release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      skip_release:
        description: 'Build artifacts only (no GitHub release)'
        type: boolean
        default: true

env:
  NODE_VERSION: '22'
  PNPM_VERSION: '9.15.0'
  GO_VERSION: '1.25.9'
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build-api:
    name: Build API
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v5
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build API
        run: pnpm build --filter=@breeze/api

      - name: Upload API artifact
        uses: actions/upload-artifact@v7
        with:
          name: api-dist
          path: apps/api/dist
          retention-days: 30

  build-web:
    name: Build Web
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v5
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Get version from tag
        id: web-version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Build Web
        env:
          PUBLIC_APP_VERSION: ${{ steps.web-version.outputs.version }}
        run: pnpm build --filter=@breeze/web

      - name: Upload Web artifact
        uses: actions/upload-artifact@v7
        with:
          name: web-dist
          path: apps/web/dist
          retention-days: 30

  build-agent:
    name: Build Agent
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - goos: linux
            goarch: amd64
            suffix: ''
            cgo: '0'
            runner: ubuntu-latest
          - goos: darwin
            goarch: amd64
            suffix: ''
            cgo: '1'
            runner: macos-latest
          - goos: darwin
            goarch: arm64
            suffix: ''
            cgo: '1'
            runner: macos-latest
          - goos: windows
            goarch: amd64
            suffix: '.exe'
            cgo: '0'
            runner: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: agent/go.sum

      - name: Download Go dependencies
        working-directory: agent
        run: go mod download

      - name: Get version from tag
        id: version
        env:
          REF_NAME: ${{ github.ref_name }}
        run: echo "version=${REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Build Agent
        working-directory: agent
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: ${{ matrix.cgo }}
          BUILD_VERSION: ${{ steps.version.outputs.version }}
          # Allow weak-linking ScreenCaptureKit so the binary runs on macOS 12+
          # where SCK doesn't exist (prevents dyld Symbol not found crash)
          CGO_LDFLAGS_ALLOW: '-weak_framework|ScreenCaptureKit'
        run: |
          go build -ldflags="-s -w -X main.version=${BUILD_VERSION}" \
            -o "breeze-agent-${GOOS}-${GOARCH}${{ matrix.suffix }}" \
            ./cmd/breeze-agent

      - name: Upload Agent artifact
        uses: actions/upload-artifact@v7
        with:
          name: breeze-agent-${{ matrix.goos }}-${{ matrix.goarch }}
          path: agent/breeze-agent-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.suffix }}
          retention-days: 30

      - name: Build breeze-backup
        working-directory: agent
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: ${{ matrix.cgo }}
          BUILD_VERSION: ${{ steps.version.outputs.version }}
          CGO_LDFLAGS_ALLOW: '-weak_framework|ScreenCaptureKit'
        run: |
          go build -ldflags="-s -w -X main.version=${BUILD_VERSION}" \
            -o "breeze-backup-${GOOS}-${GOARCH}${{ matrix.suffix }}" \
            ./cmd/breeze-backup

      - name: Upload breeze-backup artifact
        uses: actions/upload-artifact@v7
        with:
          name: breeze-backup-${{ matrix.goos }}-${{ matrix.goarch }}
          path: agent/breeze-backup-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.suffix }}
          retention-days: 30

      - name: Build breeze-watchdog
        working-directory: agent
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: 0
          BUILD_VERSION: ${{ steps.version.outputs.version }}
        run: |
          go build -ldflags="-s -w -X main.version=${BUILD_VERSION}" \
            -o "breeze-watchdog-${GOOS}-${GOARCH}${{ matrix.suffix }}" \
            ./cmd/breeze-watchdog

      - name: Upload breeze-watchdog artifact
        uses: actions/upload-artifact@v7
        with:
          name: breeze-watchdog-${{ matrix.goos }}-${{ matrix.goarch }}
          path: agent/breeze-watchdog-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.suffix }}
          retention-days: 30

      - name: Build breeze-desktop-helper
        if: matrix.goos == 'darwin'
        working-directory: agent
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: ${{ matrix.cgo }}
          BUILD_VERSION: ${{ steps.version.outputs.version }}
          CGO_LDFLAGS_ALLOW: '-weak_framework|ScreenCaptureKit'
        run: |
          go build -ldflags="-s -w -X main.version=${BUILD_VERSION}" \
            -o "breeze-desktop-helper-${GOOS}-${GOARCH}" \
            ./cmd/breeze-desktop-helper

      - name: Upload breeze-desktop-helper artifact
        if: matrix.goos == 'darwin'
        uses: actions/upload-artifact@v7
        with:
          name: breeze-desktop-helper-${{ matrix.goos }}-${{ matrix.goarch }}
          path: agent/breeze-desktop-helper-${{ matrix.goos }}-${{ matrix.goarch }}
          retention-days: 30

  build-windows-msi:
    name: Build + Sign Windows Artifacts
    if: vars.ENABLE_WINDOWS_SIGNING == 'true'
    runs-on: windows-latest
    needs: [build-agent]
    permissions:
      contents: read
      id-token: write
    environment:
      name: ${{ contains(github.ref_name, '-') && 'signing-prerelease' || 'signing-production' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: agent/go.sum

      - name: Download Go dependencies
        working-directory: agent
        shell: pwsh
        run: go mod download

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '8.0.x'

      - name: Install WiX CLI
        shell: pwsh
        run: |
          dotnet tool update --global wix | Out-Null
          if ($LASTEXITCODE -ne 0) {
            dotnet tool install --global wix | Out-Null
          }
          "$env:USERPROFILE\.dotnet\tools" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
          wix eula accept wix7

      - name: Get version from tag
        id: version
        shell: pwsh
        env:
          REF_NAME: ${{ github.ref_name }}
        run: |
          $version = $env:REF_NAME.Substring(1)
          "version=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append

      - name: Build Windows resources and binary
        shell: pwsh
        env:
          BUILD_VERSION: ${{ steps.version.outputs.version }}
        run: |
          New-Item -Path dist -ItemType Directory -Force | Out-Null
          go install github.com/tc-hib/go-winres@v0.3.3
          Push-Location agent\resources
          & "$env:USERPROFILE\go\bin\go-winres.exe" make --in winres.json --out ..\cmd\breeze-agent\rsrc_windows_amd64.syso
          Pop-Location
          Push-Location agent
          $env:GOOS = "windows"
          $env:GOARCH = "amd64"
          $env:CGO_ENABLED = "0"
          go build -ldflags="-s -w -X main.version=$env:BUILD_VERSION" -o ..\dist\breeze-agent-windows-amd64.exe .\cmd\breeze-agent
          Pop-Location
          # Build breeze-backup
          Push-Location agent
          $env:GOOS = "windows"
          $env:GOARCH = "amd64"
          $env:CGO_ENABLED = "0"
          go build -ldflags="-s -w -X main.version=$env:BUILD_VERSION" -o ..\dist\breeze-backup-windows-amd64.exe .\cmd\breeze-backup
          Pop-Location
          # Build breeze-watchdog
          Push-Location agent
          $env:GOOS = "windows"
          $env:GOARCH = "amd64"
          $env:CGO_ENABLED = "0"
          go build -ldflags="-s -w -X main.version=$env:BUILD_VERSION" -o ..\dist\breeze-watchdog-windows-amd64.exe .\cmd\breeze-watchdog
          Pop-Location

