name: Release

on:
  workflow_dispatch:
  push:
    tags:
      - "v*"

jobs:
  release:
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: "macos-latest"
            args: "--target aarch64-apple-darwin"
            python-version: "3.12"
            backend: "mlx"
          - platform: "macos-15-intel"
            args: "--target x86_64-apple-darwin"
            python-version: "3.12"
            backend: "pytorch"
          - platform: "windows-latest"
            args: ""
            python-version: "3.12"
            backend: "pytorch"

    runs-on: ${{ matrix.platform }}

    steps:
      - uses: actions/checkout@v4

      # Ubuntu runners ship with ~14 GB free; pip + PyInstaller + torch can
      # peak well above that during the build. Reclaim ~25 GB by pruning
      # preinstalled toolchains we don't use. This is what likely tripped
      # the March 2026 Linux release attempts (see commit 103e98b
      # "github runners suck") — not a code issue, a disk-pressure one.
      - name: Free up disk space (ubuntu)
        if: contains(matrix.platform, 'ubuntu') || contains(matrix.platform, 'namespace')
        # Pinned to v1.3.1 (SHA) — this job runs with contents: write and
        # handles signing secrets later, so we don't want a floating ref.
        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be
        with:
          tool-cache: false
          android: true
          dotnet: true
          haskell: true
          # large-packages: true would `apt-get remove '^llvm-.*'`, which
          # cascade-removes reverse deps that won't be pulled back in by the
          # `llvm-dev` install below. The other flags already free ~20 GB,
          # enough for the Python + torch + PyInstaller build.
          large-packages: false
          swap-storage: true

      - name: Install dependencies (ubuntu only)
        if: contains(matrix.platform, 'ubuntu') || contains(matrix.platform, 'namespace')
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf llvm-dev libasound2-dev

      - name: Install LLVM (macOS)
        if: matrix.platform == 'macos-latest' || matrix.platform == 'macos-15-intel'
        run: |
          brew install llvm@20
          echo "$(brew --prefix llvm@20)/bin" >> $GITHUB_PATH
          echo "LLVM_CONFIG=$(brew --prefix llvm@20)/bin/llvm-config" >> $GITHUB_ENV

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: "pip"

      - name: Install CPU-only PyTorch (Linux)
        if: contains(matrix.platform, 'ubuntu') || contains(matrix.platform, 'namespace')
        run: |
          pip install torch torchaudio --index-url https://download.pytorch.org/whl/cpu

      - name: Install Python dependencies
        run: |
          python -m pip install --upgrade pip
          pip install pyinstaller
          pip install -r backend/requirements.txt
          pip install --no-deps chatterbox-tts
          pip install --no-deps hume-tada

      - name: Install MLX dependencies (Apple Silicon only)
        if: matrix.backend == 'mlx'
        run: |
          pip install -r backend/requirements-mlx.txt
          # mlx-audio>=0.3.1 and mlx-lm>=0.31.1 both declare transformers>=5.x,
          # which conflicts with our 4.57.x cap. The runtime APIs we use work
          # fine on transformers 4.57.x in practice (verified in dev), so install
          # them --no-deps. mlx-audio's other runtime deps (huggingface_hub,
          # librosa, numpy, numba, pyloudnorm) are already in requirements.txt;
          # miniaudio is in requirements-mlx.txt (needed by mlx_audio.stt,
          # not transitively pulled by anything else — see issue #505); the
          # rest (sounddevice, protobuf, sentencepiece, pyyaml, jinja2) are
          # pulled in by other engines.
          pip install --no-deps mlx-lm==0.31.1
          pip install --no-deps mlx-audio==0.4.1

      - name: Build Python server (Linux/macOS)
        if: matrix.platform != 'windows-latest'
        run: |
          chmod +x scripts/build-server.sh
          ./scripts/build-server.sh

      - name: Build Python server (Windows)
        if: matrix.platform == 'windows-latest'
        shell: bash
        run: |
          cd backend
          python build_binary.py
          python build_binary.py --shim

          # Get platform tuple
          PLATFORM=$(rustc --print host-tuple)

          # Create binaries directory
          mkdir -p ../tauri/src-tauri/binaries

          # Copy with platform suffix
          cp dist/voicebox-server.exe ../tauri/src-tauri/binaries/voicebox-server-${PLATFORM}.exe
          cp dist/voicebox-mcp.exe ../tauri/src-tauri/binaries/voicebox-mcp-${PLATFORM}.exe
          echo "Built voicebox-server-${PLATFORM}.exe"
          echo "Built voicebox-mcp-${PLATFORM}.exe"

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ (matrix.platform == 'macos-latest' && 'aarch64-apple-darwin') || (matrix.platform == 'macos-15-intel' && 'x86_64-apple-darwin') || '' }}

      - name: Rust cache
        uses: swatinem/rust-cache@v2
        with:
          workspaces: "./tauri/src-tauri -> target"

