name: Release Tamagotchi

permissions:
  contents: write
  actions: read

env:
  BUNDLE_NAME: ''
  DEB_BUNDLE_NAME: ''
  RPM_BUNDLE_NAME: ''
  FLATPAK_BUNDLE_NAME: ''
  PRODUCT_NAME: 'AIRI'
  VERSION: ''

on:
  release:
    types:
      - prereleased
  workflow_dispatch:
    inputs:
      build_only:
        description: Build only
        required: false
        default: false
        type: boolean
      artifacts_only:
        description: Build and upload artifacts only
        required: false
        default: false
        type: boolean
      tag:
        description: Specific tag/commit for the release (leave empty to auto-detect latest tag)
        required: false
        type: string
      platform:
        description: Platform
        type: choice
        options:
          - all
          - windows
          - macos
          - linux
  schedule:
    - cron: '0 0 * * *'

jobs:
  build:
    name: Build
    continue-on-error: ${{ matrix.skip }} # WORKAROUND: Skipping subsequent steps without failing the whole workflow
    env:
      VITE_ENABLE_ANALYTICS: ${{ ((github.event_name == 'release') || (github.event_name == 'workflow_dispatch' && !inputs.build_only)) && 'true' || 'false' }}
    strategy:
      matrix:
        include:

          - os: macos-15-intel
            artifact: darwin-x64
            target: x86_64-apple-darwin
            arch: x64
            builder-args: --macos --x64
            skip: ${{ inputs.platform != '' && inputs.platform != 'all' && inputs.platform != 'macos' }}

          - os: macos-26
            artifact: darwin-arm64
            target: aarch64-apple-darwin
            builder-args: --macos --arm64
            arch: arm64
            skip: ${{ inputs.platform != '' && inputs.platform != 'all' && inputs.platform != 'macos' }}

          - os: ubuntu-latest
            artifact: linux-x64
            target: x86_64-unknown-linux-gnu
            builder-args: --linux --x64
            arch: x64
            skip: ${{ inputs.platform != '' && inputs.platform != 'all' && inputs.platform != 'linux' }}

          - os: ubuntu-24.04-arm
            artifact: linux-arm64
            target: aarch64-unknown-linux-gnu
            builder-args: --linux --arm64
            arch: arm64
            skip: ${{ inputs.platform != '' && inputs.platform != 'all' && inputs.platform != 'linux' }}

          - os: windows-latest
            artifact: windows-x64-setup
            target: x86_64-pc-windows-msvc
            builder-args: --windows --x64
            arch: x64
            skip: ${{ inputs.platform != '' && inputs.platform != 'all' && inputs.platform != 'windows' }}

    runs-on: ${{ matrix.os }}
    steps:
      - name: Skip the build (fail fast)
        run: |
          echo "Skipping build for ${{ matrix.os }}..."
          echo "This will fail the job, but don't panic—this is expected when not building for all."
          echo "This will be improved in the future."
          exit ${{ matrix.skip && '1' || '0' }}

      # Why?
      #
      # failed to build archive at `/home/runner/work/airi/airi/target/x86_64-unknown-linux-gnu/release/deps/libapp_lib.rlib`:
      # No space left on device (os error 28)
      - name: Free Disk Space
        if: matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm'
        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1

      - uses: actions/checkout@v6

      - name: macOS Select Xcode 26.2
        if: matrix.os == 'macos-15-intel' || matrix.os == 'macos-26'
        run: |
          sudo xcode-select -s /Applications/Xcode_26.2.app
          xcodebuild -version

      - name: macOS Show Toolchain
        if: matrix.os == 'macos-15-intel' || matrix.os == 'macos-26'
        run: |
          xcodebuild -version
          actool --version

      # NOTICE:
      # pnpm 11 does not ship a working standalone executable for Intel macOS.
      # Install pnpm through npm so it uses the Node.js runtime from setup-node.
      # https://github.com/pnpm/pnpm/issues/11423
      # Remove this branch when the project uses pnpm 12 or later.
      - uses: actions/setup-node@v6
        if: matrix.os == 'macos-15-intel'
        with:
          node-version: 26.7.0

      - name: Install pnpm with npm
        if: matrix.os == 'macos-15-intel'
        run: npm install --global pnpm@11.24.0

      - name: Get pnpm store path
        if: matrix.os == 'macos-15-intel'
        id: pnpm-store
        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"

