name: Build Tauri App (Linux + Windows exe)

on:
  push:
    branches: [ main ]
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Install Rust
        uses: actions-rs/toolchain@v1
        with:
          toolchain: stable
          profile: minimal
          override: true

      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            mingw-w64 \
            libssl-dev \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            webkit2gtk-4.1 \
            build-essential \
            curl \
            pkg-config \
            xdg-utils \
            gnupg2

      - name: Add Windows Rust target
        run: rustup target add x86_64-pc-windows-gnu

      - name: Install Tauri CLI
        run: cargo install tauri-cli

      - name: Build Linux packages (deb + rpm)
        run: |
          cd src-tauri
          cargo tauri build

      - name: Build Windows exe
        run: |
          cd src-tauri
          cargo build --release --target x86_64-pc-windows-gnu

      - name: Make Linux ELF executable
        run: chmod +x src-tauri/target/release/bytechat-desktop

      # 🔑 Import your private GPG key
      - name: Import GPG key
        run: |
          echo "$GPG_PRIVATE_KEY" | gpg --batch --import
          echo "$GPG_KEY_ID:6:" | gpg --import-ownertrust
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
          GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}

      # 🐧 Sign Linux binaries (.deb, .rpm, ELF)
      - name: Sign Linux artifacts
        run: |
          for f in src-tauri/target/release/bytechat-desktop \
                   src-tauri/target/release/bundle/deb/*.deb \
                   src-tauri/target/release/bundle/rpm/*.rpm; do
            echo "$GPG_PASSPHRASE" | gpg --batch --yes --passphrase-fd 0 \
              --pinentry-mode loopback --detach-sign -a "$f"
          done
        env:
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

      # 🪟 Sign Windows exe with GPG
      - name: Sign Windows exe
        run: |
          exe=src-tauri/target/x86_64-pc-windows-gnu/release/bytechat-desktop.exe
          echo "$GPG_PASSPHRASE" | gpg --batch --yes --passphrase-fd 0 \
            --pinentry-mode loopback --detach-sign -a "$exe"
        env:
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

      # 📦 Upload Linux artifacts + signatures + public key
      - name: Upload Linux packages
        uses: actions/upload-artifact@v3
        with:
          name: tauri-linux
          path: |
            src-tauri/target/release/bytechat-desktop
            src-tauri/target/release/bytechat-desktop.asc
            src-tauri/target/release/bundle/deb/*.deb
            src-tauri/target/release/bundle/deb/*.asc
            src-tauri/target/release/bundle/rpm/*.rpm
            src-tauri/target/release/bundle/rpm/*.asc
            key/bytechat-public.gpg

      # 📦 Upload Windows exe + signature
      - name: Upload Windows exe
        uses: actions/upload-artifact@v3
        with:
          name: tauri-windows-exe
          path: |
            src-tauri/target/x86_64-pc-windows-gnu/release/bytechat-desktop.exe
            src-tauri/target/x86_64-pc-windows-gnu/release/bytechat-desktop.exe.asc