wiicompiled/.github/workflows/package.yml

name: Package installers

# Builds the per-platform installer/setup tool (WiiCompiled-Setup.exe /
# WiiCompiled-Setup-x86_64.AppImage / WiiCompiled-Setup.pkg) via the platform packaging scripts -
# the same scripts a maintainer runs by hand today to
# produce a GitHub Release asset. This does NOT build the actual translated game executable:
# that step requires the end user's own Mario Kart Wii dump (Assets/main.dol, Assets/StaticR.rel),
# which is proprietary and not present in this repository or in CI.
on:
  push:
    tags:
      - '*'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: package-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  recompilation:
    name: Recompilation test
    uses: ./.github/workflows/recomp-test.yml

  linux-appimage:
    name: Linux (AppImage, ${{ matrix.arch }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-22.04
            arch: x86_64
          - runner: ubuntu-22.04-arm
            arch: aarch64
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: actions/setup-dotnet@v6
        with:
          dotnet-version: '8.0.x'

      # appimagetool ships as an AppImage itself and needs to self-mount via FUSE to run directly;
      # GitHub's ubuntu-latest runners don't have libfuse2 preinstalled.
      - name: Install dependencies (required by appimagetool and SDL3 build)
        run: |
          sudo apt-get update
          sudo apt-get install -y libfuse2 build-essential git make \
            pkg-config cmake ninja-build gnome-desktop-testing libasound2-dev libpulse-dev \
            libaudio-dev libfribidi-dev libjack-dev libsndio-dev libx11-dev libxext-dev \
            libxrandr-dev libxcursor-dev libxfixes-dev libxi-dev libxss-dev libxtst-dev \
            libxkbcommon-dev libdrm-dev libgbm-dev libgl1-mesa-dev libgles2-mesa-dev \
            libegl1-mesa-dev libdbus-1-dev libibus-1.0-dev libudev-dev libthai-dev libusb-1.0-0-dev \
            libpipewire-0.3-dev libwayland-dev libdecor-0-dev liburing-dev

      - name: Build AppImage
        run: bash Launcher/build-appimage.sh

      - uses: actions/upload-artifact@v7
        with:
          name: WiiCompiled-Setup-linux-${{ matrix.arch }}
          path: Launcher/dist/WiiCompiled-Setup-${{ matrix.arch }}.AppImage
          if-no-files-found: error
          archive: false

  windows-installer:
    name: Windows (installer exe)
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: actions/setup-dotnet@v6
        with:
          dotnet-version: '8.0.x'

      - name: Build installer
        shell: pwsh
        run: ./Launcher/Build-Installer.ps1

      - uses: actions/upload-artifact@v7
        with:
          name: WiiCompiled-Setup-windows-x64
          path: Launcher/dist/WiiCompiled-Setup.exe
          if-no-files-found: error
          archive: false

  macos-setup-package:
    name: macOS (universal Setup.pkg)
    runs-on: macos-14
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: actions/setup-dotnet@v6
        with:
          dotnet-version: '8.0.x'

      - name: Verify Apple Silicon runner
        shell: bash
        run: |
          test "$(uname -m)" = arm64
          xcode-select -p

      - name: Download pinned Nod tools
        shell: bash
        run: |
          mkdir -p Launcher/artifacts/macos
          nodtool_version=v2.0.0-alpha.10
          nodtool_arm64_asset=nodtool-macos-arm64
          nodtool_arm64_sha256=e23ca466999b720c55e6d29c9683fce8cc74451ba64ead2e543d50129f24528a
          nodtool_x86_64_asset=nodtool-macos-x86_64
          nodtool_x86_64_sha256=f68f504dc2b72694b468ca78b6a24142c7aa5c8800f77564297f4143682e6575
          curl -fsSL --retry 3 \
            "https://github.com/encounter/nod/releases/download/${nodtool_version}/${nodtool_arm64_asset}" \
            -o Launcher/artifacts/macos/nodtool-arm64
          curl -fsSL --retry 3 \
            "https://github.com/encounter/nod/releases/download/${nodtool_version}/${nodtool_x86_64_asset}" \
            -o Launcher/artifacts/macos/nodtool-x86_64
          printf '%s  %s\n' "$nodtool_arm64_sha256" Launcher/artifacts/macos/nodtool-arm64 | shasum -a 256 -c -
          printf '%s  %s\n' "$nodtool_x86_64_sha256" Launcher/artifacts/macos/nodtool-x86_64 | shasum -a 256 -c -
          chmod +x Launcher/artifacts/macos/nodtool-arm64 Launcher/artifacts/macos/nodtool-x86_64

      - name: Publish self-contained Translator tools
        shell: bash
        run: |
          dotnet publish translator/src/Translator.Cli/Translator.Cli.csproj \
            -c Release -r osx-arm64 --self-contained true \
            -p:PublishSingleFile=true \
            -o Launcher/artifacts/macos/translator-arm64
          dotnet publish translator/src/Translator.Cli/Translator.Cli.csproj \
            -c Release -r osx-x64 --self-contained true \
            -p:PublishSingleFile=true \
            -o Launcher/artifacts/macos/translator-x86_64

      - name: Download pinned universal Ninja
        shell: bash
        run: |
          ninja_version=1.13.2
          ninja_sha256=c99048673aa765960a99cf10c6ddb9f1fad506099ff0a0e137ad8960a88f321b
          curl -fsSL --retry 3 "https://github.com/ninja-build/ninja/releases/download/v${ninja_version}/ninja-mac.zip" -o ninja-mac.zip
          printf '%s  %s\n' "$ninja_sha256" ninja-mac.zip | shasum -a 256 -c -
          unzip -q ninja-mac.zip -d Launcher/artifacts/macos/ninja
          chmod +x Launcher/artifacts/macos/ninja/ninja