      - name: Cache pnpm store
        if: matrix.os == 'macos-15-intel'
        uses: actions/cache@v5
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: ${{ runner.os }}-${{ runner.arch }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-pnpm-store-

      - uses: pnpm/setup@v2
        if: matrix.os != 'macos-15-intel'
        with:
          runtime: node@26.7.0
          cache: true
          install: false

      - name: Install macOS System Dependencies for node-canvas
        if: runner.os == 'macOS'
        run: |
          brew install pkg-config cairo pango jpeg giflib librsvg

      - run: pnpm install --frozen-lockfile

      # ---------
      # Build
      # ---------

      - run: pnpm run build:packages

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Setup Godot
        uses: chickensoft-games/setup-godot@v2
        with:
          version: '4.7.1'
          use-dotnet: true
          include-templates: true

      - name: Export Godot Stage (Windows)
        if: matrix.os == 'windows-latest'
        working-directory: ./engines/stage-tamagotchi-godot
        shell: bash
        run: |
          mkdir -p out/win
          godot --headless --export-release "Windows Desktop" out/win/godot-stage.exe

      - name: Export Godot Stage (macOS)
        if: matrix.os == 'macos-15-intel' || matrix.os == 'macos-26'
        working-directory: ./engines/stage-tamagotchi-godot
        shell: bash
        run: |
          mkdir -p out/mac
          godot --headless --export-release "macOS" out/mac/godot-stage.app

      - name: Export Godot Stage (Linux)
        if: matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm'
        working-directory: ./engines/stage-tamagotchi-godot
        shell: bash
        run: |
          mkdir -p out/linux
          godot --headless --export-release "Linux ${{ matrix.arch }}" out/linux/godot-stage

      - name: Build (Windows Only) # Windows
        if: matrix.os == 'windows-latest'
        run: pnpm run -F @proj-airi/stage-tamagotchi build && pnpm -F @proj-airi/stage-tamagotchi exec electron-builder build ${{ matrix.builder-args }} --publish=${{ (inputs.build_only || inputs.artifacts_only) && 'never' || 'onTagOrDraft' }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Build (macOS Only) # macOS
        if: matrix.os == 'macos-15-intel' || matrix.os == 'macos-26'
        run: |
          echo "$CSC_CONTENT" | base64 --decode > apps/stage-tamagotchi/apple-developer-code-signing.p12
          export CSC_LINK="./apple-developer-code-signing.p12"
          pnpm run -F @proj-airi/stage-tamagotchi build && pnpm -F @proj-airi/stage-tamagotchi exec electron-builder build ${{ matrix.builder-args }} --publish=${{ (inputs.build_only || inputs.artifacts_only) && 'never' || 'onTagOrDraft' }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CSC_CONTENT: ${{ secrets.CSC_CONTENT }}
          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_DEVELOPER_APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_DEVELOPER_APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_DEVELOPER_TEAM_ID }}

      - name: Build (Linux Only) # Linux
        if: matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm'
        run: pnpm run -F @proj-airi/stage-tamagotchi build && pnpm -F @proj-airi/stage-tamagotchi exec electron-builder build ${{ matrix.builder-args }} --publish=${{ (inputs.build_only || inputs.artifacts_only) && 'never' || 'onTagOrDraft' }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Flatpak (Linux Only)
        if: ${{ matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm' }}
        run: |
          sudo apt update
          sudo apt install -y flatpak flatpak-builder elfutils
          flatpak --version
          flatpak --user remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo

      - name: Build Flatpak (Linux Only) # Flatpak
        if: ${{ matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm' }}
        working-directory: ./apps/stage-tamagotchi
        run: |
          mkdir -p dist
          # Auto-install required SDK/Platform/BaseApp from Flathub in user scope
          flatpak-builder --user --install-deps-from=flathub ./flatpak ai.moeru.airi.flatpak.yml --force-clean
          flatpak build-export ./flatpak-repo ./flatpak
          export FLATPAK_OUTPUT_NAME=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-output-filename flatpak)
          flatpak build-bundle ./flatpak-repo dist/${FLATPAK_OUTPUT_NAME} ai.moeru.airi