      - name: Install dependencies
        run: bun install

      - name: Install Apple API key
        if: matrix.platform == 'macos-latest' || matrix.platform == 'macos-15-intel'
        run: |
          mkdir -p ~/.appstoreconnect/private_keys/
          cd ~/.appstoreconnect/private_keys/
          echo ${{ secrets.APPLE_API_KEY_BASE64 }} >> AuthKey_${{ secrets.APPLE_API_KEY }}.p8.base64
          base64 --decode -i AuthKey_${{ secrets.APPLE_API_KEY }}.p8.base64 -o AuthKey_${{ secrets.APPLE_API_KEY }}.p8
          rm AuthKey_${{ secrets.APPLE_API_KEY }}.p8.base64

      - name: Install Codesigning Certificate
        if: matrix.platform == 'macos-latest' || matrix.platform == 'macos-15-intel'
        uses: apple-actions/import-codesign-certs@v3
        with:
          p12-file-base64: ${{ secrets.APPLE_CERTIFICATE }}
          p12-password: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}

      - name: Disk / environment snapshot (pre-bundle debug)
        if: contains(matrix.platform, 'ubuntu') || contains(matrix.platform, 'namespace')
        run: |
          echo "=== df -h ==="
          df -h
          echo "=== free -h ==="
          free -h
          echo "=== Rust / Cargo ==="
          rustc --version
          cargo --version
          echo "=== Bun ==="
          bun --version
          echo "=== Tauri CLI ==="
          cd tauri && bun run tauri --version

      - name: Extract release notes from CHANGELOG.md
        id: changelog
        shell: bash
        run: |
          # Get the version from the tag (strip leading 'v')
          VERSION="${GITHUB_REF_NAME#v}"

          # Extract the section for this version from CHANGELOG.md
          # Matches from "## [X.Y.Z]" until the next "## [" heading
          NOTES=$(sed -n "/^## \[${VERSION}\]/,/^## \[/{/^## \[${VERSION}\]/d;/^## \[/d;p;}" CHANGELOG.md)

          # Fall back to a placeholder if the version isn't in the changelog
          if [ -z "$(echo "$NOTES" | tr -d '[:space:]')" ]; then
            NOTES="See the assets below to download and install this version."
          fi

          # Use multiline output syntax
          {
            echo "notes<<CHANGELOG_EOF"
            echo "$NOTES"
            echo "CHANGELOG_EOF"
          } >> "$GITHUB_OUTPUT"

      # Linux hang watchdog: previous releases silently wedged inside tauri
      # bundling (possibly linuxdeploy/AppImage download, possibly cargo link).
      # Cap the step at 30 min so we get logs instead of waiting out the 6hr
      # job timeout. Other platforms historically complete in ~25 min, so 45
      # is comfortable.
      - uses: tauri-apps/tauri-action@v0.6
        timeout-minutes: ${{ (contains(matrix.platform, 'ubuntu') || contains(matrix.platform, 'namespace')) && 30 || 45 }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
          ENABLE_CODE_SIGNING: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_PROVIDER_SHORT_NAME: ${{ secrets.APPLE_PROVIDER_SHORT_NAME }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          # Stream subprocess stdout/stderr so the hang is visible in logs.
          CARGO_TERM_VERBOSE: "true"
          RUST_BACKTRACE: "1"
        with:
          projectPath: tauri
          tagName: v__VERSION__
          releaseName: "voicebox v__VERSION__"
          releaseBody: ${{ steps.changelog.outputs.notes }}
          releaseDraft: true
          prerelease: false
          args: ${{ matrix.args }}
          includeUpdaterJson: true

      # Tauri's bundler signs the .app and notarizes it, but the .dmg wrapper
      # ships unnotarized. Gatekeeper rejects that on macOS 15 Sequoia (caught
      # by Homebrew Cask CI) and causes "app isn't signed" dialogs on older
      # Intel Macs when Apple's notarization servers are slow (see issue #509).
      # Submit the .dmg to notarytool, staple the ticket, and overwrite the
      # release asset uploaded by tauri-action.
      - name: Notarize and staple DMG (macOS)
        if: matrix.platform == 'macos-latest' || matrix.platform == 'macos-15-intel'
        env:
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          KEY_PATH="$HOME/.appstoreconnect/private_keys/AuthKey_${APPLE_API_KEY_ID}.p8"
          TARGET=$(echo "${{ matrix.args }}" | sed -n 's/.*--target \([a-z0-9_-]*\).*/\1/p')
          DMG_DIR="tauri/src-tauri/target/${TARGET}/release/bundle/dmg"
          # Match the release tag tauri-action resolved from tauri.conf.json's
          # version field; GITHUB_REF_NAME is a branch name under workflow_dispatch.
          RELEASE_TAG="v$(jq -r '.version' tauri/src-tauri/tauri.conf.json)"
          shopt -s nullglob
          dmgs=("${DMG_DIR}"/*.dmg)
          if [ ${#dmgs[@]} -eq 0 ]; then
            echo "::error::No DMGs found in ${DMG_DIR} — tauri bundler output path may have changed"
            exit 1
          fi
          for dmg in "${dmgs[@]}"; do
            echo "::group::Notarize $(basename "$dmg")"
            xcrun notarytool submit "$dmg" \
              --key "$KEY_PATH" \
              --key-id "$APPLE_API_KEY_ID" \
              --issuer "$APPLE_API_ISSUER" \
              --wait --timeout 20m
            xcrun stapler staple "$dmg"
            spctl -a -t open --context context:primary-signature -vv "$dmg"
            gh release upload "${RELEASE_TAG}" "$dmg" --clobber \
              --repo "${GITHUB_REPOSITORY}"
            echo "::endgroup::"
          done

