name: Release Desktop

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          # Fork: só as plataformas que o grupo usa. Windows arm64 saiu porque
          # dobrava o job mais lento (duas distribuições do Electron, módulos
          # nativos compilados duas vezes) e ninguém roda Windows em ARM.
          # Linux arm64 saiu pelo mesmo motivo. Com o arm64 fora, o passo que
          # instalava o fpm nativo perdeu a razão de existir: ele só era
          # necessário porque o fpm embutido no electron-builder é x86_64 e
          # falhava no runner arm64.
          # macOS removido neste fork: ninguém do grupo usa, e o runner macOS
          # é cobrado a 10x num repositório privado — era a plataforma mais cara
          # da matriz, compilada em toda tag para zero usuários.
          # Windows — x64 + arm64 on x64 runner.
          # Pinned to windows-2022 (VS 2022 / v17): the windows-latest image
          # ships VS "18", which the node-gyp bundled with electron-rebuild
          # cannot detect ("unknown version undefined") when compiling
          # uiohook-napi in postinstall.
          - os: windows-2022
            args: --win --x64
          # Linux — x64 on x64 runner
          - os: ubuntu-latest
            args: --linux --x64

    runs-on: ${{ matrix.os }}

    steps:
      - name: Harden the runner
        if: runner.os == 'Linux'
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

      - name: Install Linux build dependencies
        if: runner.os == 'Linux'
        # Full X11 dev header set required to compile libuiohook (uiohook-napi)
        # from source in postinstall. Derived from the headers its sources
        # include: Xlib/XKB (libx11-dev), XTest+record (libxtst-dev), Intrinsic
        # (libxt-dev), Xrandr (libxrandr-dev), Xinerama (libxinerama-dev),
        # Xlib-xcb (libx11-xcb-dev), XKBrules (libxkbfile-dev), xkbcommon
        # (libxkbcommon-dev, libxkbcommon-x11-dev). Missing libxrandr-dev was
        # the original build failure (Xrandr.h: No such file or directory).
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libx11-dev libxtst-dev libxt-dev \
            libxkbcommon-dev libxkbcommon-x11-dev libxkbfile-dev \
            libxrandr-dev libxinerama-dev libx11-xcb-dev

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
        with:
          version: 10.34.3

      - name: Setup Node.js
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
        with:
          node-version: 20
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build shared package
        run: pnpm --filter @backspace/shared build

      - name: Compile desktop TypeScript
        working-directory: packages/desktop
        run: pnpm exec tsc

      - name: Build and publish desktop app
        working-directory: packages/desktop
        run: pnpm exec electron-builder ${{ matrix.args }} --publish always
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_IDENTITY_AUTO_DISCOVERY: "false"