release.yml

name: Release Electron App

# 由 semantic-release 创建的 v* tag 触发：构建 Electron 安装包并附加到对应 Release
on:
  push:
    tags: ['v*']
  # 兜底触发：semantic-release 若以内置 GITHUB_TOKEN 推 tag，
  # GitHub 防递归机制不会派发 push 事件，导致本工作流从不运行、
  # Release 资产为空（latest.yml 404）。Release 发布事件可正常触发补跑。
  release:
    types: [published]
  # 手动兜底：在 UI 选择对应 tag 运行，用于补发历史版本资产
  workflow_dispatch:

# 上传构建产物到 GitHub Release 需要写权限
permissions:
  contents: write

# 同一 tag 的多个触发源（push/release）串行执行，避免重复上传竞争
concurrency:
  group: release-electron-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  lint-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'
          cache-dependency-path: client/package-lock.json
      - run: cd client && npm ci
      - run: cd client && npm run lint
      - run: cd client && npm run test -- --run

  build:
    needs: lint-test
    # 本产品为 Windows-only（electron-builder.yml 仅定义 win target）。
    # macOS 无有效构建目标必然报 ERR_ELECTRON_BUILDER_CANNOT_EXECUTE，
    # 且默认 fail-fast 会连带取消 Windows 构建，导致 release/同步步骤永不执行。
    # 如未来支持 mac，需补回带签名的 mac target 后再加入 matrix。
    strategy:
      matrix:
        os: [windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      # lfs: true 必需：app-icon.png 等 PNG 由 Git LFS 托管（.gitattributes:
      # *.png filter=lfs），不拉取则仅为 131 字节指针文件，
      # electron-builder 图标转换（PNG→ICO）解码失败，
      # 报 ERR_ELECTRON_BUILDER_CANNOT_EXECUTE。
      - uses: actions/checkout@v4
        with:
          lfs: true
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'
          cache-dependency-path: client/package-lock.json
      - run: cd client && npm ci
      # --publish never：发布由下方 release job 统一负责，避免 electron-builder
      # 因检测到 tag 而自行尝试发布（github provider 无 GH_TOKEN 会报错）
      - run: cd client && npm run electron:build -- --publish never
      - uses: actions/upload-artifact@v4
        with:
          name: release-${{ matrix.os }}
          # latest*.yml 与 *.blockmap 是 electron-updater 自动更新的必需文件
          path: |
            client/release/*.exe
            client/release/*.blockmap
            client/release/latest*.yml

  release:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v4
        with:
          pattern: release-*
      - uses: softprops/action-gh-release@v2
        with:
          files: release-*/*

      # ---------------------------------------------------------------
      # 同步 Windows 安装包至自建服务器（国内主下载源 + 自动更新源）
      # latest.json 供官网下载页动态展示版本/直链；latest.yml 供 electron-updater
      # ---------------------------------------------------------------
      - name: Generate latest.json for website
        run: |
          YML=release-windows-latest/latest.yml
          VERSION=$(grep -m1 '^version:' "$YML" | awk '{print $2}')
          FILE=$(grep -m1 '^path:' "$YML" | sed 's/^path: //')
          SIZE=$(stat -c%s "release-windows-latest/$FILE")
          SHA256=$(sha256sum "release-windows-latest/$FILE" | awk '{print $1}')
          DATE=$(date -u +%F)
          printf '{"version":"%s","fileName":"%s","size":%s,"sha256":"%s","releaseDate":"%s"}\n' \
            "$VERSION" "$FILE" "$SIZE" "$SHA256" "$DATE" > release-windows-latest/latest.json
          cat release-windows-latest/latest.json

      - name: Ensure downloads directory on server
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: mkdir -p /opt/Entropydecrease/downloads

      # 先传二进制（exe/blockmap），后传元数据（yml/json）：
      # 避免 latest.yml 率先就位时指向尚未上传完成的安装包（更新 404 窗口期）
      - name: Upload installer binaries to server
        uses: appleboy/scp-action@v0.1.7
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          source: release-windows-latest/*.exe,release-windows-latest/*.blockmap
          target: /opt/Entropydecrease/downloads
          strip_components: 1

      - name: Publish update metadata (last, avoids 404 window)
        uses: appleboy/scp-action@v0.1.7
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          source: release-windows-latest/latest.yml,release-windows-latest/latest.json
          target: /opt/Entropydecrease/downloads
          strip_components: 1

      # 保留策略：仅保留最近 3 个版本的安装包，防止磁盘增长
      - name: Prune old versions (keep last 3)
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            cd /opt/Entropydecrease/downloads
            ls -t -- *.exe 2>/dev/null | tail -n +4 | while read -r f; do
              rm -f -- "$f" "$f.blockmap"
            done