on:
  push:
    tags:
      - 'v*.*.*'

jobs:
  build_desktop:
    runs-on: ${{ matrix.platform.os }}
    strategy:
      matrix:
        platform:
          # - os: ubuntu-latest
          #   name: linux+x86-64
          # no need for macos-11 arm will build for both
          - os: [self-hosted, macOS, ARM64]
            name: darwin+aarch64
          # - os: [self-hosted, linux, ARM64]
          #   name: linux+aarch64
    container: ${{ matrix.platform.container }}
    steps:
    - uses: actions/checkout@v3
    - uses: teaxyz/setup@v0

    - name: get gui version
      id: gui-version
      run: |
        tea +stedolan.github.io/jq
        export version=$(echo $(cat modules/desktop/package.json) | jq --raw-output .version)
        echo "version=$version" >> $GITHUB_OUTPUT

    - name: build
      if: startsWith(matrix.platform.name, 'darwin')
      run: tea -ES +nodejs.org@18 xc dist
      env:
        # PUBLISH_FOR_PULL_REQUEST: true
        PUBLIC_VERSION: ${{ steps.gui-version.outputs.version }}
        USE_HARD_LINKS: false
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        CSC_LINK: ${{ secrets.GUI_APPLE_CERTIFICATE }}
        CSC_KEY_PASSWORD: ${{ secrets.GUI_APPLE_CERTIFICATE_PASSWORD }}
        CSC_NAME: ${{ secrets.APPLE_IDENTITY_NO_PREFIX }}
        # notarization doesnt work
        # APPLE_ID: ${{ secrets.APPLE_ID }}
        # APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
        # AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        # AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        # AWS_REGION: us-east-1
    # build artifacts for publishing and notarization
    - run: mkdir -p target
    - run: cp -r ./modules/desktop/dist/.icon-icns ./target/
    - run: cp ./modules/desktop/dist/*.{zip,dmg,yml,blockmap} ./target/
    - run: tar -czvf artifacts.tgz -C ./target/ .

    - name: upload artifacts
      uses: actions/upload-artifact@v3
      with:
        name: ${{ matrix.platform.name }}
        path: artifacts.tgz
        if-no-files-found: error

  notarize_desktop:
    needs: [build_desktop]
    runs-on: macos-11
    strategy:
      matrix:
        platform:
          # no need for x86-64
          - darwin+aarch64
    steps:
    - uses: teaxyz/setup@v0
    - uses: actions/download-artifact@v3
      with:
        name: ${{ matrix.platform }}

    # prepare folders
    - run: mkdir dist
    - run: tar xzf artifacts.tgz -C dist

    - name: get .zip of arm64 and x86+64
      id: app_files
      working-directory: ./dist
      run: |
        ARM64_ZIP=$(ls | grep -Ev blockmap | grep arm64-mac.zip)
        X86_ZIP=$(ls | grep -Ev blockmap | grep -Ev arm64 | grep mac.zip)
        ARM64_DMG=$(ls | grep -Ev blockmap | grep arm64.dmg)
        X86_DMG=$(ls | grep -Ev blockmap | grep -Ev arm64 | grep dmg)
        echo zip_arm64=$ARM64_ZIP >> $GITHUB_OUTPUT
        echo zip_x86=$X86_ZIP >> $GITHUB_OUTPUT
        echo dmg_arm64=$ARM64_DMG >> $GITHUB_OUTPUT
        echo dmg_x86=$X86_DMG >> $GITHUB_OUTPUT

    # Notarize. Can take up to 10 minutes (and fail) asynchronously
    - name: notarize .app arm64
      run: xcrun altool --notarize-app --username "$APPLE_ID" --password "$APPLE_PASSWORD" --primary-bundle-id "com.tea.xyz" --file dist/$ZIP_FILE
      env:
        APPLE_ID: ${{ secrets.APPLE_ID }}
        APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
        ZIP_FILE: ${{ steps.app_files.outputs.zip_arm64 }}

    - name: notarize .app x86+64
      run: xcrun altool --notarize-app --username "$APPLE_ID" --password "$APPLE_PASSWORD" --primary-bundle-id "com.tea.xyz" --file dist/$ZIP_FILE
      env:
        APPLE_ID: ${{ secrets.APPLE_ID }}
        APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
        ZIP_FILE: ${{ steps.app_files.outputs.zip_x86 }}

    # prepare for DMG creation
    - run: |
        mkdir x86_installer && mkdir arm64_installer
        tar xzf dist/$ZIP_FILE_X86 -C x86_installer/
        tar xzf dist/$ZIP_FILE_ARM64 -C arm64_installer/
        cp -r ./dist/.icon-icns x86_installer/
        cp -r ./dist/.icon-icns arm64_installer/
      env:
        ZIP_FILE_X86: ${{ steps.app_files.outputs.zip_x86 }}
        ZIP_FILE_ARM64: ${{ steps.app_files.outputs.zip_arm64 }}

    - name: create x86 dmg
      run: |
        tea create-dmg \
        --volname "Tea Installer" \
        --window-pos 200 120 \
        --window-size 800 400 \
        --icon-size 100 \
        --icon "tea.app" 200 190 \
        --hide-extension "tea.app" \
        --app-drop-link 600 185 \
        --sandbox-safe \
        "$filename" \
        "$installer_folder"
      env:
        filename: ${{ steps.app_files.outputs.dmg_x86 }}
        installer_folder: x86_installer/