      - name: Validate signing configuration
        shell: pwsh
        env:
          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          AZURE_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
          AZURE_CERT_PROFILE_PROD: ${{ secrets.AZURE_CERT_PROFILE_PROD }}
          AZURE_CERT_PROFILE_PRERELEASE: ${{ secrets.AZURE_CERT_PROFILE_PRERELEASE }}
        run: |
          $required = @("AZURE_CLIENT_ID", "AZURE_TENANT_ID", "AZURE_SIGNING_ENDPOINT", "AZURE_SIGNING_ACCOUNT_NAME")
          foreach ($name in $required) {
            if ([string]::IsNullOrWhiteSpace((Get-Item "env:$name").Value)) {
              throw "Missing required signing secret: $name"
            }
          }

          $isPrerelease = "${{ contains(github.ref_name, '-') }}" -eq "true"
          if ($isPrerelease) {
            if ([string]::IsNullOrWhiteSpace($env:AZURE_CERT_PROFILE_PRERELEASE)) {
              throw "Missing required signing secret: AZURE_CERT_PROFILE_PRERELEASE"
            }
          } else {
            if ([string]::IsNullOrWhiteSpace($env:AZURE_CERT_PROFILE_PROD)) {
              throw "Missing required signing secret: AZURE_CERT_PROFILE_PROD"
            }
          }

      - name: Azure Login (OIDC)
        uses: azure/login@v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          allow-no-subscriptions: true

      - name: Sign Windows EXE (stable profile)
        if: ${{ !contains(github.ref_name, '-') }}
        uses: azure/artifact-signing-action@v1
        with:
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_PROD }}
          files: ${{ github.workspace }}\dist\breeze-agent-windows-amd64.exe
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Sign Windows EXE (prerelease profile)
        if: ${{ contains(github.ref_name, '-') }}
        uses: azure/artifact-signing-action@v1
        with:
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_PRERELEASE }}
          files: ${{ github.workspace }}\dist\breeze-agent-windows-amd64.exe
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Sign backup EXE (stable profile)
        if: ${{ !contains(github.ref_name, '-') }}
        uses: azure/artifact-signing-action@v1
        with:
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_PROD }}
          files: ${{ github.workspace }}\dist\breeze-backup-windows-amd64.exe
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Sign backup EXE (prerelease profile)
        if: ${{ contains(github.ref_name, '-') }}
        uses: azure/artifact-signing-action@v1
        with:
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_PRERELEASE }}
          files: ${{ github.workspace }}\dist\breeze-backup-windows-amd64.exe
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Sign watchdog executable (stable profile)
        if: ${{ !contains(github.ref_name, '-') }}
        uses: azure/artifact-signing-action@v1
        with:
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_PROD }}
          files: ${{ github.workspace }}\dist\breeze-watchdog-windows-amd64.exe
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Sign watchdog executable (prerelease profile)
        if: ${{ contains(github.ref_name, '-') }}
        uses: azure/artifact-signing-action@v1
        with:
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_PRERELEASE }}
          files: ${{ github.workspace }}\dist\breeze-watchdog-windows-amd64.exe
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Build MSI
        shell: pwsh
        run: |
          $root = $env:GITHUB_WORKSPACE
          $version = "${{ steps.version.outputs.version }}"
          $agentExe = Join-Path $root "dist\breeze-agent-windows-amd64.exe"
          $backupExe = Join-Path $root "dist\breeze-backup-windows-amd64.exe"
          $watchdogExe = Join-Path $root "dist\breeze-watchdog-windows-amd64.exe"
          $msiPath = Join-Path $root "dist\breeze-agent.msi"
          & (Join-Path $root "agent\installer\build-msi.ps1") -Version $version -AgentExePath $agentExe -BackupExePath $backupExe -WatchdogExePath $watchdogExe -OutputPath $msiPath

      - name: Build Template MSI
        shell: pwsh
        run: |
          $root = $env:GITHUB_WORKSPACE
          $version = "${{ steps.version.outputs.version }}"
          $agentExe = Join-Path $root "dist\breeze-agent-windows-amd64.exe"
          $backupExe = Join-Path $root "dist\breeze-backup-windows-amd64.exe"
          $watchdogExe = Join-Path $root "dist\breeze-watchdog-windows-amd64.exe"
          $msiPath = Join-Path $root "dist\breeze-agent-template.msi"
          & (Join-Path $root "agent\installer\build-msi.ps1") -Version $version -AgentExePath $agentExe -BackupExePath $backupExe -WatchdogExePath $watchdogExe -OutputPath $msiPath -Template

      # Only sign the regular MSI — template MSI is re-signed server-side by jsign after patching
      - name: Sign MSI (stable profile)
        if: ${{ !contains(github.ref_name, '-') }}
        uses: azure/artifact-signing-action@v1
        with:
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_PROD }}
          files: ${{ github.workspace }}\dist\breeze-agent.msi
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Sign MSI (prerelease profile)
        if: ${{ contains(github.ref_name, '-') }}
        uses: azure/artifact-signing-action@v1
        with:
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_PRERELEASE }}
          files: ${{ github.workspace }}\dist\breeze-agent.msi
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Verify signatures
        shell: pwsh
        run: |
          $targets = @(
            (Join-Path $env:GITHUB_WORKSPACE "dist\breeze-agent-windows-amd64.exe"),
            (Join-Path $env:GITHUB_WORKSPACE "dist\breeze-backup-windows-amd64.exe"),
            (Join-Path $env:GITHUB_WORKSPACE "dist\breeze-watchdog-windows-amd64.exe"),
            (Join-Path $env:GITHUB_WORKSPACE "dist\breeze-agent.msi")
          )
          foreach ($target in $targets) {
            $sig = Get-AuthenticodeSignature -FilePath $target
            # Valid = fully trusted chain; UnknownError = signed but Azure Trusted
            # Signing root cert not yet in local trust store (normal for new accounts)
            if ($sig.Status -ne "Valid" -and $sig.Status -ne "UnknownError") {
              throw "Signature validation failed for $target. Status: $($sig.Status)"
            }
            if ($sig.Status -eq "UnknownError") {
              Write-Host "::warning::$target signed but root cert not yet trusted locally (Status: UnknownError). This is normal for new Azure Trusted Signing accounts."
            }
            Write-Host "Verified: $target - Status: $($sig.Status) - Signer: $($sig.SignerCertificate.Subject)"
          }

      - name: Upload signed Windows EXE artifact
        uses: actions/upload-artifact@v7
        with:
          name: breeze-agent-windows-amd64
          path: dist/breeze-agent-windows-amd64.exe
          overwrite: true
          retention-days: 30

      - name: Upload Windows MSI artifact
        uses: actions/upload-artifact@v7
        with:
          name: breeze-agent-windows-msi
          path: dist/breeze-agent.msi
          retention-days: 30

      - name: Upload Template MSI artifact
        uses: actions/upload-artifact@v7
        with:
          name: breeze-agent-template-msi
          path: dist/breeze-agent-template.msi
          retention-days: 30

