name: Build HealthChat Desktop

# Builds the HealthChat desktop (Electron) app for macOS and Windows: the fork's
# element-web webapp with the HealthChat plugin (healthchat-module.js + healthchat-elements.js)
# injected, packaged via the element-desktop build pipeline and published to the GitHub Release.
#
# This is the desktop counterpart of build-healthchat.yaml (web). On a `healthchat-v*` tag it
# runs alongside the web build; it first builds the element-plugin from healthchat-workspace,
# builds the fork webapp with the plugin injected, then feeds it into build_desktop_prepare.yaml
# (via `webapp-artifact`) and the per-platform build_desktop_{macos,windows}.yaml reusables.
#
# Notes:
#   - This workflow RELEASES but does not DEPLOY. It stages the update feed + public installers
#     to the versioned archive at packages.healthchat.ch/desktop-releases/<version>/ and links
#     the public installer URLs in the Release notes (nothing binary is attached to the GitHub
#     Release); the live auto-update feed at packages.healthchat.ch/desktop/ is only touched by
#     the manually dispatched deploy-healthchat-desktop.yaml. So cutting a tag never pushes an
#     update to already-installed apps until a human decides to ship it.
#   - The reusable build workflows are pointed at THIS fork (repository/ref inputs) so the Electron
#     shell, icons (apps/desktop/build/icon.*) and the healthchat:// deep-link handler
#     (apps/desktop/src/protocol.ts) are all fork-branded. Branding values come from
#     apps/desktop/element.io/healthchat/{build.json,config.json} (-> variant.json).
#   - macOS notarisation and Windows code-signing require the `Desktop Apple` / `Desktop eSigner`
#     GitHub environments (secrets/vars) to be configured. Without them the builds still run but
#     produce unsigned/untrusted output. See apps/desktop/element.io/healthchat/README.
#   - The desktop app version comes from apps/desktop/package.json (electron-builder); the per-job
#     `version` input only feeds the macOS update manifest and is mangled into a nightly
#     string by Windows squirrel, so it cannot set the app version. To keep the installers / About
#     dialog in sync with the tag, apps/desktop/package.json must be bumped to the release version
#     in the release commit. The "Assert desktop app version matches release" step below enforces
#     this: the build fails fast if package.json drifts from the tag's MAJOR.MINOR.PATCH (any
#     -rc1/-hotfix1 suffix is ignored, since squirrel requires a clean numeric version).

on:
    push:
        tags:
            - "healthchat-v*"
    workflow_dispatch:
        inputs:
            version:
                description: "Version (e.g. 1.4.0). Drives the web bundle version and must match apps/desktop/package.json (MAJOR.MINOR.PATCH), which sets the desktop app version."
                required: true
                type: string
            workspace_ref:
                description: "healthchat-workspace ref (defaults to .healthchat-workspace-version)."
                required: false
                type: string

permissions: {}

concurrency:
    group: build-healthchat-desktop-${{ github.event.inputs.version || github.ref_name }}
    cancel-in-progress: false

jobs:
    webapp:
        name: Build webapp + plugin
        runs-on: ubuntu-latest
        permissions:
            contents: read
        steps:
            - uses: actions/checkout@v4
              with:
                  persist-credentials: false

            - name: Resolve version
              id: version
              env:
                  INPUT_VERSION: ${{ github.event.inputs.version }}
              run: |
                  set -euo pipefail
                  if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
                    VERSION="${GITHUB_REF_NAME#healthchat-v}"
                  elif [[ -n "${INPUT_VERSION:-}" ]]; then
                    VERSION="${INPUT_VERSION}"
                  else
                    echo "::error::No version available (not a tag push and no version input)"
                    exit 1
                  fi
                  if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
                    echo "::error::Invalid version '$VERSION'"
                    exit 1
                  fi
                  echo "version=$VERSION" >> "$GITHUB_OUTPUT"

