name: Manual Build Windows Release & Mac
on:
  workflow_dispatch:
    inputs:
      branch:
        description: 'Define branch name'
        required: true
        default: 'master'

permissions:
  contents: write

jobs:
  windows-bin:
    runs-on: windows-latest
    env:
      UNSPLASH_KEY: ${{ secrets.UNSPLASH_KEY }}
      UNSPLASH_CLIENT_ID: ${{ secrets.UNSPLASH_CLIENT_ID }}

    steps:
      - name: Check out Git repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          persist-credentials: false

      - name: Setup Electron build environment
        uses: ./.github/actions/setup-electron-build

      # @nx/nx-win32-x64-msvc isn't in package.json (npm's optional-dep bug
      # skips it), so install it explicitly. That install and `npm i` both run
      # electron's flaky postinstall binary download, so retry the whole thing
      # — dropping node_modules/electron between tries forces the postinstall
      # to re-run (npm skips it for a present package).
      - name: Install npm Packages
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 15
          shell: bash
          command: npm install @nx/nx-win32-x64-msvc && npm i || { rm -rf node_modules/electron; exit 1; }

      - name: Build Frontend & Electron TS
        run: npm run buildAllElectron:noTests:prod

      - name: Build Electron app
        uses: johannesjo/action-electron-builder@9ea9e2d991c97668843d57337848e3e2b1ffab3d # v1
        with:
          build_script_name: empty
          github_token: ${{ secrets.github_token }}
          release: false

      - name: 'Upload Artifact'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: WinBuildStuff
          path: .tmp/app-builds/*.exe

  mac-bin:
    runs-on: macos-15
    env:
      UNSPLASH_KEY: ${{ secrets.UNSPLASH_KEY }}
      UNSPLASH_CLIENT_ID: ${{ secrets.UNSPLASH_CLIENT_ID }}

    steps:
      - name: Check out Git repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          persist-credentials: false

      - name: Echo is Release
        run: echo "IS_RELEASE $IS_RELEASE, ${{ startsWith(github.ref, 'refs/tags/v') }}"
        env:
          IS_RELEASE: ${{ startsWith(github.ref, 'refs/tags/v') }}

      - name: Setup Electron build environment
        uses: ./.github/actions/setup-electron-build

      # @nx/nx-darwin-arm64 + dmg-license aren't in package.json (npm's
      # optional-dep bug skips them), so install them explicitly. That install
      # and `npm i` both run electron's flaky postinstall binary download, so
      # retry the whole thing — dropping node_modules/electron between tries
      # forces the postinstall to re-run (npm skips it for a present package).
      - name: Install npm Packages
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 15
          shell: bash
          command: npm install @nx/nx-darwin-arm64 dmg-license && npm i || { rm -rf node_modules/electron; exit 1; }

      - run: 'echo "$PROVISION_PROFILE" | base64 --decode > embedded.provisionprofile'
        shell: bash
        env:
          PROVISION_PROFILE: ${{secrets.dl_provision_profile}}

      - name: Prepare for app notarization
        # Import Apple API key for app notarization on macOS
        run: |
          mkdir -p ~/private_keys/
          echo '${{ secrets.mac_api_key }}' > ~/private_keys/AuthKey_${{ secrets.mac_api_key_id }}.p8

      - run: npm run env # Generate env.generated.ts

      - name: Lint
        run: npm run lint

      - name: Test Unit
        run: npm run test

      #      - uses: browser-actions/setup-chrome@v1
      #        id: setup-chrome
      #      - run: |
      #          echo Installed chromium version: ${{ steps.setup-chrome.outputs.chrome-version }}
      #          ${{ steps.setup-chrome.outputs.chrome-path }} --version
      # Disabled because not working atm: https://github.com/super-productivity/super-productivity/actions/runs/5924016145/job/16060737982
      #      - name: Test E2E
      #        run: npm run e2e

      - name: Build Frontend & Electron
        run: npm run build

      - name: Build/Release Electron app
        uses: johannesjo/action-electron-builder@9ea9e2d991c97668843d57337848e3e2b1ffab3d # v1
        with:
          build_script_name: empty
          github_token: ${{ secrets.github_token }}
          mac_certs: ${{ secrets.mac_certs }}
          mac_certs_password: ${{ secrets.mac_certs_password }}
          release: ${{ startsWith(github.ref, 'refs/tags/v') }}
          # macOS notarization API key
        env:
          API_KEY_ID: ${{ secrets.mac_api_key_id }}
          API_KEY_ISSUER_ID: ${{ secrets.mac_api_key_issuer_id }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

      # - name: notary log
      #  if: always()
      # run: ls -la && cat notarization-error.log
      - name: 'Upload Artifact'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dmg
          path: .tmp/app-builds/*.dmg
