name: OTA Frontend Build & Sign

# 前端 OTA 升级包构建 + 签名 + 上传 artifact
# 触发: 仅手动 (workflow_dispatch), 发版前用
#   - 主分支 push 的自动 OTA 生成已并入 docker-build.yml (随镜像发布), 本 workflow 不再监听 push 避免重复构建
# 输入: sequence / notes / min_binary (可覆盖默认)
# Secret 依赖: MINISIGN_PRIVATE_KEY (整段 .key 文件内容, 含首行 untrusted comment)
# 注意: 此 workflow 不会修改 src-tauri/tauri.conf.json 里的 pubkey,
#       换密钥请手动改 conf 并 commit.

on:
  workflow_dispatch:
    inputs:
      sequence:
        description: 'OTA sequence (单调递增整数, 留空用 timestamp)'
        required: false
        type: string
      notes:
        description: '发布说明 (写入 latest.json.notes)'
        required: false
        type: string
        default: ''
      min_binary:
        description: '最低 binary 版本 (默认 0.1.0 = 现有 APK 的原生版本, 与前端应用版本无关)'
        required: false
        type: string
        default: '0.1.0'

jobs:
  build-ota:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: https://gitea.com/actions/checkout@v4

      - name: Setup Node
        uses: https://gitea.com/actions/setup-node@v4
        with:
          node-version: 22

      - name: Install deps
        run: npm ci --no-audit --no-fund

      - name: Build frontend
        # 复用 vite build 产物; 不打 Docker (本 workflow 只关心前端)
        run: npm run build

      - name: Install minisign
        # 静态二进制直接下载, 免去每次 apt-get update + install
        # 注意: release tarball 是 macOS 上打包的, 混有多个平台的 minisign 二进制,
        # 逐个试运行挑出本机可执行的, 都不行再回退 apt
        run: |
          set -euo pipefail
          mkdir -p /tmp/ms
          curl -sL https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12-linux.tar.gz | tar xz -C /tmp/ms
          BIN=""
          for c in $(find /tmp/ms -type f -name minisign); do
            if "$c" -v >/dev/null 2>&1; then BIN="$c"; break; fi
          done
          if [ -n "$BIN" ]; then
            sudo install -m755 "$BIN" /usr/local/bin/minisign
          else
            echo "未找到可执行的静态二进制, 回退 apt 安装"
            sudo apt-get update && sudo apt-get install -y minisign
          fi
          minisign -v

      - name: Build & sign OTA package
        # 发布说明默认 = 检出 commit 的 message (标题+正文), commit sha 单独写入;
        # 手动填写的 notes 优先
        env:
          MINISIGN_PRIVATE_KEY: ${{ secrets.MINISIGN_PRIVATE_KEY }}
        run: |
          set -euo pipefail
          OUT="ota-package"
          ARGS="--out ${OUT} --commit ${GITHUB_SHA}"
          if [ -n "${{ inputs.sequence }}" ]; then ARGS="${ARGS} --sequence ${{ inputs.sequence }}"; fi
          if [ -n "${{ inputs.notes }}" ]; then
            ARGS="${ARGS} --notes \"${{ inputs.notes }}\""
          else
            MSG="$(git log -1 --pretty=format:%B | sed -e '/^[[:space:]]*$/d')"
            ARGS="${ARGS} --notes \"${MSG}\""
          fi
          if [ -n "${{ inputs.min_binary }}" ]; then ARGS="${ARGS} --min-binary ${{ inputs.min_binary }}"; fi
          eval "node scripts/build-ota.mjs ${ARGS}"
          echo "===== latest.json ====="
          cat ${OUT}/latest.json
          echo "===== bundle sha256 ====="
          sha256sum ${OUT}/iboard-ota.tar.gz

      - name: Upload OTA package as artifact
        uses: https://gitea.com/actions/upload-artifact@v4
        with:
          name: iboard-ota-${{ inputs.sequence || github.run_number }}
          path: ota-package/
          retention-days: 30
          if-no-files-found: error