      - name: Download pinned portable CMake
        shell: bash
        run: |
          cmake_version=4.4.3
          archive="cmake-${cmake_version}-macos-universal.tar.gz"
          base_url="https://github.com/Kitware/CMake/releases/download/v${cmake_version}"
          expected_sha256=0c5d65251c14cc884bfa16bdbed3c263ce5bffe2e21c0d0d00962cb0610464fa
          curl -fsSL --retry 3 "$base_url/$archive" -o "$archive"
          printf '%s  %s\n' "$expected_sha256" "$archive" | shasum -a 256 -c -
          tar -xzf "$archive"
          mv "cmake-${cmake_version}-macos-universal/CMake.app/Contents" Launcher/artifacts/macos/cmake

      - name: Build Setup.pkg
        env:
          TAG_VERSION: ${{ github.ref_name }}
        shell: bash
        run: |
          package_version=""
          if [[ "${TAG_VERSION:-}" =~ ^v?[0-9] ]]; then
            package_version="${TAG_VERSION#v}"
          elif [[ -f "Launcher/Directory.Build.props" ]]; then
            package_version=$(grep -m1 '<Version>' Launcher/Directory.Build.props | sed -E 's/.*<Version>([^<]+)<\/Version>.*/\1/')
          fi
          mkdir -p Launcher/dist
          Launcher/macos/build-setup-pkg.command \
            --nodtool-arm64 Launcher/artifacts/macos/nodtool-arm64 \
            --nodtool-x86_64 Launcher/artifacts/macos/nodtool-x86_64 \
            --translator-arm64 Launcher/artifacts/macos/translator-arm64/Translator.Cli \
            --translator-x86_64 Launcher/artifacts/macos/translator-x86_64/Translator.Cli \
            --cmake-root Launcher/artifacts/macos/cmake \
            --ninja-arm64 Launcher/artifacts/macos/ninja/ninja \
            --ninja-x86_64 Launcher/artifacts/macos/ninja/ninja \
            --output Launcher/dist/WiiCompiled-Setup.pkg \
            ${package_version:+--version "$package_version"}

      - name: Verify package layout and architecture-specific tools
        shell: bash
        run: |
          pkgutil --check-signature Launcher/dist/WiiCompiled-Setup.pkg || true
          if pkgutil --payload-files Launcher/dist/WiiCompiled-Setup.pkg | \
            grep -E '/(Assets|generated|PulsarPacks|WiiCompiled.app|RetroRewind.app)(/|$)'; then
            echo "::error::Setup.pkg contains a forbidden payload"
            exit 1
          fi
          expanded="$RUNNER_TEMP/wiicompiled-setup-expanded"
          pkgutil --expand-full Launcher/dist/WiiCompiled-Setup.pkg "$expanded"
          resources="$expanded/Payload/Applications/WiiCompiled Setup.app/Contents/Resources"
          for arch in arm64 x86_64; do
            for tool in nodtool Translator.Cli ninja; do
              lipo "$resources/tools/$arch/$tool" -verify_arch "$arch"
            done
          done
          lipo "$resources/tools/cmake/bin/cmake" -verify_arch arm64 x86_64
          bash "$resources/setup.command" --help
          /usr/bin/arch -x86_64 /bin/bash "$resources/setup.command" --help

      - uses: actions/upload-artifact@v7
        with:
          name: WiiCompiled-Setup-macos-universal
          path: Launcher/dist/WiiCompiled-Setup.pkg
          if-no-files-found: error
          archive: false

  # Publishes the packaged installers as a GitHub Release whenever a v* tag is pushed. Wheel Wizard
  # discovers updates from these releases, so the contract it relies on is enforced here: a full
  # (non-prerelease) release whose tag is v<semver>, carrying the expected platform assets,
  # produced by setup hosts that report that same version.
  release:
    name: Publish GitHub Release
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [linux-appimage, windows-installer, macos-setup-package, recompilation]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      # Wheel Wizard runs the downloaded setup with --version and refuses it when the reported
      # version differs from the release tag, so a tag that was pushed without bumping the pinned
      # version would ship an update nobody can install. Catch that before anything is published.
      - name: Verify the tag matches the pinned setup version
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          version="${TAG#v}"
          status=0
          check() {
            if ! grep -Fq "$2" "$1"; then
              echo "::error file=$1::expected '$2' for tag $TAG"
              status=1
            fi
          }
          check Launcher/Directory.Build.props "<Version>$version</Version>"
          exit $status

      # The build jobs upload with `archive: false`, which stores each installer as a raw file
      # rather than a zip (and names the artifact after the file). Only download-artifact v8 and
      # later understand such direct uploads; v7 tries to unzip everything and fails on them.
      - uses: actions/download-artifact@v8
        with:
          path: artifacts
          merge-multiple: true

      - name: Publish release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          ls -lR artifacts
          assets=()
          for name in WiiCompiled-Setup.exe WiiCompiled-Setup-x86_64.AppImage WiiCompiled-Setup-aarch64.AppImage WiiCompiled-Setup.pkg; do
            found="$(find artifacts -type f -name "$name" | head -n 1)"
            [ -n "$found" ] && [ -s "$found" ] || { echo "::error::missing release asset $name"; exit 1; }
            assets+=("$found")
          done
          # A re-run of a tag whose release already exists only refreshes the assets.
          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            gh release upload "$TAG" "${assets[@]}" --repo "$GITHUB_REPOSITORY" --clobber
          else
            gh release create "$TAG" "${assets[@]}" \
              --repo "$GITHUB_REPOSITORY" \
              --title "$TAG" \
              --verify-tag \
              --generate-notes
          fi