            # electron-builder bakes apps/desktop/package.json's version into the installers and the
            # About dialog (the per-platform `version` input cannot override it). Fail fast if that
            # file wasn't bumped to this release, so the desktop apps always match the tag. The
            # comparison is on MAJOR.MINOR.PATCH only: tags may carry -rc1/-hotfix1 suffixes, but
            # Windows squirrel needs package.json to stay a clean numeric version.
            - name: Assert desktop app version matches release
              env:
                  VERSION: ${{ steps.version.outputs.version }}
              run: |
                  set -euo pipefail
                  BASE=$(printf '%s' "$VERSION" | grep -oE '^[0-9]+\.[0-9]+\.[0-9]+')
                  PKG=$(jq -r .version apps/desktop/package.json)
                  if [[ "$PKG" != "$BASE" ]]; then
                    echo "::error::apps/desktop/package.json version ($PKG) does not match release $BASE (tag: $VERSION). Bump apps/desktop/package.json to $BASE in the release commit so the desktop installers and About dialog match the tag."
                    exit 1
                  fi
                  echo "Desktop app version $PKG matches release $BASE"

            - name: Resolve workspace ref
              id: workspace
              env:
                  OVERRIDE: ${{ github.event.inputs.workspace_ref }}
              run: |
                  set -euo pipefail
                  if [[ -n "$OVERRIDE" ]]; then
                    REF="$OVERRIDE"
                  elif [[ -f .healthchat-workspace-version ]]; then
                    REF=$(head -n1 .healthchat-workspace-version | tr -d '[:space:]')
                    [[ -n "$REF" ]] || { echo "::error::.healthchat-workspace-version is empty"; exit 1; }
                  else
                    echo "::error::.healthchat-workspace-version missing and no workspace_ref override provided"
                    exit 1
                  fi
                  echo "ref=$REF" >> "$GITHUB_OUTPUT"

            - name: Checkout healthchat-workspace
              uses: actions/checkout@v4
              with:
                  repository: Novaloop-AG/healthchat-workspace
                  path: healthchat-workspace
                  token: ${{ secrets.HEALTHCHAT_WORKSPACE_TOKEN }}
                  ref: ${{ steps.workspace.outputs.ref }}
                  persist-credentials: false

            # v6.0.8 reads the pnpm version from devEngines.packageManager in package.json
            # (this repo has no top-level "packageManager" field, which older majors require).
            - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
            - name: Setup Node.js
              uses: actions/setup-node@v4
              with:
                  node-version: 22
                  cache: "pnpm"

            - name: Install monorepo deps
              run: pnpm install --frozen-lockfile

            - name: Build element-plugin
              run: |
                  cd healthchat-workspace/element-plugin
                  npm ci
                  npm run build
                  cd module
                  npm ci
                  npm run build

            - name: Stage plugin artifacts
              run: |
                  mkdir -p plugin-dist/elements
                  cp healthchat-workspace/element-plugin/module/dist/healthchat-module.js plugin-dist/healthchat-module.js
                  cp healthchat-workspace/element-plugin/dist/elements/browser/main.js plugin-dist/elements/healthchat-elements.js

            - name: Build webapp with plugin injected
              env:
                  VERSION: ${{ steps.version.outputs.version }}
              run: ./apps/desktop/scripts/build-healthchat-webapp.sh

            - uses: actions/upload-artifact@v4
              with:
                  name: healthchat-webapp
                  retention-days: 1
                  path: apps/desktop/webapp

    prepare:
        name: Prepare desktop asar
        needs: webapp
        permissions:
            contents: read
        uses: ./.github/workflows/build_desktop_prepare.yaml
        with:
            repository: ${{ github.repository }}
            ref: ${{ github.sha }}
            config: element.io/healthchat
            webapp-artifact: healthchat-webapp
            # 'develop' skips the upstream "[Release] Fetch release" / Debian changelog step,
            # which would look for a non-existent v<package.json-version> release in this fork.
            version: develop
            nightly: false
            deploy: false

    macos:
        name: macOS
        needs: prepare
        permissions:
            contents: read
        uses: ./.github/workflows/build_desktop_macos.yaml
        secrets: inherit # zizmor: ignore[secrets-inherit]
        with:
            repository: ${{ github.repository }}
            ref: ${{ github.sha }}
            sign: true
            test: false
            targets: "dmg zip"
            # Generates dist/releases.json (the Squirrel.Mac feed manifest). The reusable appends
            # `/update/macos/<zip>` to this, so the in-manifest URL becomes
            # https://packages.healthchat.ch/desktop/update/macos/<zip>, matching where the
            # `release` job publishes the feed. Keep in sync with update_base_url in
            # element.io/healthchat/config.json (.../desktop/update/).
            base-url: https://packages.healthchat.ch/desktop