      - name: Upload signed backup EXE artifact
        uses: actions/upload-artifact@v7
        with:
          name: breeze-backup-windows-amd64
          path: dist/breeze-backup-windows-amd64.exe
          overwrite: true
          retention-days: 30

      - name: Upload signed watchdog EXE artifact
        uses: actions/upload-artifact@v7
        with:
          name: breeze-watchdog-windows-amd64
          path: dist/breeze-watchdog-windows-amd64.exe
          overwrite: true
          retention-days: 30

  build-macos-agent:
    name: Sign macOS Agent Binary
    runs-on: macos-latest
    needs: [build-agent]
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Download darwin/amd64 artifact
        uses: actions/download-artifact@v8
        with:
          name: breeze-agent-darwin-amd64
          path: staging/

      - name: Download darwin/arm64 artifact
        uses: actions/download-artifact@v8
        with:
          name: breeze-agent-darwin-arm64
          path: staging/

      - name: Download backup darwin/amd64 artifact
        uses: actions/download-artifact@v8
        with:
          name: breeze-backup-darwin-amd64
          path: staging/

      - name: Download backup darwin/arm64 artifact
        uses: actions/download-artifact@v8
        with:
          name: breeze-backup-darwin-arm64
          path: staging/

      - name: Download desktop-helper darwin/amd64 artifact
        uses: actions/download-artifact@v8
        with:
          name: breeze-desktop-helper-darwin-amd64
          path: staging/

      - name: Download desktop-helper darwin/arm64 artifact
        uses: actions/download-artifact@v8
        with:
          name: breeze-desktop-helper-darwin-arm64
          path: staging/

      - name: Download watchdog darwin/amd64 artifact
        uses: actions/download-artifact@v8
        with:
          name: breeze-watchdog-darwin-amd64
          path: staging/

      - name: Download watchdog darwin/arm64 artifact
        uses: actions/download-artifact@v8
        with:
          name: breeze-watchdog-darwin-arm64
          path: staging/

      - name: Import certificate into keychain
        if: vars.ENABLE_MACOS_SIGNING == 'true'
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          CERT_PATH="$RUNNER_TEMP/cert.p12"
          KEYCHAIN_PATH="$RUNNER_TEMP/signing.keychain-db"
          KEYCHAIN_PASSWORD="$(openssl rand -hex 16)"

          echo "$APPLE_CERTIFICATE" | base64 --decode > "$CERT_PATH"

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$CERT_PATH" -P "$APPLE_CERTIFICATE_PASSWORD" \
            -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: \
            -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security list-keychains -d user -s "$KEYCHAIN_PATH" \
            $(security list-keychains -d user | tr -d '"')

          rm -f "$CERT_PATH"

      - name: Sign binaries
        if: vars.ENABLE_MACOS_SIGNING == 'true'
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          for bin in staging/breeze-agent-darwin-* staging/breeze-backup-darwin-* staging/breeze-desktop-helper-darwin-* staging/breeze-watchdog-darwin-*; do
            [ -f "$bin" ] || continue
            codesign --force --options runtime \
              --entitlements agent/entitlements/agent-macos.entitlements.plist \
              --sign "$APPLE_SIGNING_IDENTITY" --timestamp "$bin"
            codesign --verify --verbose "$bin"
            echo "Signed: $bin"
          done

      - name: Notarize binaries
        if: vars.ENABLE_MACOS_SIGNING == 'true'
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          for bin in staging/breeze-agent-darwin-* staging/breeze-backup-darwin-* staging/breeze-desktop-helper-darwin-* staging/breeze-watchdog-darwin-*; do
            [ -f "$bin" ] || continue
            ZIP_PATH="${bin}.zip"
            ditto -c -k --keepParent "$bin" "$ZIP_PATH"

            echo "Submitting $(basename "$bin") for notarization..."
            xcrun notarytool submit "$ZIP_PATH" \
              --apple-id "$APPLE_ID" \
              --password "$APPLE_PASSWORD" \
              --team-id "$APPLE_TEAM_ID" \
              --wait --timeout 30m

            rm -f "$ZIP_PATH"
            echo "Notarized: $(basename "$bin")"
          done

      - name: Upload signed darwin/amd64
        uses: actions/upload-artifact@v7
        with:
          name: breeze-agent-darwin-amd64
          path: staging/breeze-agent-darwin-amd64
          overwrite: true
          retention-days: 30

      - name: Upload signed darwin/arm64
        uses: actions/upload-artifact@v7
        with:
          name: breeze-agent-darwin-arm64
          path: staging/breeze-agent-darwin-arm64
          overwrite: true
          retention-days: 30

      - name: Upload signed backup darwin/amd64
        uses: actions/upload-artifact@v7
        with:
          name: breeze-backup-darwin-amd64
          path: staging/breeze-backup-darwin-amd64
          overwrite: true
          retention-days: 30

      - name: Upload signed backup darwin/arm64
        uses: actions/upload-artifact@v7
        with:
          name: breeze-backup-darwin-arm64
          path: staging/breeze-backup-darwin-arm64
          overwrite: true
          retention-days: 30

      - name: Upload signed desktop-helper darwin/amd64
        uses: actions/upload-artifact@v7
        with:
          name: breeze-desktop-helper-darwin-amd64
          path: staging/breeze-desktop-helper-darwin-amd64
          overwrite: true
          retention-days: 30

      - name: Upload signed desktop-helper darwin/arm64
        uses: actions/upload-artifact@v7
        with:
          name: breeze-desktop-helper-darwin-arm64
          path: staging/breeze-desktop-helper-darwin-arm64
          overwrite: true
          retention-days: 30

      - name: Upload signed watchdog darwin/amd64
        uses: actions/upload-artifact@v7
        with:
          name: breeze-watchdog-darwin-amd64
          path: staging/breeze-watchdog-darwin-amd64
          overwrite: true
          retention-days: 30

      - name: Upload signed watchdog darwin/arm64
        uses: actions/upload-artifact@v7
        with:
          name: breeze-watchdog-darwin-arm64
          path: staging/breeze-watchdog-darwin-arm64
          overwrite: true
          retention-days: 30

      - name: Build macOS .pkg installers
        env:
          BUILD_VERSION: ${{ github.ref_name }}
        run: |
          VERSION="${BUILD_VERSION#v}"
          chmod +x agent/installer/macos/build-pkg.sh
          for arch in amd64 arm64; do
            agent/installer/macos/build-pkg.sh \
              "staging/breeze-agent-darwin-${arch}" \
              "staging/breeze-desktop-helper-darwin-${arch}" \
              "staging/breeze-backup-darwin-${arch}" \
              "staging/breeze-watchdog-darwin-${arch}" \
              "$VERSION" \
              "$arch" \
              "staging/breeze-agent-darwin-${arch}.pkg"
          done

      - name: Sign .pkg installers
        if: vars.ENABLE_MACOS_SIGNING == 'true'
        env:
          APPLE_INSTALLER_IDENTITY: ${{ secrets.APPLE_INSTALLER_IDENTITY }}
        run: |
          if [ -z "$APPLE_INSTALLER_IDENTITY" ]; then
            echo "APPLE_INSTALLER_IDENTITY not set, skipping .pkg signing"
            exit 0
          fi
          for pkg in staging/*.pkg; do
            SIGNED="${pkg%.pkg}-signed.pkg"
            productsign --sign "$APPLE_INSTALLER_IDENTITY" "$pkg" "$SIGNED"
            mv "$SIGNED" "$pkg"
            echo "Signed: $(basename "$pkg")"
          done