    - name: create arm64 dmg
      run: |
        tea create-dmg \
        --volname "Tea Installer" \
        --window-pos 200 120 \
        --window-size 800 400 \
        --icon-size 100 \
        --icon "tea.app" 200 190 \
        --hide-extension "tea.app" \
        --app-drop-link 600 185 \
        --sandbox-safe \
        "$filename" \
        "$installer_folder"
      env:
        filename: ${{ steps.app_files.outputs.dmg_arm64 }}
        installer_folder: arm64_installer/

    # finalize artifacts
    - run: |
        mv $x86dmg dist
        mv $arm64dmg dist
      env:
        x86dmg: ${{ steps.app_files.outputs.dmg_x86 }}
        arm64dmg: ${{ steps.app_files.outputs.dmg_arm64 }}

    - run: tar -czvf dist.tgz -C dist/ .
    - name: upload artifacts
      uses: actions/upload-artifact@v3
      with:
        name: ${{ matrix.platform }}-dist
        path: dist.tgz
        if-no-files-found: error

  upload:
    needs: [build_desktop, notarize_desktop]
    runs-on: ubuntu-latest
    strategy:
      matrix:
        platform:
          # - linux+x86-64
          # no need for x86 mac
          - darwin+aarch64
          # - linux+aarch64
    steps:
    - uses: actions/checkout@v3
    - uses: actions/download-artifact@v3
      with:
        name: ${{ matrix.platform }}-dist
    - run: mkdir dist
    - run: tar xzf dist.tgz -C dist

    - name: get .zip of arm64 and x86+64
      id: app_files
      working-directory: ./dist
      run: |
        ARM64_ZIP=$(ls | grep -Ev blockmap | grep arm64-mac.zip)
        X86_ZIP=$(ls | grep -Ev blockmap | grep -Ev arm64 | grep mac.zip)
        ARM64_DMG=$(ls | grep -Ev blockmap | grep arm64.dmg)
        X86_DMG=$(ls | grep -Ev blockmap | grep -Ev arm64 | grep dmg)
        echo zip_arm64=$ARM64_ZIP >> $GITHUB_OUTPUT
        echo zip_x86=$X86_ZIP >> $GITHUB_OUTPUT
        echo dmg_arm64=$ARM64_DMG >> $GITHUB_OUTPUT
        echo dmg_x86=$X86_DMG >> $GITHUB_OUTPUT

    - name: build platform output
      id: build_platform
      env:
        platform: ${{ matrix.platform }}
      run: |
        BUILD_PLATFORM=$(echo $platform | sed -e "s/darwin+//g" | sed -e "s/linux+//g")
        EXTENSION=dmg
        case $platform in
          "linux+x86-64")
            BUILD_PLATFORM="amd64"
            EXTENSION="deb"
            ;;
          "linux+aarch64")
            BUILD_PLATFORM="aarch64"
            EXTENSION="deb"
            ;;
          "darwin+aarch64")
            BUILD_PLATFORM="aarch64"
            EXTENSION="dmg"
            ;;
          "darwin+x86-64")
            BUILD_PLATFORM="x64"
            EXTENSION="dmg"
            ;;
          *)
            echo "Unknown platform $platform"
            exit 1
            ;;
        esac
        echo "build_platform=$BUILD_PLATFORM" >> $GITHUB_OUTPUT
        echo "extension=$EXTENSION" >> $GITHUB_OUTPUT
  
    - uses: aws-actions/configure-aws-credentials@v1
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: us-east-1

    # update and replace latest release bin in s3
    - name: Set tag
      id: tag
      run: echo "tag=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT

    # TODO: 
    # - configure correct blockmap and checksum hash on latest-mac.yml
    - name: publish release 
      env:
        platform: ${{ steps.build_platform.outputs.build_platform }}
        extension: ${{ steps.build_platform.outputs.extension }}
        tag: ${{ steps.tag.outputs.tag }}
      run: |
        cd dist && \
        aws s3 sync . \
          "s3://preview.gui.tea.xyz/release/"
    - uses: actions/setup-node@v3
      with:
        node-version: 18
    - name: Slack Notification ARM64 Build
      run: ./.github/notify-slack.js
      env:
        SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
        PLATFORM: darwin+aarch64
        VERSION: ${{steps.tag.outputs.tag}}
        EXT: "${{ steps.build_platform.outputs.extension }}"
        DOWNLOAD_URL:  http://preview.gui.tea.xyz.s3-website-us-east-1.amazonaws.com/release/${{ steps.app_files.outputs.dmg_arm64 }}

    - name: Slack Notification X86 Build
      run: ./.github/notify-slack.js
      env:
        SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
        PLATFORM: darwin+x86-64
        VERSION: ${{steps.tag.outputs.tag}}
        EXT: ${{ steps.build_platform.outputs.extension }}
        DOWNLOAD_URL:  http://preview.gui.tea.xyz.s3-website-us-east-1.amazonaws.com/release/${{ steps.app_files.outputs.dmg_x86 }}

    - run: |
        aws cloudfront create-invalidation \
          --distribution-id ${{ secrets.AWS_CF_GUI_RELEASE_ID }} \
          --paths '/latest-mac.yml'