    windows:
        name: Windows ${{ matrix.arch }}
        needs: prepare
        permissions:
            contents: read
        strategy:
            matrix:
                arch: [x64, arm64]
        uses: ./.github/workflows/build_desktop_windows.yaml
        # element-desktop's Windows reusable signs via SSL.com eSigner CKA, whose secret names
        # differ from the org-level CodeSignTool secrets shared with the other Novaloop apps
        # (CKA needs no credential_id). Map them here. A trusted signature also requires the
        # repo/org variable ESIGNER_MODE=prod (otherwise the reusable falls back to the untrusted
        # sandbox demo cert).
        secrets:
            ESIGNER_USER_NAME: ${{ secrets.ESIGNER_USERNAME }}
            ESIGNER_USER_PASSWORD: ${{ secrets.ESIGNER_PASSWORD }}
            ESIGNER_USER_TOTP: ${{ secrets.ESIGNER_TOTP_SECRET }}
        with:
            repository: ${{ github.repository }}
            ref: ${{ github.sha }}
            arch: ${{ matrix.arch }}
            sign: true
            test: false
            targets: "squirrel msi"

    release:
        name: Stage feed archive + Release notes
        needs: [macos, windows]
        # Runs on tag pushes AND manual dispatches: the archive upload is idempotent per version
        # (mirror --delete into desktop-releases/<version>/), and re-running it via dispatch is
        # the recovery path for a version whose archive is missing. The GitHub Release steps
        # below stay tag-only, so a dispatch can never touch release history.
        if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
        runs-on: ubuntu-latest
        permissions:
            contents: write
        steps:
            # Needed so the staging step can read HEALTHCHAT_CHANGES.md to extract release notes.
            # Lands at the workspace root; download-artifact below writes to dist-artifacts/, no conflict.
            - uses: actions/checkout@v4
              with:
                  persist-credentials: false

            - name: Resolve version
              id: relversion
              env:
                  INPUT_VERSION: ${{ github.event.inputs.version }}
              run: |
                  set -euo pipefail
                  if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
                    VERSION="${GITHUB_REF_NAME#healthchat-v}"
                  else
                    VERSION="${INPUT_VERSION:?No version input on workflow_dispatch}"
                  fi
                  echo "version=$VERSION" >> "$GITHUB_OUTPUT"

            - name: Download all build artifacts
              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
              with:
                  path: dist-artifacts

            # Installers are NOT attached to the Release: they ship inside the staged feed and are
            # served from packages.healthchat.ch after the deploy — the Release body links to them
            # there (see "Link public downloads in the Release notes" below). Attaching them here
            # would duplicate ~1 GiB per release and the x64/arm64 Setup.exe share a filename, so
            # they'd clobber each other as flat Release assets anyway.
            - name: Ensure GitHub Release exists
              if: startsWith(github.ref, 'refs/tags/')
              env:
                  GH_TOKEN: ${{ github.token }}
                  GH_REPO: ${{ github.repository }}
                  TAG: ${{ github.ref_name }}
              run: |
                  set -euo pipefail
                  # The web workflow (build-healthchat.yaml) also creates this release for the same tag.
                  # Create-if-missing (without touching existing notes) so the two workflows race
                  # safely regardless of ordering.
                  gh release view "$TAG" >/dev/null 2>&1 || \
                    gh release create "$TAG" --title "$TAG" --notes "HealthChat $TAG"