      - name: Notarize and staple .pkg installers
        if: vars.ENABLE_MACOS_SIGNING == 'true'
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_INSTALLER_IDENTITY: ${{ secrets.APPLE_INSTALLER_IDENTITY }}
        run: |
          if [ -z "$APPLE_INSTALLER_IDENTITY" ]; then
            echo "APPLE_INSTALLER_IDENTITY not set, skipping .pkg notarization"
            exit 0
          fi
          for pkg in staging/*.pkg; do
            echo "Submitting $(basename "$pkg") for notarization..."
            xcrun notarytool submit "$pkg" \
              --apple-id "$APPLE_ID" \
              --password "$APPLE_PASSWORD" \
              --team-id "$APPLE_TEAM_ID" \
              --wait --timeout 30m

            xcrun stapler staple "$pkg"
            echo "Notarized and stapled: $(basename "$pkg")"
          done

      - name: Upload .pkg darwin/amd64
        uses: actions/upload-artifact@v7
        with:
          name: breeze-agent-darwin-amd64-pkg
          path: staging/breeze-agent-darwin-amd64.pkg
          retention-days: 30

      - name: Upload .pkg darwin/arm64
        uses: actions/upload-artifact@v7
        with:
          name: breeze-agent-darwin-arm64-pkg
          path: staging/breeze-agent-darwin-arm64.pkg
          retention-days: 30

      - name: Cleanup keychain
        if: always() && vars.ENABLE_MACOS_SIGNING == 'true'
        run: security delete-keychain "$RUNNER_TEMP/signing.keychain-db" || true

  build-macos-installer-app:
    name: Build macOS Installer App
    needs: [build-macos-agent]
    runs-on: macos-latest
    if: vars.ENABLE_MACOS_SIGNING == 'true'
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Download .pkg darwin/amd64
        uses: actions/download-artifact@v8
        with:
          name: breeze-agent-darwin-amd64-pkg
          path: installer-pkgs/

      - name: Download .pkg darwin/arm64
        uses: actions/download-artifact@v8
        with:
          name: breeze-agent-darwin-arm64-pkg
          path: installer-pkgs/

      - name: Import certificate into keychain
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
        run: |
          CERT_PATH="$RUNNER_TEMP/cert.p12"
          KEYCHAIN_PATH="$RUNNER_TEMP/signing.keychain-db"
          KEYCHAIN_PASSWORD="$(openssl rand -hex 16)"

          echo "$APPLE_CERTIFICATE" | base64 --decode > "$CERT_PATH"

          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security import "$CERT_PATH" -P "$APPLE_CERTIFICATE_PASSWORD" \
            -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: \
            -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security list-keychains -d user -s "$KEYCHAIN_PATH" \
            $(security list-keychains -d user | tr -d '"')

          rm -f "$CERT_PATH"

      - name: Build .app bundle
        run: |
          chmod +x agent/installer/macos-app/build-app-bundle.sh
          agent/installer/macos-app/build-app-bundle.sh \
            --pkg-amd64 installer-pkgs/breeze-agent-darwin-amd64.pkg \
            --pkg-arm64 installer-pkgs/breeze-agent-darwin-arm64.pkg \
            --output "build/Breeze Installer.app"

      - name: Sign .app
        env:
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
        run: |
          codesign --force --options runtime \
            --entitlements agent/installer/macos-app/entitlements.plist \
            --sign "$APPLE_SIGNING_IDENTITY" --timestamp \
            --deep "build/Breeze Installer.app"
          codesign --verify --verbose=2 "build/Breeze Installer.app"

      - name: Notarize + staple
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          ditto -c -k --keepParent "build/Breeze Installer.app" build/installer-notarize.zip
          xcrun notarytool submit build/installer-notarize.zip \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait --timeout 30m
          xcrun stapler staple "build/Breeze Installer.app"
          xcrun stapler validate "build/Breeze Installer.app"
          spctl -a -t exec -vv "build/Breeze Installer.app"

      - name: Package for release
        run: |
          ditto -c -k --sequesterRsrc --keepParent \
            "build/Breeze Installer.app" \
            "build/Breeze Installer.app.zip"
          ls -lh build/

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: breeze-installer-app
          path: build/Breeze Installer.app.zip
          retention-days: 30

      - name: Cleanup keychain
        if: always()
        run: security delete-keychain "$RUNNER_TEMP/signing.keychain-db" || true

  build-viewer:
    name: Build Viewer
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: windows-latest
            target: x86_64-pc-windows-msvc
            asset_name: breeze-viewer-windows.msi
            asset_glob: 'src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.msi'
          - platform: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            asset_name: breeze-viewer-linux.AppImage
            asset_glob: 'src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage'
    runs-on: ${{ matrix.platform }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Install Linux dependencies
        if: contains(matrix.platform, 'ubuntu')
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      - name: Setup pnpm
        uses: pnpm/action-setup@v5
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: apps/viewer/src-tauri -> target

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Get version from tag
        id: version
        shell: bash
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Inject version into viewer config
        shell: bash
        working-directory: apps/viewer
        env:
          BUILD_VERSION: ${{ steps.version.outputs.version }}
        run: |
          # Strip prerelease suffix for WiX/Tauri/Cargo compatibility (e.g. 0.11.3-rc.1 → 0.11.3)
          MSI_VERSION="${BUILD_VERSION%%-*}"
          # Update tauri.conf.json — match any semver version string
          sed -i.bak 's/"version": "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/"version": "'"$MSI_VERSION"'"/' src-tauri/tauri.conf.json && rm src-tauri/tauri.conf.json.bak
          # Update window title to include version
          sed -i.bak 's/"title": "Breeze Remote Desktop"/"title": "Breeze Remote Desktop '"$MSI_VERSION"'"/' src-tauri/tauri.conf.json && rm src-tauri/tauri.conf.json.bak
          # Update Cargo.toml
          sed -i.bak 's/^version = "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/version = "'"$MSI_VERSION"'"/' src-tauri/Cargo.toml && rm src-tauri/Cargo.toml.bak
          # Update package.json
          sed -i.bak 's/"version": "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/"version": "'"$MSI_VERSION"'"/' package.json && rm package.json.bak
          echo "Injected version $MSI_VERSION into viewer config files (from $BUILD_VERSION)"

      - name: Validate signing key
        shell: bash
        run: |
          if [ -z "$TAURI_SIGNING_PRIVATE_KEY" ]; then
            echo "::error::TAURI_SIGNING_PRIVATE_KEY secret is not set — update signing will fail"
            exit 1
          fi
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}

      - name: Build Tauri app
        working-directory: apps/viewer
        shell: bash
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: pnpm tauri build --target ${{ matrix.target }}

      - name: Find and rename artifact
        id: find_asset
        shell: bash
        working-directory: apps/viewer
        run: |
          asset=$(ls ${{ matrix.asset_glob }} 2>/dev/null | head -1)
          if [ -z "$asset" ]; then
            echo "ERROR: No asset found matching ${{ matrix.asset_glob }}"
            ls -R src-tauri/target/*/release/bundle/ || true
            exit 1
          fi
          cp "$asset" "${{ matrix.asset_name }}"
          echo "path=${{ matrix.asset_name }}" >> "$GITHUB_OUTPUT"

