workdsh/.github/workflows/ci.yml

name: CI

on:
  pull_request:
    branches: [master]
  push:
    branches: [master]
    tags: ['desktop-v*']
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  DSH_TELEMETRY_DISABLED: '1'

jobs:
  # Keep required checks conclusive for documentation-only changes. Workflow
  # path filters can leave required checks pending, so classify inside the run.
  changes:
    runs-on: ubuntu-latest
    outputs:
      product: ${{ steps.scope.outputs.product }}
    steps:
      - uses: actions/checkout@v6
        with:
          # GitHub's pull-request merge ref can retain the base branch's
          # submodule gitlink when the PR advances it to a descendant. Check
          # out the actual PR head so pinned submodules match upstream.json.
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-node@v6
        with:
          node-version: 22.23.2
      - name: Classify changed paths
        id: scope
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          REF_TYPE: ${{ github.ref_type }}
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          set -euo pipefail
          node --test scripts/bilingual-docs.test.mjs
          node scripts/verify-bilingual-docs.mjs
          node --test scripts/market-dependency-direction.test.mjs
          node scripts/verify-market-dependency-direction.mjs
          if [[ "$EVENT_NAME" == "workflow_dispatch" || "$REF_TYPE" == "tag" || -z "$BASE_SHA" || "$BASE_SHA" =~ ^0+$ ]]; then
            product=true
          else
            git diff --check "$BASE_SHA" "$HEAD_SHA"
            product="$(git diff --name-only -z "$BASE_SHA" "$HEAD_SHA" | node scripts/classify-ci-changes.mjs)"
          fi
          echo "product=$product" >> "$GITHUB_OUTPUT"

  # Full product gate: build, typecheck, unit tests, and every headless smoke.
  # A documentation-only change already passed diff validation in `changes`.
  check:
    needs: changes
    runs-on: ubuntu-latest
    steps:
      - name: Documentation-only gate
        if: needs.changes.outputs.product == 'false'
        run: echo "Documentation-only change; product build and tests are not required."
      - uses: actions/checkout@v6
        if: needs.changes.outputs.product == 'true'
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
          submodules: recursive
      - uses: actions/setup-node@v6
        if: needs.changes.outputs.product == 'true'
        with:
          node-version: 22.23.2
      - if: needs.changes.outputs.product == 'true'
        run: corepack enable
      - name: Resolve Yarn cache folder
        if: needs.changes.outputs.product == 'true'
        id: yarn-cache
        run: echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
      - uses: actions/cache@v6
        if: needs.changes.outputs.product == 'true'
        with:
          path: ${{ steps.yarn-cache.outputs.dir }}
          key: yarn-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
      - if: needs.changes.outputs.product == 'true'
        run: yarn install --immutable
      - if: needs.changes.outputs.product == 'true'
        run: yarn check

  # Windows-only logic and unsigned NSIS/portable builds on a real Windows runner:
  # updates, window options, pwsh sandbox, volume diagnostics, and packaging.
  # The package gate runs once; both artifacts reuse its build output.
  desktop-windows:
    needs: changes
    if: needs.changes.outputs.product == 'true'
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        workspace: [dsh-plugin-desktop, dsh-plugin-desktop-beta]
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
          submodules: recursive
      - uses: actions/setup-node@v6
        with:
          node-version: 22.23.2
      - run: corepack enable
      - name: Resolve Yarn cache folder
        id: yarn-cache
        run: echo "dir=$(yarn config get cacheFolder)" >> "$env:GITHUB_OUTPUT"
      - uses: actions/cache@v6
        with:
          path: ${{ steps.yarn-cache.outputs.dir }}
          key: yarn-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
      - run: yarn install --immutable
      - run: yarn workspace ${{ matrix.workspace }} check:win-package
      - name: Build Windows installer
        env:
          DSH_PACKAGE_CHECK_ALREADY_RAN: '1'
        run: yarn workspace ${{ matrix.workspace }} dist:win
      - name: Build Windows portable archive
        env:
          DSH_PACKAGE_CHECK_ALREADY_RAN: '1'
        run: yarn workspace ${{ matrix.workspace }} dist:win-portable
      - name: Upload Windows installer and portable archive
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.workspace }}-windows-x64
          path: |
            ${{ matrix.workspace }}/dist/*.exe
            ${{ matrix.workspace }}/dist/*.zip
            ${{ matrix.workspace }}/dist/*.blockmap
          if-no-files-found: error
          retention-days: 14