      # ---------
      # Nightly (schedule) builds only
      # ---------

      - name: Get Artifacts Envs (Nightly + Windows Only)
        if: ${{ github.event_name == 'schedule' && matrix.os == 'windows-latest' }}
        working-directory: ./apps/stage-tamagotchi
        run: |
          echo "BUNDLE_NAME=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-bundle-name)" >> $env:GITHUB_ENV
          echo "VERSION=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-version)" >> $env:GITHUB_ENV

      - name: Get Artifacts Envs (Nightly + Non-Windows)
        if: ${{ github.event_name == 'schedule' && matrix.os != 'windows-latest' }}
        working-directory: ./apps/stage-tamagotchi
        run: |
          echo "VERSION=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-version)" >> $GITHUB_ENV

      - name: Get Artifacts Envs (Nightly + macOS Only)
        if: ${{ github.event_name == 'schedule' && (matrix.os == 'macos-26' || matrix.os == 'macos-15-intel') }}
        working-directory: ./apps/stage-tamagotchi
        run: |
          echo "BUNDLE_NAME=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-bundle-name)" >> $GITHUB_ENV

      - name: Rename Artifacts (Nightly)
        if: ${{ github.event_name == 'schedule' }}
        run:
          pnpm run -F @proj-airi/stage-tamagotchi rename-artifacts ${{ matrix.target }}

      - name: Get Linux Artifact Names (Nightly + Linux Only)
        if: ${{ github.event_name == 'schedule' && (matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm') }}
        working-directory: ./apps/stage-tamagotchi
        run: |
          echo "DEB_BUNDLE_NAME=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-filename deb)" >> $GITHUB_ENV
          echo "RPM_BUNDLE_NAME=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-filename rpm)" >> $GITHUB_ENV
          echo "FLATPAK_BUNDLE_NAME=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-filename flatpak)" >> $GITHUB_ENV

      - name: Upload Artifacts (Nightly + Non-Linux)
        if: ${{ github.event_name == 'schedule' && (matrix.os != 'ubuntu-latest' && matrix.os != 'ubuntu-24.04-arm') }}
        id: unsigned-artifacts-nightly
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.BUNDLE_NAME }}
          path: apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}

      - name: Upload Artifacts (Nightly + Linux deb)
        if: ${{ github.event_name == 'schedule' && (matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm') }}
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.DEB_BUNDLE_NAME }}
          path: apps/stage-tamagotchi/bundle/${{ env.DEB_BUNDLE_NAME }}

      - name: Upload Artifacts (Nightly + Linux rpm)
        if: ${{ github.event_name == 'schedule' && (matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm') }}
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.RPM_BUNDLE_NAME }}
          path: apps/stage-tamagotchi/bundle/${{ env.RPM_BUNDLE_NAME }}

      - name: Upload Flatpak Artifact (Nightly + Linux Only)
        if: ${{ github.event_name == 'schedule' && (matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm') }}
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.FLATPAK_BUNDLE_NAME }}
          path: apps/stage-tamagotchi/bundle/${{ env.FLATPAK_BUNDLE_NAME }}

      - name: Sign Windows Artifacts with SignPath (Nightly + Windows Only)
        id: signpath-nightly-windows
        continue-on-error: true
        uses: signpath/github-action-submit-signing-request@v2
        if: ${{ github.event_name == 'schedule' && (matrix.os == 'windows-latest' && github.repository == 'moeru-ai/airi') }}
        with:
          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
          organization-id: '${{ secrets.SIGNPATH_ORGANIZATION_ID }}'
          project-slug: 'airi'
          signing-policy-slug: 'test-signing'
          artifact-configuration-slug: ci-github-actions-artifacts-windows
          github-artifact-id: '${{ steps.unsigned-artifacts-nightly.outputs.artifact-id }}'
          wait-for-completion: true
          wait-for-completion-timeout-in-seconds: 900 # 15 minutes
          download-signed-artifact-timeout-in-seconds: 900 # 15 minutes
          output-artifact-directory: apps/stage-tamagotchi/bundle/signed/windows/

      - name: Warn When Windows Signing Fails (Nightly)
        if: ${{ github.event_name == 'schedule' && matrix.os == 'windows-latest' && steps.signpath-nightly-windows.outcome != 'success' }}
        run: |
          echo "::warning::SignPath Windows signing failed for nightly build. Continuing with unsigned artifact at apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}."