            # The GitHub Release is private (internal fork), so it can't serve end users or the
            # Squirrel auto-updater. Those are served from packages.healthchat.ch/desktop/, which is
            # published by the SEPARATE, MANUALLY DISPATCHED "Deploy HealthChat Desktop" workflow
            # (deploy-healthchat-desktop.yaml) — releasing never touches the live update feed.
            # This job only *stages* that feed and uploads it to the versioned archive at
            # packages.healthchat.ch/desktop-releases/<version>/ (the archive persists, so the
            # deploy workflow can publish any staged version without rebuilding or re-signing).
            - name: Stage update feed + public installers
              env:
                  VERSION: ${{ steps.relversion.outputs.version }}
              run: |
                  set -euo pipefail
                  # --- Release notes: extract this version's section from HEALTHCHAT_CHANGES.md ---
                  # Same extraction as build-healthchat.yaml (web). Surfaced to desktop users in the
                  # auto-update "See changes" dialog: macOS reads it from releases.json's `notes`
                  # field natively, Windows fetches notes.txt (Squirrel.Windows can't carry notes
                  # through the update-downloaded event — only releaseName is available).
                  NOTES=$(awk -v ver="$VERSION" '
                    /^## Changes in / {
                      if (found) { exit }
                      if ($0 ~ "## Changes in " ver "( |$|\\()") { found = 1; next }
                    }
                    found { print }
                  ' HEALTHCHAT_CHANGES.md | sed '/^[[:space:]]*$/{N;/^\n$/D;}')
                  if [[ -z "$NOTES" ]]; then
                    NOTES="HealthChat ${VERSION} — automated build from ${GITHUB_REF_NAME}."
                    echo "::warning::No HEALTHCHAT_CHANGES.md section found for $VERSION — using fallback"
                  fi
                  printf '%s\n' "$NOTES" > notes.txt
                  echo "--- release notes ---"; cat notes.txt

                  # --- macOS update feed: releases.json (Squirrel.Mac manifest) + signed *-mac.zip payload ---
                  mkdir -p feed/update/macos feed/install/macos
                  test -f dist-artifacts/macos/releases.json || {
                    echo "::error::dist-artifacts/macos/releases.json missing (did the macos job get base-url?)"; exit 1; }
                  cp -v dist-artifacts/macos/releases.json feed/update/macos/
                  # Splice the notes into the manifest: Squirrel.Mac maps updateTo.notes -> the
                  # update-downloaded event's releaseNotes, which the renderer already renders.
                  jq --rawfile notes notes.txt '.releases[0].updateTo.notes = $notes' \
                    feed/update/macos/releases.json > feed/update/macos/releases.json.tmp
                  mv feed/update/macos/releases.json.tmp feed/update/macos/releases.json
                  find dist-artifacts/macos -type f -iname '*-mac.zip' -exec cp -v {} feed/update/macos/ \;
                  # --- macOS installer: versioned .dmg + a stable "latest" copy ---
                  find dist-artifacts/macos -type f -iname '*.dmg' -exec cp -v {} feed/install/macos/ \;
                  dmg=$(find feed/install/macos -type f -iname '*.dmg' | head -n1)
                  test -n "$dmg" && cp -v "$dmg" feed/install/macos/HealthChat.dmg
                  # --- Windows: per-arch Squirrel feed (RELEASES + full nupkg) + installers (Setup.exe, msi) ---
                  for arch in x64 arm64; do
                    src="dist-artifacts/win-$arch"
                    [ -d "$src" ] || { echo "::error::$src missing"; exit 1; }
                    mkdir -p "feed/update/win32/$arch" "feed/install/win32/$arch"
                    # Side-channel for release notes: the desktop main process fetches this and
                    # populates releaseNotes itself, since Squirrel.Windows can't deliver them.
                    cp -v notes.txt "feed/update/win32/$arch/notes.txt"
                    find "$src" -type f -iname 'RELEASES'      -exec cp -v {} "feed/update/win32/$arch/" \;
                    find "$src" -type f -iname '*-full.nupkg'  -exec cp -v {} "feed/update/win32/$arch/" \;
                    find "$src" -type f -iname '* Setup*.exe'  -exec cp -v {} "feed/install/win32/$arch/" \;
                    find "$src" -type f -iname '*.msi'         -exec cp -v {} "feed/install/win32/$arch/" \;
                    setup=$(find "feed/install/win32/$arch" -type f -iname '* Setup*.exe' | head -n1)
                    test -n "$setup" && cp -v "$setup" "feed/install/win32/$arch/HealthChat-Setup.exe"
                  done
                  echo "--- staged feed tree ---"
                  find feed -type f | sort