      - name: Package updater bundle (Linux)
        if: matrix.platform == 'ubuntu-22.04'
        shell: bash
        working-directory: apps/viewer
        run: |
          bundle_dir="src-tauri/target/${{ matrix.target }}/release/bundle/appimage"
          appimage=$(ls "$bundle_dir"/*.AppImage 2>/dev/null | grep -v '\.sig$' | grep -v '\.tar\.gz' | head -1)
          sig_file=$(ls "$bundle_dir"/*.AppImage.sig 2>/dev/null | head -1)
          if [ -z "$appimage" ] || [ -z "$sig_file" ]; then
            echo "ERROR: Updater bundle not found in $bundle_dir"
            ls -la "$bundle_dir" || true
            ls -R src-tauri/target/*/release/bundle/ || true
            exit 1
          fi
          cp "$appimage" breeze-viewer-linux.AppImage
          cp "$sig_file" breeze-viewer-linux.AppImage.sig

      - name: Upload Viewer artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.asset_name }}
          path: apps/viewer/${{ matrix.asset_name }}
          retention-days: 30

      - name: Upload Viewer Linux updater bundle
        if: matrix.platform == 'ubuntu-22.04'
        uses: actions/upload-artifact@v7
        with:
          name: breeze-viewer-linux-updater
          path: |
            apps/viewer/breeze-viewer-linux.AppImage
            apps/viewer/breeze-viewer-linux.AppImage.sig
          retention-days: 30

  build-helper:
    name: Build Helper
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: windows-latest
            target: x86_64-pc-windows-msvc
            asset_name: breeze-helper-windows.msi
            asset_glob: 'src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.msi'
          - platform: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            asset_name: breeze-helper-linux.AppImage
            asset_glob: 'src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage'
    runs-on: ${{ matrix.platform }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Install Linux dependencies
        if: contains(matrix.platform, 'ubuntu')
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      - name: Setup pnpm
        uses: pnpm/action-setup@v5
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: apps/helper/src-tauri -> target

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Get version from tag
        id: version
        shell: bash
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Inject version into helper config
        shell: bash
        working-directory: apps/helper
        env:
          BUILD_VERSION: ${{ steps.version.outputs.version }}
        run: |
          # Strip prerelease suffix for WiX/Tauri/Cargo compatibility (e.g. 0.11.3-rc.1 → 0.11.3)
          MSI_VERSION="${BUILD_VERSION%%-*}"
          # Update tauri.conf.json — match any semver version string
          sed -i.bak 's/"version": "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/"version": "'"$MSI_VERSION"'"/' src-tauri/tauri.conf.json && rm src-tauri/tauri.conf.json.bak
          # Update window title to include version
          sed -i.bak 's/"title": "Breeze Remote Desktop"/"title": "Breeze Remote Desktop '"$MSI_VERSION"'"/' src-tauri/tauri.conf.json && rm src-tauri/tauri.conf.json.bak
          # Update Cargo.toml
          sed -i.bak 's/^version = "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/version = "'"$MSI_VERSION"'"/' src-tauri/Cargo.toml && rm src-tauri/Cargo.toml.bak
          # Update package.json
          sed -i.bak 's/"version": "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/"version": "'"$MSI_VERSION"'"/' package.json && rm package.json.bak
          echo "Injected version $MSI_VERSION into helper config files (from $BUILD_VERSION)"

      - name: Build Tauri app
        working-directory: apps/helper
        shell: bash
        env:
          TAURI_SIGNING_PRIVATE_KEY: ''
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: pnpm tauri build --target ${{ matrix.target }}

      - name: Find and rename artifact
        id: find_asset
        shell: bash
        working-directory: apps/helper
        run: |
          asset=$(ls ${{ matrix.asset_glob }} 2>/dev/null | head -1)
          if [ -z "$asset" ]; then
            echo "ERROR: No asset found matching ${{ matrix.asset_glob }}"
            ls -R src-tauri/target/*/release/bundle/ || true
            exit 1
          fi
          cp "$asset" "${{ matrix.asset_name }}"
          echo "path=${{ matrix.asset_name }}" >> "$GITHUB_OUTPUT"

      - name: Upload Helper artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.asset_name }}
          path: apps/helper/${{ matrix.asset_name }}
          retention-days: 30

  build-viewer-macos:
    name: Build Viewer (macOS)
    runs-on: macos-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v5
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: apps/viewer/src-tauri -> target

      - name: Add macOS universal target
        run: |
          rustup target add aarch64-apple-darwin
          rustup target add x86_64-apple-darwin

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Get version from tag
        id: version
        shell: bash
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Inject version into viewer config
        shell: bash
        working-directory: apps/viewer
        env:
          BUILD_VERSION: ${{ steps.version.outputs.version }}
        run: |
          # Strip prerelease suffix for WiX/Tauri/Cargo compatibility (e.g. 0.11.3-rc.1 → 0.11.3)
          MSI_VERSION="${BUILD_VERSION%%-*}"
          sed -i.bak 's/"version": "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/"version": "'"$MSI_VERSION"'"/' src-tauri/tauri.conf.json && rm src-tauri/tauri.conf.json.bak
          sed -i.bak 's/^version = "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/version = "'"$MSI_VERSION"'"/' src-tauri/Cargo.toml && rm src-tauri/Cargo.toml.bak
          sed -i.bak 's/"version": "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/"version": "'"$MSI_VERSION"'"/' package.json && rm package.json.bak
          echo "Injected version $MSI_VERSION into viewer config files (from $BUILD_VERSION)"

      - name: Validate signing key
        shell: bash
        run: |
          if [ -z "$TAURI_SIGNING_PRIVATE_KEY" ]; then
            echo "::error::TAURI_SIGNING_PRIVATE_KEY secret is not set — update signing will fail"
            exit 1
          fi
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}

      - name: Build Tauri app
        working-directory: apps/viewer
        shell: bash
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: pnpm tauri build --target universal-apple-darwin

      - name: Find and rename artifact
        shell: bash
        working-directory: apps/viewer
        run: |
          asset=$(ls src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg 2>/dev/null | head -1)
          if [ -z "$asset" ]; then
            echo "ERROR: No DMG found"
            ls -R src-tauri/target/*/release/bundle/ || true
            exit 1
          fi
          cp "$asset" breeze-viewer-macos.dmg

      - name: Notarize and staple DMG
        shell: bash
        working-directory: apps/viewer
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          xcrun notarytool submit breeze-viewer-macos.dmg \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait --timeout 30m
          xcrun stapler staple breeze-viewer-macos.dmg
          xcrun stapler validate breeze-viewer-macos.dmg

      - name: Package updater bundle (macOS)
        shell: bash
        working-directory: apps/viewer
        run: |
          bundle_dir="src-tauri/target/universal-apple-darwin/release/bundle/macos"
          tar_gz=$(ls "$bundle_dir"/*.app.tar.gz 2>/dev/null | head -1)
          sig_file=$(ls "$bundle_dir"/*.app.tar.gz.sig 2>/dev/null | head -1)
          if [ -z "$tar_gz" ] || [ -z "$sig_file" ]; then
            echo "ERROR: Updater bundle not found in $bundle_dir"
            ls -la "$bundle_dir" || true
            ls -R src-tauri/target/*/release/bundle/ || true
            exit 1
          fi
          cp "$tar_gz" breeze-viewer-macos.app.tar.gz
          cp "$sig_file" breeze-viewer-macos.app.tar.gz.sig