      - name: Upload Signed Artifacts (Nightly + Non-Linux)
        if: ${{ github.event_name == 'schedule' && matrix.os == 'windows-latest' && steps.signpath-nightly-windows.outcome == 'success' }}
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.BUNDLE_NAME }}
          path: apps/stage-tamagotchi/bundle/signed/windows/${{ env.BUNDLE_NAME }}
          overwrite: true

      - name: Upload Unsigned Windows Artifacts Fallback (Nightly)
        if: ${{ github.event_name == 'schedule' && matrix.os == 'windows-latest' && steps.signpath-nightly-windows.outcome != 'success' }}
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.BUNDLE_NAME }}
          path: apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}
          overwrite: true

      # NOTICE: Electron Builder generates latest-x64.yml during the build step, before this workflow
      # submits the Windows installer to SignPath. SignPath re-signs the .exe and changes its bytes,
      # which changes the updater hashes too. Regenerating latest-x64.yml from the signed installer keeps
      # the published Windows update metadata aligned with the final released artifact.
      - name: Regenerate Windows latest-x64.yml (Nightly + Windows Only)
        if: ${{ github.event_name == 'schedule' && matrix.os == 'windows-latest' && steps.signpath-nightly-windows.outcome == 'success' }}
        run: |
          pnpm -F @proj-airi/stage-tamagotchi run regenerate-windows-latest --input apps/stage-tamagotchi/bundle/signed/windows/${{ env.BUNDLE_NAME }} --output apps/stage-tamagotchi/bundle/latest-x64.yml --version ${{ env.VERSION }}

      - name: Regenerate Windows latest-x64.yml From Unsigned Artifact (Nightly Fallback)
        if: ${{ github.event_name == 'schedule' && matrix.os == 'windows-latest' && steps.signpath-nightly-windows.outcome != 'success' }}
        run: |
          pnpm -F @proj-airi/stage-tamagotchi run regenerate-windows-latest --input apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }} --output apps/stage-tamagotchi/bundle/latest-x64.yml --version ${{ env.VERSION }}

      # ---------
      # Workflow Dispatch only
      # ---------

      - name: Get Artifacts Envs (Manual + Windows Only)
        if: ${{ github.event_name == 'workflow_dispatch' && matrix.os == 'windows-latest' }}
        working-directory: ./apps/stage-tamagotchi
        run: |
          echo "BUNDLE_NAME=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-bundle-name --release ${{ !inputs.build_only && !inputs.artifacts_only }} --tag ${{ inputs.tag }} --auto-tag ${{ !inputs.build_only }})" >> $env:GITHUB_ENV
          echo "VERSION=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-version --release ${{ !inputs.build_only && !inputs.artifacts_only }} --tag ${{ inputs.tag }} --auto-tag ${{ !inputs.build_only }})" >> $env:GITHUB_ENV

      - name: Get Artifacts Envs (Manual + Non-Windows)
        if: ${{ github.event_name == 'workflow_dispatch' && matrix.os != 'windows-latest' }}
        working-directory: ./apps/stage-tamagotchi
        run: |
          echo "VERSION=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-version --release ${{ !inputs.build_only && !inputs.artifacts_only }} --tag ${{ inputs.tag }} --auto-tag ${{ !inputs.build_only }})" >> $GITHUB_ENV

      - name: Get Artifacts Envs (Manual + macOS Only)
        if: ${{ github.event_name == 'workflow_dispatch' && (matrix.os == 'macos-26' || matrix.os == 'macos-15-intel') }}
        working-directory: ./apps/stage-tamagotchi
        run: |
          echo "BUNDLE_NAME=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-bundle-name --release ${{ !inputs.build_only && !inputs.artifacts_only }} --tag ${{ inputs.tag }} --auto-tag ${{ !inputs.build_only }})" >> $GITHUB_ENV

      - name: Rename Artifacts (Manual)
        if: ${{ github.event_name == 'workflow_dispatch' }}
        run: |
          pnpm run -F @proj-airi/stage-tamagotchi rename-artifacts ${{ matrix.target }} --release ${{ !inputs.build_only && !inputs.artifacts_only }} --tag ${{ inputs.tag }} --auto-tag ${{ !inputs.build_only }}

