:
      # --- Gitea (unchanged) ---
      GITEA_API: https://git.cbsk-tech.de/api/v1
      OWNER: Christoph
      REPO: GitLite
      GITEA_TOKEN: ${{ secrets.ACTIONS_TOKEN }}
      GITEA_FALLBACK_TOKEN: ${{ github.token }}

      # --- MinIO / S3-compatible upload ---
      MINIO_ENDPOINT: ${{ vars.MINIO_ENDPOINT }} # e.g. https://updates.example.com
      S3_BUCKET: ${{ vars.S3_BUCKET }} # e.g. updates
      AWS_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY }} # used by aws cli
      AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_KEY }} # used by aws cli
      ARTIFACT_BASE_URL: ${{ vars.ARTIFACT_BASE_URL }} # e.g. https://updates.example.com
      S3_ACCESS_KEY: ${{ secrets.S3_ACCESS_KEY }} # used by cicd_tool
      S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }} # used by cicd_tool

    defaults:
      run:
        working-directory: GitLite

    strategy:
      fail-fast: false
      matrix:
        include:
          # - platform: 'macos-latest'
          #   args: '--target aarch64-apple-darwin'
          # - platform: 'macos-latest'
          #   args: '--target x86_64-apple-darwin'
          # - platform: 'ubuntu-22.04'
          #   args: ''
          - platform: "windows-latest"
            args: ""

    runs-on: ${{ matrix.platform }}

    steps:
      # cicd_tool/main.py expects the repo at <workspace>/GitLite, so check out there.
      - uses: actions/checkout@v5
        with:
          path: GitLite

      - name: install dependencies (ubuntu only)
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      - name: setup node
        uses: actions/setup-node@v4
        with:
          node-version: lts/*

      - name: install frontend dependencies
        run: npm ci

      - name: Update package.json Version
        run: npm version ${{ github.ref_name }} --no-git-tag-version --allow-same-version

      - name: Update tauri.conf.json Version
        shell: powershell
        run: |
          $path = ".\src-tauri\tauri.conf.json"
          $version = '${{ github.ref_name }}'
          $content = Get-Content -Raw -Encoding UTF8 $path
          $regex = [regex]'"version"\s*:\s*"[^"]*"'
          $replacement = '"version": "' + $version + '"'
          $updated = $regex.Replace($content, $replacement, 1)
          $encoding = New-Object System.Text.UTF8Encoding($false)
          [System.IO.File]::WriteAllText($path, $updated, $encoding)

      - name: Commit and Push Changes
        shell: powershell
        run: |
          git config user.name '${{ vars.USERNAME_GIT }}'
          git config user.email '${{ vars.EMAIL_GIT }}'
          # npm version also bumps the version inside package-lock.json, so stage it
          # too -- otherwise it stays as an unstaged change and blocks the rebase.
          git add package.json package-lock.json src-tauri/tauri.conf.json

          git commit -m 'Update version to ${{ github.ref_name }}'
          if ($LASTEXITCODE -ne 0) {
            # Version files already match the tag -> nothing to push, succeed quietly.
            Write-Host 'No version changes to commit; skipping push.'
            exit 0
          }

          # The release build runs in detached HEAD on the tag. Resolve the branch
          # that should receive the version bump.
          $branch = '${{ github.event.release.target_commitish }}'
          if ([string]::IsNullOrEmpty($branch) -or $branch -match '^[0-9a-f]{40}$') {
            $branch = (
              git branch -r --contains $env:GITHUB_SHA |
              ForEach-Object { $_.Trim() } |
              Where-Object { $_ -and ($_ -notmatch '->') } |
              ForEach-Object { $_ -replace '^(?:remotes/)?[^/]+/', '' } |
              Select-Object -First 1
            )
          }

          if ([string]::IsNullOrEmpty($branch)) {
            Write-Host 'Could not determine branch for push.'
            git branch -a
            exit 1
          }

          # The tag may be behind the branch tip. Replay the bump commit on top of
          # the current remote branch so the push is a clean fast-forward.
          git fetch origin $branch
          git rebase "origin/$branch"
          if ($LASTEXITCODE -ne 0) {
            git rebase --abort
            Write-Host "Rebase onto origin/$branch failed."
            exit 1
          }

          git push origin "HEAD:refs/heads/$branch"

      - name: Build Tauri App
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD}}
        run: npm run tauri build
      # ----------------------
      # Upload to MinIO (via mc) and create latest.json
      # ----------------------
      - name: Upload artifacts to MinIO with cicd_tool
        working-directory: GitLite/cicd_tool
        run: |
          uv sync
          uv run main.py