      - name: Upload Viewer macOS artifact
        uses: actions/upload-artifact@v7
        with:
          name: breeze-viewer-macos.dmg
          path: apps/viewer/breeze-viewer-macos.dmg
          retention-days: 30

      - name: Upload Viewer macOS updater bundle
        uses: actions/upload-artifact@v7
        with:
          name: breeze-viewer-macos-updater
          path: |
            apps/viewer/breeze-viewer-macos.app.tar.gz
            apps/viewer/breeze-viewer-macos.app.tar.gz.sig
          retention-days: 30

  build-helper-macos:
    name: Build Helper (macOS)
    runs-on: macos-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v5
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: apps/helper/src-tauri -> target

      - name: Add macOS universal target
        run: |
          rustup target add aarch64-apple-darwin
          rustup target add x86_64-apple-darwin

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Get version from tag
        id: version
        shell: bash
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Inject version into helper config
        shell: bash
        working-directory: apps/helper
        env:
          BUILD_VERSION: ${{ steps.version.outputs.version }}
        run: |
          # Strip prerelease suffix for WiX/Tauri/Cargo compatibility (e.g. 0.11.3-rc.1 → 0.11.3)
          MSI_VERSION="${BUILD_VERSION%%-*}"
          sed -i.bak 's/"version": "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/"version": "'"$MSI_VERSION"'"/' src-tauri/tauri.conf.json && rm src-tauri/tauri.conf.json.bak
          sed -i.bak 's/^version = "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/version = "'"$MSI_VERSION"'"/' src-tauri/Cargo.toml && rm src-tauri/Cargo.toml.bak
          sed -i.bak 's/"version": "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/"version": "'"$MSI_VERSION"'"/' package.json && rm package.json.bak
          echo "Injected version $MSI_VERSION into helper config files (from $BUILD_VERSION)"

      - name: Build Tauri app
        working-directory: apps/helper
        shell: bash
        env:
          TAURI_SIGNING_PRIVATE_KEY: ''
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: pnpm tauri build --target universal-apple-darwin

      - name: Find and rename artifact
        shell: bash
        working-directory: apps/helper
        run: |
          asset=$(ls src-tauri/target/universal-apple-darwin/release/bundle/dmg/*.dmg 2>/dev/null | head -1)
          if [ -z "$asset" ]; then
            echo "ERROR: No DMG found"
            ls -R src-tauri/target/*/release/bundle/ || true
            exit 1
          fi
          cp "$asset" breeze-helper-macos.dmg

      - name: Notarize and staple DMG
        shell: bash
        working-directory: apps/helper
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
        run: |
          xcrun notarytool submit breeze-helper-macos.dmg \
            --apple-id "$APPLE_ID" \
            --password "$APPLE_PASSWORD" \
            --team-id "$APPLE_TEAM_ID" \
            --wait --timeout 30m
          xcrun stapler staple breeze-helper-macos.dmg
          xcrun stapler validate breeze-helper-macos.dmg

      - name: Upload Helper macOS artifact
        uses: actions/upload-artifact@v7
        with:
          name: breeze-helper-macos.dmg
          path: apps/helper/breeze-helper-macos.dmg
          retention-days: 30

  sign-windows-tauri:
    name: Sign Windows Tauri Artifacts
    if: vars.ENABLE_WINDOWS_SIGNING == 'true'
    runs-on: windows-latest
    needs: [build-viewer, build-helper]
    permissions:
      contents: read
      id-token: write
    environment:
      name: ${{ contains(github.ref_name, '-') && 'signing-prerelease' || 'signing-production' }}
    steps:
      - name: Download viewer Windows MSI
        uses: actions/download-artifact@v8
        with:
          name: breeze-viewer-windows.msi
          path: staging/

      - name: Download helper Windows MSI
        uses: actions/download-artifact@v8
        with:
          name: breeze-helper-windows.msi
          path: staging/

      - name: Validate signing configuration
        shell: pwsh
        env:
          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          AZURE_SIGNING_ACCOUNT_NAME: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
        run: |
          $required = @("AZURE_CLIENT_ID", "AZURE_TENANT_ID", "AZURE_SIGNING_ENDPOINT", "AZURE_SIGNING_ACCOUNT_NAME")
          foreach ($name in $required) {
            if ([string]::IsNullOrWhiteSpace((Get-Item "env:$name").Value)) {
              throw "Missing required signing secret: $name"
            }
          }

      - name: Azure Login (OIDC)
        uses: azure/login@v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          allow-no-subscriptions: true

      - name: Sign viewer MSI (stable profile)
        if: ${{ !contains(github.ref_name, '-') }}
        uses: azure/artifact-signing-action@v1
        with:
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_PROD }}
          files: ${{ github.workspace }}/staging/breeze-viewer-windows.msi
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Sign viewer MSI (prerelease profile)
        if: ${{ contains(github.ref_name, '-') }}
        uses: azure/artifact-signing-action@v1
        with:
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_PRERELEASE }}
          files: ${{ github.workspace }}/staging/breeze-viewer-windows.msi
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Sign helper MSI (stable profile)
        if: ${{ !contains(github.ref_name, '-') }}
        uses: azure/artifact-signing-action@v1
        with:
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_PROD }}
          files: ${{ github.workspace }}/staging/breeze-helper-windows.msi
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Sign helper MSI (prerelease profile)
        if: ${{ contains(github.ref_name, '-') }}
        uses: azure/artifact-signing-action@v1
        with:
          endpoint: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
          signing-account-name: ${{ secrets.AZURE_SIGNING_ACCOUNT_NAME }}
          certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_PRERELEASE }}
          files: ${{ github.workspace }}/staging/breeze-helper-windows.msi
          file-digest: SHA256
          timestamp-rfc3161: http://timestamp.acs.microsoft.com
          timestamp-digest: SHA256

      - name: Verify signatures
        shell: pwsh
        run: |
          $targets = @(
            (Join-Path $env:GITHUB_WORKSPACE "staging\breeze-viewer-windows.msi"),
            (Join-Path $env:GITHUB_WORKSPACE "staging\breeze-helper-windows.msi")
          )
          foreach ($target in $targets) {
            $sig = Get-AuthenticodeSignature -FilePath $target
            if ($sig.Status -ne "Valid" -and $sig.Status -ne "UnknownError") {
              throw "Signature validation failed for $target. Status: $($sig.Status)"
            }
            if ($sig.Status -eq "UnknownError") {
              Write-Host "::warning::$target signed but root cert not yet trusted locally (Status: UnknownError)."
            }
            Write-Host "Verified: $target - Status: $($sig.Status) - Signer: $($sig.SignerCertificate.Subject)"
          }

      - name: Upload signed viewer MSI
        uses: actions/upload-artifact@v7
        with:
          name: breeze-viewer-windows.msi
          path: staging/breeze-viewer-windows.msi
          overwrite: true
          retention-days: 30