      - name: Get Linux Artifact Names (Manual + Non-Release + Linux Only)
        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && inputs.artifacts_only && (matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm') }}
        working-directory: ./apps/stage-tamagotchi
        run: |
          echo "DEB_BUNDLE_NAME=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-filename deb --release ${{ !inputs.build_only && !inputs.artifacts_only }} --tag ${{ inputs.tag }} --auto-tag ${{ !inputs.build_only }})" >> $GITHUB_ENV
          echo "RPM_BUNDLE_NAME=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-filename rpm --release ${{ !inputs.build_only && !inputs.artifacts_only }} --tag ${{ inputs.tag }} --auto-tag ${{ !inputs.build_only }})" >> $GITHUB_ENV
          echo "FLATPAK_BUNDLE_NAME=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-filename flatpak --release ${{ !inputs.build_only && !inputs.artifacts_only }} --tag ${{ inputs.tag }} --auto-tag ${{ !inputs.build_only }})" >> $GITHUB_ENV

      - name: Upload Artifacts (Manual + Non-Release + Non-Linux)
        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && inputs.artifacts_only && (matrix.os != 'ubuntu-latest' && matrix.os != 'ubuntu-24.04-arm') }}
        id: unsigned-artifacts-workflow-dispatch
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.BUNDLE_NAME }}
          path: apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}

      - name: Upload Artifacts (Manual + Non-Release + Linux deb)
        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && inputs.artifacts_only && (matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm') }}
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.DEB_BUNDLE_NAME }}
          path: apps/stage-tamagotchi/bundle/${{ env.DEB_BUNDLE_NAME }}

      - name: Upload Artifacts (Manual + Non-Release + Linux rpm)
        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && inputs.artifacts_only && (matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm') }}
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.RPM_BUNDLE_NAME }}
          path: apps/stage-tamagotchi/bundle/${{ env.RPM_BUNDLE_NAME }}

      - name: Upload Flatpak Artifact (Manual + Non-Release + Linux)
        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && inputs.artifacts_only && (matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm') }}
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.FLATPAK_BUNDLE_NAME }}
          path: apps/stage-tamagotchi/bundle/${{ env.FLATPAK_BUNDLE_NAME }}

      - name: Sign Windows Artifacts with SignPath (Manual + Windows Only)
        id: signpath-manual-windows
        continue-on-error: true
        uses: signpath/github-action-submit-signing-request@v2
        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && inputs.artifacts_only && (matrix.os == 'windows-latest' && github.repository == 'moeru-ai/airi') }}
        with:
          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
          organization-id: '${{ secrets.SIGNPATH_ORGANIZATION_ID }}'
          project-slug: 'airi'
          signing-policy-slug: 'test-signing'
          artifact-configuration-slug: ci-github-actions-artifacts-windows
          github-artifact-id: '${{ steps.unsigned-artifacts-workflow-dispatch.outputs.artifact-id }}'
          wait-for-completion: true
          wait-for-completion-timeout-in-seconds: 900 # 15 minutes
          download-signed-artifact-timeout-in-seconds: 900 # 15 minutes
          output-artifact-directory: apps/stage-tamagotchi/bundle/signed/windows/

      - name: Warn When Windows Signing Fails (Manual)
        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && inputs.artifacts_only && matrix.os == 'windows-latest' && steps.signpath-manual-windows.outcome != 'success' }}
        run: |
          echo "::warning::SignPath Windows signing failed for workflow_dispatch artifact build. Continuing with unsigned artifact at apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}."

      - name: Move Signed Artifacts (Manual + Release + Windows Only)
        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && inputs.artifacts_only && matrix.os == 'windows-latest' && steps.signpath-manual-windows.outcome == 'success' }}
        run: |
          Move-Item -Force apps/stage-tamagotchi/bundle/signed/windows/${{ env.BUNDLE_NAME }} apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}

      - name: Upload Signed Artifacts (Manual + Windows Only)
        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && inputs.artifacts_only && (matrix.os == 'windows-latest') }}
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.BUNDLE_NAME }}
          path: apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}
          overwrite: true

      # NOTICE: Electron Builder already wrote latest-x64.yml before SignPath signed the installer.
      # After the signed .exe replaces the unsigned one, we must rebuild latest-x64.yml so its hashes
      # describe the final Windows artifact that users will actually download.
      - name: Regenerate Windows latest-x64.yml (Manual + Windows Only)
        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && inputs.artifacts_only && matrix.os == 'windows-latest' }}
        run: |
          pnpm -F @proj-airi/stage-tamagotchi run regenerate-windows-latest --input apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }} --output apps/stage-tamagotchi/bundle/latest-x64.yml --version ${{ env.VERSION }}

