name: Publish Linux Packages

on:
  workflow_dispatch:
    inputs:
      version:
        description: Optional package version override, for example 1.3.0
        required: false
        type: string
  push:
    tags:
      - "v*"

permissions:
  contents: write

concurrency:
  group: publish-linux-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build:
    name: Build Linux ${{ matrix.arch }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            runner: ubuntu-24.04
          - arch: arm64
            runner: ubuntu-24.04-arm

    runs-on: ${{ matrix.runner }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install Linux build dependencies
        run: |
          set -euo pipefail
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            build-essential \
            ca-certificates \
            curl \
            dpkg-dev \
            git \
            libayatana-appindicator3-dev \
            libgtk-3-dev \
            libwebkit2gtk-4.1-dev \
            patchelf \
            pkg-config \
            python3 \
            tar

      - name: Install Wails CLI
        run: go install github.com/wailsapp/wails/v2/cmd/wails@v2.12.0

      - name: Add Go bin to PATH
        run: echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"

      - name: Verify runtime files
        run: bash tools/runtime/verify-runtime.sh linux-${{ matrix.arch }}

      - name: Build Linux packages
        env:
          VERSION: ${{ inputs.version }}
          BROWSERSLIST_IGNORE_OLD_DATA: "1"
        run: |
          set -euo pipefail
          args=(--arch "${{ matrix.arch }}")
          if [[ -n "${VERSION:-}" ]]; then
            args+=(--version "$VERSION")
          fi
          bash publish/linux/publish-linux.sh "${args[@]}"

      - name: Validate deb package metadata
        run: |
          set -euo pipefail
          deb_file="$(ls -1 publish/output/*_${{ matrix.arch }}.deb | head -n 1)"
          echo "Validating: $deb_file"
          dpkg-deb -I "$deb_file"
          dpkg-deb -c "$deb_file" >/dev/null

      - name: Validate tar package layout
        run: |
          set -euo pipefail
          tar_file="$(ls -1 publish/output/AntBrowser-*-linux-${{ matrix.arch }}.tar.gz | head -n 1)"
          validate_dir="$(mktemp -d)"
          echo "Validating: $tar_file"
          tar -xzf "$tar_file" -C "$validate_dir"
          test -x "$validate_dir/ant-chrome"
          test -x "$validate_dir/bin/xray"
          test -x "$validate_dir/bin/sing-box"
          test -f "$validate_dir/config.yaml"

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ant-browser-linux-${{ matrix.arch }}
          path: |
            publish/output/*_${{ matrix.arch }}.deb
            publish/output/*-linux-${{ matrix.arch }}.tar.gz
          if-no-files-found: error

  release:
    name: Publish GitHub Release
    if: startsWith(github.ref, 'refs/tags/v')
    needs: build
    runs-on: ubuntu-24.04

    steps:
      - name: Download Linux artifacts
        uses: actions/download-artifact@v4
        with:
          path: release-artifacts
          merge-multiple: true

      - name: Upload release assets
        env:
          GH_TOKEN: ${{ github.token }}
          TAG_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          gh release view "$TAG_NAME" >/dev/null 2>&1 || gh release create "$TAG_NAME" --generate-notes
          gh release upload "$TAG_NAME" release-artifacts/* --clobber