      - name: Upload signed helper MSI
        uses: actions/upload-artifact@v7
        with:
          name: breeze-helper-windows.msi
          path: staging/breeze-helper-windows.msi
          overwrite: true
          retention-days: 30

  package-windows-updater:
    name: Package Windows Updater Bundle
    if: vars.ENABLE_WINDOWS_SIGNING == 'true'
    runs-on: ubuntu-latest
    needs: [sign-windows-tauri]
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v5
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Download signed viewer MSI
        uses: actions/download-artifact@v8
        with:
          name: breeze-viewer-windows.msi
          path: staging/

      - name: Create updater zip
        run: |
          set -euo pipefail
          if [ ! -s staging/breeze-viewer-windows.msi ]; then
            echo "::error::Signed MSI missing or empty at staging/breeze-viewer-windows.msi"
            exit 1
          fi
          cd staging
          zip -j breeze-viewer-windows.msi.zip breeze-viewer-windows.msi

      - name: Minisign the zip with Tauri key
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          set -euo pipefail
          key_file=$(mktemp)
          trap 'rm -f "$key_file"' EXIT
          printf '%s' "$TAURI_SIGNING_PRIVATE_KEY" > "$key_file"
          unset TAURI_SIGNING_PRIVATE_KEY
          cd apps/viewer
          pnpm exec tauri signer sign -f "$key_file" "$GITHUB_WORKSPACE/staging/breeze-viewer-windows.msi.zip"
          if [ ! -s "$GITHUB_WORKSPACE/staging/breeze-viewer-windows.msi.zip.sig" ]; then
            echo "::error::Tauri signer did not produce .sig file"
            exit 1
          fi

      - name: Upload Windows updater bundle
        uses: actions/upload-artifact@v7
        with:
          name: breeze-viewer-windows-updater
          path: |
            staging/breeze-viewer-windows.msi.zip
            staging/breeze-viewer-windows.msi.zip.sig
          retention-days: 30

  merge-viewer-update-manifest:
    name: Generate Viewer Update Manifest
    runs-on: ubuntu-latest
    needs: [build-viewer, build-viewer-macos, package-windows-updater]
    if: >-
      !cancelled()
      && (needs.build-viewer.result == 'success' || needs.build-viewer.result == 'skipped')
      && (needs.build-viewer-macos.result == 'success' || needs.build-viewer-macos.result == 'skipped')
      && (needs.package-windows-updater.result == 'success' || needs.package-windows-updater.result == 'skipped')
    steps:
      - name: Download viewer updater bundles
        uses: actions/download-artifact@v8
        with:
          path: updater-bundles
          pattern: 'breeze-viewer-*-updater'
          merge-multiple: true

      - name: Generate latest.json
        shell: bash
        env:
          REF_NAME: ${{ github.ref_name }}
          REPO: ${{ github.repository }}
          SERVER_URL: ${{ github.server_url }}
          WIN_UPDATER_RESULT: ${{ needs.package-windows-updater.result }}
        run: |
          # Strip leading "v" and any prerelease suffix so the version matches
          # the one injected into tauri.conf.json at build time.
          version="${REF_NAME#v}"
          version="${version%%-*}"
          pub_date=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
          release_base="${SERVER_URL}/${REPO}/releases/download/${REF_NAME}"
          notes_url="${SERVER_URL}/${REPO}/releases/tag/${REF_NAME}"

          echo "Downloaded updater bundle contents:"
          ls -la updater-bundles/ || true

          platforms='{}'

          # macOS — Tauri builds a universal binary, so the same bundle
          # satisfies both x86_64 and aarch64 clients.
          mac_sig="updater-bundles/breeze-viewer-macos.app.tar.gz.sig"
          if [ -f "$mac_sig" ]; then
            sig_content=$(cat "$mac_sig")
            url="${release_base}/breeze-viewer-macos.app.tar.gz"
            platforms=$(jq -n \
              --arg sig "$sig_content" \
              --arg url "$url" \
              '{"darwin-x86_64": {signature: $sig, url: $url}, "darwin-aarch64": {signature: $sig, url: $url}}')
          else
            echo "::warning::macOS updater signature not found — macOS auto-update disabled for this release"
          fi

          # Linux AppImage
          linux_sig="updater-bundles/breeze-viewer-linux.AppImage.sig"
          if [ -f "$linux_sig" ]; then
            sig_content=$(cat "$linux_sig")
            url="${release_base}/breeze-viewer-linux.AppImage"
            platforms=$(echo "$platforms" | jq \
              --arg sig "$sig_content" \
              --arg url "$url" \
              '. + {"linux-x86_64": {signature: $sig, url: $url}}')
          else
            echo "::warning::Linux updater signature not found — Linux auto-update disabled for this release"
          fi

          # Windows MSI updater bundle
          win_sig="updater-bundles/breeze-viewer-windows.msi.zip.sig"
          if [ -f "$win_sig" ]; then
            sig_content=$(cat "$win_sig")
            url="${release_base}/breeze-viewer-windows.msi.zip"
            platforms=$(echo "$platforms" | jq \
              --arg sig "$sig_content" \
              --arg url "$url" \
              '. + {"windows-x86_64": {signature: $sig, url: $url}}')
          elif [ "$WIN_UPDATER_RESULT" = "success" ]; then
            echo "::error::package-windows-updater reported success but no sig found at $win_sig"
            exit 1
          else
            echo "::warning::Windows updater signature not found (upstream result: $WIN_UPDATER_RESULT) — Windows auto-update disabled for this release"
          fi

          if [ "$(echo "$platforms" | jq 'keys | length')" = "0" ]; then
            echo "::error::No updater platforms available — latest.json would be useless"
            exit 1
          fi

          jq -n \
            --arg version "$version" \
            --arg notes "See release notes at $notes_url" \
            --arg pub_date "$pub_date" \
            --argjson platforms "$platforms" \
            '{version: $version, notes: $notes, pub_date: $pub_date, platforms: $platforms}' > latest.json

          echo "Generated latest.json:"
          cat latest.json

      - name: Upload generated manifest
        uses: actions/upload-artifact@v7
        with:
          name: viewer-latest-json
          path: latest.json
          retention-days: 30

  create-release:
    name: Create Release
    runs-on: ubuntu-latest
    needs: [build-api, build-web, build-agent, build-windows-msi, build-macos-agent, build-macos-installer-app, sign-windows-tauri, build-viewer, build-helper, build-viewer-macos, build-helper-macos, merge-viewer-update-manifest, package-windows-updater]
    if: >-
      !cancelled()
      && needs.build-api.result == 'success'
      && needs.build-web.result == 'success'
      && needs.build-agent.result == 'success'
      && (needs.build-windows-msi.result == 'success' || needs.build-windows-msi.result == 'skipped')
      && (needs.build-macos-agent.result == 'success' || needs.build-macos-agent.result == 'skipped')
      && (needs.build-macos-installer-app.result == 'success' || needs.build-macos-installer-app.result == 'skipped')
      && (needs.sign-windows-tauri.result == 'success' || needs.sign-windows-tauri.result == 'skipped')
      && (needs.package-windows-updater.result == 'success' || needs.package-windows-updater.result == 'skipped')
      && (needs.build-viewer.result == 'success' || needs.build-viewer.result == 'skipped')
      && (needs.build-helper.result == 'success' || needs.build-helper.result == 'skipped')
      && (needs.build-viewer-macos.result == 'success' || needs.build-viewer-macos.result == 'skipped')
      && (needs.build-helper-macos.result == 'success' || needs.build-helper-macos.result == 'skipped')
      && (needs.merge-viewer-update-manifest.result == 'success' || needs.merge-viewer-update-manifest.result == 'skipped')
      && !(github.event_name == 'workflow_dispatch' && inputs.skip_release)
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts
          pattern: '{api-dist,web-dist,breeze-agent-*,breeze-backup-*,breeze-desktop-helper-*,breeze-watchdog-*,breeze-viewer-*,breeze-helper-*,breeze-installer-app,viewer-latest-json}'
          merge-multiple: false