      - name: Upload To GitHub Releases (Manual + Release + Overwrite Release)
        if: ${{ github.event_name == 'workflow_dispatch' && !inputs.build_only && !inputs.artifacts_only }}
        uses: softprops/action-gh-release@v2
        with:
          files: |
            apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}-*.exe
            apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}-*.zip
            apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}-*.dmg
            apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}-*.deb
            apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}-*.rpm
            apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}-*.flatpak
            apps/stage-tamagotchi/bundle/latest-*.yml
          append_body: true
          tag_name: ${{ inputs.tag }}

      # ---------
      # Version push
      # ---------

      - name: Rename Artifacts (Automatic)
        if: ${{ github.event_name == 'release' }}
        run: |
          pnpm run -F @proj-airi/stage-tamagotchi rename-artifacts ${{ matrix.target }} --release --auto-tag

      - name: Get Artifacts Envs (Automatic + Windows Only)
        if: ${{ github.event_name == 'release' && matrix.os == 'windows-latest' }}
        working-directory: ./apps/stage-tamagotchi
        run: |
          echo "BUNDLE_NAME=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-bundle-name --release ${{ !inputs.build_only && !inputs.artifacts_only }} --tag ${{ inputs.tag }} --auto-tag ${{ !inputs.build_only }})" >> $env:GITHUB_ENV
          echo "VERSION=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-version --release ${{ !inputs.build_only && !inputs.artifacts_only }} --tag ${{ inputs.tag }} --auto-tag ${{ !inputs.build_only }})" >> $env:GITHUB_ENV

      - name: Get Artifacts Envs (Automatic + Non-Windows)
        if: ${{ github.event_name == 'release' && matrix.os != 'windows-latest' }}
        working-directory: ./apps/stage-tamagotchi
        run: |
          echo "BUNDLE_NAME=$(pnpm exec tsx scripts/artifacts-metadata.ts ${{ matrix.target }} --get-bundle-name --release --auto-tag)" >> $GITHUB_ENV

      - name: Upload Artifacts (Automatic + Windows Only)
        if: ${{ github.event_name == 'release' && matrix.os == 'windows-latest' }}
        id: unsigned-artifacts-release
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.BUNDLE_NAME }}
          path: apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}

      - name: Sign Windows Artifacts with SignPath (Nightly + Windows Only)
        id: signpath-release-windows
        continue-on-error: true
        uses: signpath/github-action-submit-signing-request@v2
        if: ${{ github.event_name == 'release' && (matrix.os == 'windows-latest' && github.repository == 'moeru-ai/airi') }}
        with:
          api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
          organization-id: '${{ secrets.SIGNPATH_ORGANIZATION_ID }}'
          project-slug: 'airi'
          signing-policy-slug: 'test-signing'
          artifact-configuration-slug: ci-github-actions-artifacts-windows
          github-artifact-id: '${{ steps.unsigned-artifacts-release.outputs.artifact-id }}'
          wait-for-completion: true
          wait-for-completion-timeout-in-seconds: 900 # 15 minutes
          download-signed-artifact-timeout-in-seconds: 900 # 15 minutes
          output-artifact-directory: apps/stage-tamagotchi/bundle/signed/windows/

      - name: Warn When Windows Signing Fails (Release)
        if: ${{ github.event_name == 'release' && matrix.os == 'windows-latest' && steps.signpath-release-windows.outcome != 'success' }}
        run: |
          echo "::warning::SignPath Windows signing failed for release build. Continuing with unsigned artifact at apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}."

      - name: Move Signed Artifacts (Automatic + Windows Only)
        if: ${{ github.event_name == 'release' && matrix.os == 'windows-latest' && steps.signpath-release-windows.outcome == 'success' }}
        run: |
          Move-Item -Force apps/stage-tamagotchi/bundle/signed/windows/${{ env.BUNDLE_NAME }} apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}

      # NOTICE: The root cause here is the build/signing order: latest-x64.yml is produced by Electron
      # Builder before SignPath re-signs the installer. That post-build signing step mutates the .exe,
      # so the updater metadata becomes stale. Recomputing latest-x64.yml after the signed file is moved
      # into its final bundle path makes the release upload self-consistent again.
      - name: Regenerate Windows latest manifest (Automatic + Windows Only)
        if: ${{ github.event_name == 'release' && matrix.os == 'windows-latest' }}
        run: |
          pnpm -F @proj-airi/stage-tamagotchi run regenerate-windows-latest --input apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }} --output apps/stage-tamagotchi/bundle/latest-x64.yml --version ${{ env.VERSION }}