  build-cuda-windows:
    runs-on: windows-latest
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: "pip"

      - name: Install Python dependencies
        run: |
          python -m pip install --upgrade pip
          pip install pyinstaller
          pip install -r backend/requirements.txt
          pip install --no-deps chatterbox-tts
          pip install --no-deps hume-tada

      - name: Install PyTorch with CUDA 12.8
        run: |
          pip install torch --index-url https://download.pytorch.org/whl/cu128 --force-reinstall --no-deps
          pip install torchaudio --index-url https://download.pytorch.org/whl/cu128 --force-reinstall --no-deps

      - name: Verify CUDA support in torch
        run: |
          python -c "import torch; print(f'CUDA available in build: {torch.cuda.is_available()}'); print(f'CUDA version: {torch.version.cuda}')"

      - name: Build CUDA server binary (onedir)
        shell: bash
        working-directory: backend
        env:
          # Include Blackwell (sm_120) via PTX forward compatibility.
          # Pre-built PyTorch cu128 wheels ship native kernels for sm_80/86/89/90
          # but not sm_120. Setting this env var causes torch.utils.cpp_extension
          # (and any JIT-compiled kernels) to target Blackwell GPUs as well.
          TORCH_CUDA_ARCH_LIST: "8.0;8.6;8.9;9.0;12.0+PTX"
        run: python build_binary.py --cuda

      - name: Package into server core + CUDA libs archives
        shell: bash
        run: |
          python scripts/package_cuda.py \
            backend/dist/voicebox-server-cuda/ \
            --output release-assets/ \
            --cuda-libs-version cu128-v1 \
            --torch-compat ">=2.7.0,<2.11.0"

      - name: Upload archives to GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          files: |
            release-assets/voicebox-server-cuda.tar.gz
            release-assets/voicebox-server-cuda.tar.gz.sha256
            release-assets/cuda-libs-cu128-v1.tar.gz
            release-assets/cuda-libs-cu128-v1.tar.gz.sha256
            release-assets/cuda-libs.json
          draft: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload onedir as workflow artifact
        uses: actions/upload-artifact@v4
        with:
          name: voicebox-server-cuda-windows
          path: backend/dist/voicebox-server-cuda/
          retention-days: 7

  build-rocm-windows:
    runs-on: windows-latest
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          # ROCm wheels are cp312-cp312-specific — build_binary.py --rocm enforces this.
          python-version: "3.12"
          cache: "pip"

      - name: Install Python dependencies
        run: |
          python -m pip install --upgrade pip
          pip install pyinstaller
          pip install -r backend/requirements.txt
          pip install --no-deps chatterbox-tts
          pip install --no-deps hume-tada

      - name: Build ROCm server binary (onedir)
        shell: bash
        working-directory: backend
        # build_binary.py --rocm pulls the official AMD Radeon torch + rocm_sdk
        # wheels (rocm-rel-7.2.1) itself when ROCm torch is not already present,
        # then restores the dev torch afterwards.
        run: python build_binary.py --rocm

      - name: Package into server core + ROCm libs archives
        shell: bash
        run: |
          python scripts/package_rocm.py \
            backend/dist/voicebox-server-rocm/ \
            --output release-assets/ \
            --rocm-libs-version rocm7.2-v1 \
            --torch-compat ">=2.9.0,<2.10.0"

      - name: Upload archives to GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          files: |
            release-assets/voicebox-server-rocm.tar.gz
            release-assets/voicebox-server-rocm.tar.gz.sha256
            release-assets/rocm-libs-rocm7.2-v1.tar.gz
            release-assets/rocm-libs-rocm7.2-v1.tar.gz.sha256
            release-assets/rocm-libs.json
          draft: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload onedir as workflow artifact
        uses: actions/upload-artifact@v4
        with:
          name: voicebox-server-rocm-windows
          path: backend/dist/voicebox-server-rocm/
          retention-days: 7