      - name: Prepare release assets
        run: |
          mkdir -p release-assets

          # Copy agent binaries
          for dir in artifacts/breeze-agent-*; do
            if [ -d "$dir" ] && ls "$dir"/* >/dev/null 2>&1; then
              cp "$dir"/* release-assets/
            fi
          done

          # Copy backup binaries
          for dir in artifacts/breeze-backup-*; do
            if [ -d "$dir" ] && ls "$dir"/* >/dev/null 2>&1; then
              cp "$dir"/* release-assets/
            fi
          done

          # Copy desktop-helper binaries
          for dir in artifacts/breeze-desktop-helper-*; do
            if [ -d "$dir" ] && ls "$dir"/* >/dev/null 2>&1; then
              cp "$dir"/* release-assets/
            fi
          done

          # Copy watchdog binaries
          for dir in artifacts/breeze-watchdog-*; do
            if [ -d "$dir" ] && ls "$dir"/* >/dev/null 2>&1; then
              cp "$dir"/* release-assets/
            fi
          done

          # Copy viewer installers
          for dir in artifacts/breeze-viewer-*; do
            if [ -d "$dir" ] && ls "$dir"/* >/dev/null 2>&1; then
              cp "$dir"/* release-assets/
            fi
          done

          # Copy viewer update manifest
          if [ -d "artifacts/viewer-latest-json" ] && [ -f "artifacts/viewer-latest-json/latest.json" ]; then
            cp artifacts/viewer-latest-json/latest.json release-assets/latest.json
          fi

          # Copy helper installers
          for dir in artifacts/breeze-helper-*; do
            if [ -d "$dir" ] && ls "$dir"/* >/dev/null 2>&1; then
              cp "$dir"/* release-assets/
            fi
          done

          # Copy macOS installer app
          if [ -d "artifacts/breeze-installer-app" ] && ls "artifacts/breeze-installer-app/"* >/dev/null 2>&1; then
            cp "artifacts/breeze-installer-app/"* release-assets/
          fi

          # Create archives for API and Web
          if [ -d "artifacts/api-dist" ]; then
            tar -czvf release-assets/breeze-api.tar.gz -C artifacts/api-dist .
          fi

          if [ -d "artifacts/web-dist" ]; then
            tar -czvf release-assets/breeze-web.tar.gz -C artifacts/web-dist .
          fi

          # Generate checksums
          cd release-assets
          sha256sum * > checksums.txt

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: release-assets/*
          generate_release_notes: true
          draft: false
          prerelease: ${{ contains(github.ref_name, '-') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Sync agent versions to Breeze API
        if: ${{ !contains(github.ref_name, '-') && vars.BREEZE_API_URL != '' }}
        env:
          BREEZE_API_URL: ${{ vars.BREEZE_API_URL }}
          BREEZE_API_KEY: ${{ secrets.BREEZE_API_KEY }}
        run: |
          curl -sf -X POST "${BREEZE_API_URL}/api/v1/agent-versions/sync-github" \
            -H "Authorization: Bearer ${BREEZE_API_KEY}" \
            -H "Content-Type: application/json" \
            || echo "::warning::Agent version sync failed (non-fatal)"

  build-binaries-image:
    name: Build & Push Binaries Init Image
    runs-on: ubuntu-latest
    needs: [build-agent, build-windows-msi, build-macos-agent, sign-windows-tauri, build-viewer, build-helper, build-viewer-macos, build-helper-macos, create-release]
    if: >-
      !cancelled()
      && needs.build-agent.result == 'success'
      && (needs.build-windows-msi.result == 'success' || needs.build-windows-msi.result == 'skipped')
      && (needs.build-macos-agent.result == 'success' || needs.build-macos-agent.result == 'skipped')
      && (needs.sign-windows-tauri.result == 'success' || needs.sign-windows-tauri.result == 'skipped')
      && needs.build-viewer.result == 'success'
      && needs.build-helper.result == 'success'
      && (needs.build-viewer-macos.result == 'success' || needs.build-viewer-macos.result == 'skipped')
      && (needs.build-helper-macos.result == 'success' || needs.build-helper-macos.result == 'skipped')
      && (needs.create-release.result == 'success' || needs.create-release.result == 'skipped')
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Create staging directory
        run: mkdir -p staging/agent staging/viewer staging/helper

      - name: Download agent artifacts
        uses: actions/download-artifact@v8
        with:
          path: staging/agent
          pattern: 'breeze-agent-*'
          merge-multiple: true

      - name: Download viewer artifacts
        uses: actions/download-artifact@v8
        with:
          path: staging/viewer
          pattern: 'breeze-viewer-*'
          merge-multiple: true

      - name: Download helper artifacts
        uses: actions/download-artifact@v8
        with:
          path: staging/helper
          pattern: 'breeze-helper-*'
          merge-multiple: true

      - name: Write VERSION file
        env:
          REF_NAME: ${{ github.ref_name }}
        run: echo "${REF_NAME#v}" > staging/VERSION

      - name: List staging contents
        run: find staging -type f | sort

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/binaries
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }}
            type=sha

      - name: Build and push binaries image
        uses: docker/build-push-action@v7
        with:
          context: staging/
          file: docker/Dockerfile.binaries
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  build-docker-api:
    name: Build & Push API Docker Image
    runs-on: ubuntu-latest
    needs: [build-api, create-release]
    if: >-
      !cancelled()
      && needs.build-api.result == 'success'
      && (needs.create-release.result == 'success' || needs.create-release.result == 'skipped')
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Download API artifact
        uses: actions/download-artifact@v8
        with:
          name: api-dist
          path: apps/api/dist

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Get version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/api
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }}
            type=sha

      - name: Build and push API image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: apps/api/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            APP_VERSION=${{ steps.version.outputs.version }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  build-docker-web:
    name: Build & Push Web Docker Image
    runs-on: ubuntu-latest
    needs: [build-web, create-release]
    if: >-
      !cancelled()
      && needs.build-web.result == 'success'
      && (needs.create-release.result == 'success' || needs.create-release.result == 'skipped')
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Download Web artifact
        uses: actions/download-artifact@v8
        with:
          name: web-dist
          path: apps/web/dist

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to Container Registry
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Get version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/web
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }}
            type=sha

      - name: Build and push Web image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: apps/web/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            PUBLIC_APP_VERSION=${{ steps.version.outputs.version }}
          cache-from: type=gha
          cache-to: type=gha,mode=max