            # Upload the staged feed to the versioned archive instead of publishing it. "Deploy
            # HealthChat Desktop" (deploy-healthchat-desktop.yaml) mirrors this archive to the
            # live feed when a human decides to ship. The archive directories persist on the
            # server, so any staged version stays redeployable without rebuilding or re-signing.
            # (The feed used to be attached to the GitHub Release as a tarball, but the
            # compressed feed outgrew GitHub's 2 GiB per-asset cap at 1.6.0.)
            - name: Publish staged feed to the versioned archive
              env:
                  FTP_SERVER: ${{ secrets.FTP_SERVER }}
                  FTP_USERNAME: ${{ secrets.FTP_USERNAME }}
                  # Passed to lftp via LFTP_PASSWORD (--env-password) so it never appears on the
                  # command line / process list.
                  LFTP_PASSWORD: ${{ secrets.FTP_PASSWORD }}
                  VERSION: ${{ steps.relversion.outputs.version }}
              run: |
                  set -euo pipefail
                  : "${FTP_SERVER:?FTP_SERVER secret not set}"
                  : "${FTP_USERNAME:?FTP_USERNAME secret not set}"
                  : "${LFTP_PASSWORD:?FTP_PASSWORD secret not set}"
                  sudo apt-get update && sudo apt-get install -y lftp
                  # The archive dir is owned by this version's build: --delete makes re-runs
                  # idempotent (a rebuild fully replaces the staged tree). The live feed under
                  # /public_html/packages/desktop is never touched here.
                  lftp -u "$FTP_USERNAME" --env-password "$FTP_SERVER" <<LFTP
                  set cmd:fail-exit true
                  set ftp:ssl-force true
                  set ftp:ssl-protect-data true
                  set ssl:verify-certificate true
                  mkdir -pf /public_html/packages/desktop-releases/$VERSION
                  mirror -R --delete --parallel=4 --verbose feed/ /public_html/packages/desktop-releases/$VERSION/
                  bye
                  LFTP
                  echo "::notice::Feed staged at https://packages.healthchat.ch/desktop-releases/$VERSION/ — the live feed is UNCHANGED. Run 'Deploy HealthChat Desktop' to publish it."

            # The Release carries no installer binaries (see "Ensure GitHub Release exists"), so
            # point readers at the public download URLs instead. The links are derived from the
            # staged feed/install tree, so they stay correct if electron-builder ever renames the
            # artifacts. They resolve once "Deploy HealthChat Desktop" has published this version.
            - name: Link public downloads in the Release notes
              if: startsWith(github.ref, 'refs/tags/')
              env:
                  GH_TOKEN: ${{ github.token }}
                  GH_REPO: ${{ github.repository }}
                  TAG: ${{ github.ref_name }}
              run: |
                  set -euo pipefail
                  BASE="https://packages.healthchat.ch/desktop"
                  BODY=$(gh release view "$TAG" --json body --jq .body)
                  if [[ "$BODY" == *"## Downloads"* ]]; then
                    echo "Release notes already carry a Downloads section — leaving them untouched."
                    exit 0
                  fi
                  {
                    printf '%s\n\n' "$BODY"
                    echo "## Downloads"
                    echo ""
                    echo "Public installers, live once this version is deployed via \"Deploy HealthChat Desktop\":"
                    echo ""
                    for f in feed/install/macos/* feed/install/win32/x64/* feed/install/win32/arm64/*; do
                      name=$(basename "$f")
                      # Skip the stable "latest" aliases — they track whatever is deployed, not this version.
                      case "$name" in HealthChat.dmg|HealthChat-Setup.exe) continue ;; esac
                      dir=$(dirname "${f#feed/}")
                      case "$dir" in
                        */macos) platform="macOS" ;;
                        */x64) platform="Windows x64" ;;
                        */arm64) platform="Windows arm64" ;;
                        *) platform="$dir" ;;
                      esac
                      enc=$(jq -rn --arg s "$name" '$s|@uri')
                      echo "- [$name]($BASE/$dir/$enc) — $platform"
                    done
                  } > release-body.md
                  gh release edit "$TAG" --notes-file release-body.md
                  echo "::notice::Release notes now link the public installers under $BASE/install/."