      - name: Upload Distribution Artifact (Automatic + macOS arm64 Only)
        if: ${{ github.event_name == 'release' && matrix.os == 'macos-26' }}
        uses: actions/upload-artifact@v7
        with:
          name: distribution-osx
          path: apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}

      - name: Upload Distribution Artifact (Automatic + Windows Only)
        if: ${{ github.event_name == 'release' && matrix.os == 'windows-latest' }}
        uses: actions/upload-artifact@v7
        with:
          name: distribution-win
          path: apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}

      - name: Upload Distribution Artifact (Automatic + Linux x64 Only)
        if: ${{ github.event_name == 'release' && matrix.os == 'ubuntu-latest' }}
        uses: actions/upload-artifact@v7
        with:
          name: distribution-linux-x64
          path: apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}

      - name: Upload Distribution Artifact (Automatic + Linux arm64 Only)
        if: ${{ github.event_name == 'release' && matrix.os == 'ubuntu-24.04-arm' }}
        uses: actions/upload-artifact@v7
        with:
          name: distribution-linux-arm64
          path: apps/stage-tamagotchi/bundle/${{ env.BUNDLE_NAME }}

      - name: Upload To GitHub Releases (Automatic)
        if: ${{ github.event_name == 'release' }}
        uses: softprops/action-gh-release@v2
        with:
          # Possible auto updater files:
          # Windows: latest-x64.yml
          # macOS: latest-arm64-mac.yml, latest-x64-mac.yml
          # Linux: latest-arm64-linux.yml (arm64), latest-x64-linux.yml (x64)
          files: |
            apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}-*.exe
            apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}-*.zip
            apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}-*.dmg
            apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}-*.deb
            apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}-*.rpm
            apps/stage-tamagotchi/bundle/${{ env.PRODUCT_NAME }}-*.flatpak
            apps/stage-tamagotchi/bundle/latest-*.yml
          append_body: true

  publish-gitcode-release:
    name: Publish GitCode Release Mirror
    needs: build
    if: ${{ always() && github.repository == 'moeru-ai/airi' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && !inputs.build_only && !inputs.artifacts_only && inputs.tag != '')) }}
    continue-on-error: true
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Validate release mirror tools
        run: |
          gh --version
          jq --version
          curl --version

      - name: Publish release assets to GitCode
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITCODE_TOKEN: ${{ secrets.GITCODE_TOKEN }}
          GITCODE_OWNER: ${{ secrets.GITCODE_OWNER }}
          GITCODE_REPO: ${{ secrets.GITCODE_REPO }}
          GITCODE_RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }}
        run: bash .github/scripts/publish-gitcode-release.sh

  publish-distribution:
    name: Publish Distribution
    needs: build
    if: ${{ github.event_name == 'release' }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - artifact_name: distribution-osx
            platform: osx
          - artifact_name: distribution-win
            platform: win
          - artifact_name: distribution-linux-x64
            platform: linux
          - artifact_name: distribution-linux-arm64
            platform: linux
    steps:
      - name: Resolve release version
        run: |
          echo "VERSION=${GITHUB_REF_NAME#v}" >> $GITHUB_ENV

      - name: Download distribution artifact
        uses: actions/download-artifact@v5
        with:
          name: ${{ matrix.artifact_name }}
          path: dist/${{ matrix.artifact_name }}

      - name: Resolve artifact path
        run: |
          echo "ARTIFACT_PATH=$(find dist/${{ matrix.artifact_name }} -maxdepth 1 -mindepth 1 | head -n 1)" >> $GITHUB_ENV

      - name: Setup butler
        uses: remarkablegames/setup-butler@v2

      # https://itch.io/docs/butler/pushing.html
      - name: Publish distribution artifact to itch.io
        run: butler push "${{ env.ARTIFACT_PATH }}" nekomeowww/airi:${{ matrix.platform }} --userversion "${{ env.VERSION }}"
        env:
          BUTLER_API_KEY: ${{ secrets.GAME_PUBLISHING_ITCHIO }}