name: Deploy

on:
  push:
    tags:
      - 'v[0-9]*.[0-9]*.[0-9]*'

jobs:
  build-linux-web:
    runs-on: mac
    env:
      GOPROXY: https://goproxy.cn,direct
      PUB_HOSTED_URL: https://pub.flutter-io.cn
      FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn

    steps:
      - uses: actions/checkout@v4

      - name: Provision (idempotent — auto-runs if host not initialized)
        run: sh scripts/ci/provision-mac.sh

      - name: Compile (Linux backend + Flutter Web)
        run: sh scripts/ci/compile.sh "${{ gitea.ref_name }}"

      - name: Upload linux-web artifacts
        uses: actions/upload-artifact@v3
        with:
          name: linux-web
          path: dist/

  build-macos:
    # Same physical runner as build-linux-web (label: mac, capacity 1). Run them
    # serially via needs so the second job doesn't sit queued and time out.
    needs: build-linux-web
    runs-on: mac
    env:
      PUB_HOSTED_URL: https://pub.flutter-io.cn
      FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn

    steps:
      - uses: actions/checkout@v4

      - name: Provision (idempotent — auto-runs if host not initialized)
        run: sh scripts/ci/provision-mac.sh

      - name: Compile (Flutter macOS)
        run: sh scripts/ci/compile-macos.sh "${{ gitea.ref_name }}"

      - name: Upload macos artifacts
        uses: actions/upload-artifact@v3
        with:
          name: macos
          path: dist/

  build-android:
    # Same physical mac runner (label: mac, capacity 1) — it already has the
    # Android SDK. Serialize after build-macos via needs so it doesn't sit
    # queued and time out.
    needs: build-macos
    runs-on: mac
    env:
      PUB_HOSTED_URL: https://pub.flutter-io.cn
      FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn

    steps:
      - uses: actions/checkout@v4

      - name: Provision (idempotent — auto-runs if host not initialized)
        run: sh scripts/ci/provision-mac.sh

      - name: Compile (Flutter Android APK)
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: sh scripts/ci/compile-android.sh "${{ gitea.ref_name }}"

      - name: Upload android artifacts
        uses: actions/upload-artifact@v3
        with:
          name: android
          path: dist/

  build-ios:
    # Same physical mac runner (label: mac, capacity 1) with Xcode. Serialize
    # after build-android. Builds a signed IPA and uploads to TestFlight; if the
    # iOS signing secrets are absent the script skips gracefully (exit 0), so this
    # job is safe to keep before the Apple Developer account is configured.
    needs: build-android
    runs-on: mac
    env:
      PUB_HOSTED_URL: https://pub.flutter-io.cn
      FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn

    steps:
      - uses: actions/checkout@v4

      - name: Provision (idempotent — auto-runs if host not initialized)
        run: sh scripts/ci/provision-mac.sh

      - name: Compile & upload to TestFlight (Flutter iOS)
        env:
          IOS_DIST_CERT_P12_BASE64: ${{ secrets.IOS_DIST_CERT_P12_BASE64 }}
          IOS_DIST_CERT_PASSWORD: ${{ secrets.IOS_DIST_CERT_PASSWORD }}
          IOS_PROVISIONING_PROFILE_BASE64: ${{ secrets.IOS_PROVISIONING_PROFILE_BASE64 }}
          IOS_TEAM_ID: ${{ secrets.IOS_TEAM_ID }}
          APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
          APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }}
          APPSTORE_API_KEY_P8_BASE64: ${{ secrets.APPSTORE_API_KEY_P8_BASE64 }}
        run: sh scripts/ci/compile-ios.sh "${{ gitea.ref_name }}"

  build-windows:
    runs-on: windows
    env:
      GOPROXY: https://goproxy.cn,direct
      PUB_HOSTED_URL: https://pub.flutter-io.cn
      FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn

    steps:
      - uses: actions/checkout@v4

      - name: Provision (idempotent — auto-runs if host not initialized)
        shell: bash
        run: sh scripts/ci/provision-windows.sh

      - name: Compile (Flutter Windows)
        shell: bash
        run: sh scripts/ci/compile-windows.sh "${{ gitea.ref_name }}"

      - name: Upload windows artifacts
        uses: actions/upload-artifact@v3
        with:
          name: windows
          path: dist/

  release-deploy:
    needs: [build-linux-web, build-macos, build-android, build-ios, build-windows]
    runs-on: mac
    env:
      GOPROXY: https://goproxy.cn,direct
      PUB_HOSTED_URL: https://pub.flutter-io.cn
      FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn

    steps:
      - uses: actions/checkout@v4

      - name: Download linux-web artifacts
        uses: actions/download-artifact@v3
        with:
          name: linux-web
          path: dist/

      - name: Download macos artifacts
        uses: actions/download-artifact@v3
        with:
          name: macos
          path: dist/

      - name: Download android artifacts
        uses: actions/download-artifact@v3
        with:
          name: android
          path: dist/

      - name: Download windows artifacts
        uses: actions/download-artifact@v3
        with:
          name: windows
          path: dist/

      - name: Test
        run: sh scripts/ci/test.sh

      - name: Release
        env:
          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
          GITEA_REPOSITORY: ${{ gitea.repository }}
        run: sh scripts/ci/release.sh "${{ gitea.ref_name }}"

      - name: Deploy
        env:
          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
          GITEA_REPOSITORY: ${{ gitea.repository }}
          EC2_SSH_KEY: ${{ secrets.EC2_SSH_KEY }}
          EC2_HOST: ${{ secrets.EC2_HOST }}
          EC2_USER: ${{ secrets.EC2_USER }}
        run: sh scripts/ci/deploy.sh "${{ gitea.ref_name }}"

      - name: Notify
        if: always()
        env:
          TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
          TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
        run: sh scripts/ci/notify.sh "${{ gitea.ref_name }}" "${{ job.status }}"