  # macOS-only universal packaging smoke on a real macOS runner: the signed
  # release is built manually on a credentialed machine, so an unsigned DMG
  # here catches Intel and Apple Silicon packaging regressions before a manual
  # release. No signing secrets ever reach this job.
  desktop-macos:
    needs: changes
    if: needs.changes.outputs.product == 'true'
    runs-on: macos-latest
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        workspace: [dsh-plugin-desktop, dsh-plugin-desktop-beta]
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
          submodules: recursive
      - uses: actions/setup-node@v6
        with:
          node-version: 22.23.2
      - run: corepack enable
      - name: Resolve Yarn cache folder
        id: yarn-cache
        run: echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
      - uses: actions/cache@v6
        with:
          path: ${{ steps.yarn-cache.outputs.dir }}
          key: yarn-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
      - run: yarn install --immutable
      - run: yarn workspace ${{ matrix.workspace }} check:mac-package
      - name: Build macOS smoke artifact
        env:
          DSH_PACKAGE_CHECK_ALREADY_RAN: '1'
        run: yarn workspace ${{ matrix.workspace }} dist:mac-smoke
      - name: Upload macOS universal DMG
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.workspace }}-macos-universal
          path: |
            ${{ matrix.workspace }}/dist/mac-smoke/*.dmg
            ${{ matrix.workspace }}/dist/mac-smoke/*.dmg.blockmap
          if-no-files-found: error
          retention-days: 14

  # Upstream toolchain smoke: the portable-shell scripts must resolve the
  # pinned submodule's own Yarn/pnpm release on Windows.
  upstream-command-windows:
    needs: changes
    if: needs.changes.outputs.product == 'true'
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
          submodules: recursive
      - uses: actions/setup-node@v6
        with:
          node-version: 22.23.2
      - run: corepack enable
      - run: yarn check:layout
      - run: yarn upstream:version

  publish-desktop-release:
    if: github.ref_type == 'tag' && startsWith(github.ref_name, 'desktop-v')
    needs: [check, desktop-windows, desktop-macos, upstream-command-windows]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download desktop packages
        uses: actions/download-artifact@v5
        with:
          pattern: dsh-plugin-desktop-*
          path: staging
      - name: Prepare uniquely named release assets
        shell: bash
        run: |
          set -euo pipefail
          mkdir release-assets
          while IFS= read -r -d '' file; do
            artifact="$(basename "$(dirname "$file")")"
            name="$(basename "$file")"
            cp "$file" "release-assets/${artifact}--${name}"
          done < <(find staging -type f -print0)
          (cd release-assets && sha256sum -- * > SHA256SUMS)
      - name: Publish GitHub prerelease
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        shell: bash
        run: |
          cat > release-notes.md <<'EOF'
          WorkDSH Desktop v2.0.5 Alpha 1 提供 Windows x64 安装版、便携版和 macOS Universal DMG，同时提供稳定与 Beta 桌面变体。

          - 桌面产品名称统一为 WorkDSH
          - README 新增项目、资料库和桌面端下载说明
          - Windows 包在原生 Windows Runner 构建和验证
          - macOS 包为 Intel/Apple Silicon Universal 未签名预览包
          - 修复 SSH 中断上传后遗留空文件的问题

          这是 Alpha 预发布。请在升级前备份本地配置和数据；未签名包可能触发系统安全提示。所有文件的 SHA-256 见 `SHA256SUMS`。
          EOF
          gh release create "$TAG" release-assets/* \
            --repo "$GITHUB_REPOSITORY" \
            --title "WorkDSH Desktop v2.0.5 Alpha 1" \
            --notes-file release-notes.md \
            --prerelease