name: Release Builds

on:
    push:
        tags:
            - "v*"
    workflow_dispatch:

# Building and testing runs every dependency's build scripts and tests, so those jobs only get a
# read token. Publishing is a separate job that never runs project or dependency code.
permissions:
    contents: read

jobs:
    build:
        name: Build ${{ matrix.platform }}
        runs-on: ${{ matrix.runner }}
        strategy:
            fail-fast: false
            matrix:
                include:
                    - { platform: darwin/amd64, runner: macos-15-intel }
                    - { platform: darwin/arm64, runner: macos-14 }
                    - { platform: linux/amd64, runner: ubuntu-22.04 }
                    - { platform: linux/arm64, runner: ubuntu-22.04-arm }
                    - { platform: windows/amd64, runner: windows-latest }
                    - { platform: windows/arm64, runner: windows-11-arm }
        defaults:
            run:
                shell: bash
                working-directory: rust
        steps:
            - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
              with:
                  fetch-depth: 0
                  persist-credentials: false

            - name: Rust toolchain (pinned by rust-toolchain.toml)
              run: rustup show active-toolchain || rustup toolchain install

            - name: Linux build dependencies
              if: runner.os == 'Linux'
              run: |
                  sudo apt-get update
                  sudo apt-get install -y libxkbcommon-dev libgl1-mesa-dev libx11-dev libxcursor-dev libxrandr-dev libxi-dev libwayland-dev libgtk-3-dev libasound2-dev zip

            - name: Test
              run: cargo test --locked --workspace

            - name: Build and package
              env:
                  NEXUS_RELEASE_TARGETS: ${{ matrix.platform }}
                  NEXUS_RELEASE_ROOT: ${{ github.workspace }}/build/releases
              run: ./release.sh

            - name: Upload artefacts
              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
              with:
                  name: nexus-terminal-${{ matrix.runner }}
                  path: |
                      build/releases/*/NexusTerminal-*.zip
                      build/releases/manifest-*.json
                      build/releases/version-*.txt

    publish:
        name: Attach to GitHub Release
        needs: build
        if: startsWith(github.ref, 'refs/tags/')
        runs-on: ubuntu-22.04
        permissions:
            contents: write
        steps:
            - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
              with:
                  path: artefacts
            - name: Checksums
              run: |
                  find artefacts -name 'NexusTerminal-*.zip' | while read -r f; do
                      (cd "$(dirname "$f")" && sha256sum "$(basename "$f")")
                  done > SHA256SUMS
                  cat SHA256SUMS
            - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
              with:
                  files: |
                      artefacts/*/*/NexusTerminal-*.zip
                      artefacts/*/NexusTerminal-*.zip
                      SHA256SUMS