ci.yml

name: CI

on:
  # Branch pushes are already validated by pull_request; avoid building the same commit twice.
  push:
    branches: ["main"]
  pull_request:
  workflow_dispatch:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  glib-security:
    name: GLib memory-safety regressions
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install GLib headers
        run: sudo apt-get update && sudo apt-get install -y libglib2.0-dev pkg-config
      - name: Exercise upstream iterators under optimization
        run: cargo test --manifest-path vendor/glib/Cargo.toml --release --locked --lib

  check:
    name: Check (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, windows-latest, macos-latest]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Linux system libraries
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev libasound2-dev libdbus-1-dev \
            libssl-dev libayatana-appindicator3-dev librsvg2-dev libsoup-3.0-dev ffmpeg

      - name: ffmpeg (test fixtures)
        if: runner.os == 'macOS'
        run: brew install ffmpeg

      - name: ffmpeg (test fixtures)
        if: runner.os == 'Windows'
        shell: pwsh
        run: scripts/ensure-ffmpeg.ps1

      - name: Clippy
        run: cargo clippy --workspace --all-targets --locked -- -D warnings

      - name: Tests
        run: cargo test --workspace --locked

      - name: Release manifest tests
        if: runner.os == 'Linux'
        run: python3 -m unittest discover -s scripts -p test_prepare_release.py

      - name: Install script
        if: runner.os == 'Linux'
        working-directory: .
        run: bash tests/install-test.sh

  native:
    name: Rust native core
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Test
        run: cargo test --release --locked --manifest-path native/Cargo.toml

  ui:
    name: UI tests
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install
        working-directory: ui-tests
        run: |
          npm install --no-audit --no-fund
          npx playwright install --with-deps chromium
      - name: Test
        working-directory: ui-tests
        run: npm test

  bundle:
    name: Bundle (${{ matrix.name }})
    needs: [check, ui]
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { name: Linux, os: ubuntu-24.04, bundles: "deb appimage", target: "" }
          - { name: Windows, os: windows-latest, bundles: "nsis", target: "" }
          - { name: macOS, os: macos-latest, bundles: "dmg", target: "universal-apple-darwin" }
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Linux system libraries
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev libasound2-dev libdbus-1-dev \
            libssl-dev libayatana-appindicator3-dev librsvg2-dev libsoup-3.0-dev

      - name: macOS targets
        if: runner.os == 'macOS'
        run: rustup target add aarch64-apple-darwin x86_64-apple-darwin

      # The bundler downloads NSIS (Windows) and the AppImage tools (Linux) from GitHub releases on every
      # build; keep them so a GitHub download outage (504) does not fail an otherwise good build.
      - name: Cache the Tauri bundler tools
        if: runner.os != 'macOS'
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.cache/tauri
            ~/AppData/Local/tauri
          key: tauri-bundler-tools-${{ runner.os }}-v2

      - name: Build
        shell: bash
        working-directory: src-tauri
        # В пакет npm входит готовый CLI: никакого десятиминутного `cargo install`.
        run: npx --yes @tauri-apps/cli@2 build --bundles ${{ matrix.bundles }} ${{ matrix.target && format('--target {0}', matrix.target) || '' }}

      # Окно входа VK должно загружаться в каждой системе, начиная с реальной сборки.
      - name: Sign-in window loads (Linux, macOS)
        if: runner.os != 'Windows'
        shell: bash
        run: |
          binary=$(find target -path '*release/bundle/macos/*.app/Contents/MacOS/private-music-desktop' -print -quit)
          [ -n "$binary" ] || binary=target/${{ matrix.target }}/release/private-music-desktop
          scripts/smoke-login.sh "$binary"

      - name: Sign-in window loads (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $report = Join-Path $env:RUNNER_TEMP 'smoke.txt'
          $env:PM_SMOKE_LOGIN = $report
          $app = Start-Process -FilePath 'target\release\private-music-desktop.exe' -PassThru
          if (-not $app.WaitForExit(150000)) { $app.Kill(); Write-Host 'the app did not finish in time' }
          Write-Host "app exited with $($app.ExitCode)"
          if (Test-Path $report) { Get-Content $report } else { Write-Host '(no report)' }
          $log = Join-Path $env:LOCALAPPDATA 'com.dec.privatemusic2.desktop\logs\private-music.log'
          if (Test-Path $log) { Write-Host "--- $log"; Get-Content $log }
          if (-not ((Test-Path $report) -and (Select-String -Path $report -Pattern '^loaded ' -Quiet))) { exit 1 }

      - name: Fixed window presets and fullscreen (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: scripts\smoke-window.ps1 -Binary 'target\release\private-music-desktop.exe'

      # Обновление устанавливается поверх старой версии и должно сохранить данные для входа и данные.
      - name: Installing over the last release keeps the sign-in (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          $new = (Get-ChildItem 'target\release\bundle\nsis\*-setup.exe' | Select-Object -First 1).FullName
          gh release download --repo '${{ github.repository }}' --pattern '*-setup.exe' --dir "$env:RUNNER_TEMP\previous"
          $previous = Get-ChildItem "$env:RUNNER_TEMP\previous\*-setup.exe" -ErrorAction SilentlyContinue | Select-Object -First 1
          if ($previous) { $old = $previous.FullName } else {
            Write-Host '::notice::No earlier release exists: installing the new build over itself instead.'
            $old = $new
          }
          scripts\upgrade-check.ps1 -Old $old -New $new

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: private-music-desktop-${{ matrix.name }}
          path: |
            target/**/release/bundle/**/*-setup.exe
            target/**/release/bundle/**/*.dmg
            target/**/release/bundle/**/*.deb
            target/**/release/bundle/**/*.AppImage
          if-no-files-found: error