name: Auto Tag

# Runs on every merge to master — reads the latest semver tag, increments
# the patch version, pushes a new tag, then runs release builds in this workflow.
# workflow_dispatch allows manual triggering when Gitea drops a push event.

on:
  push:
    branches:
      - master
  workflow_dispatch:

concurrency:
  group: auto-tag-master
  cancel-in-progress: false

jobs:
  autotag:
    runs-on: linux-amd64
    container:
      image: alpine:latest
    outputs:
      release_tag: ${{ steps.bump.outputs.release_tag }}
    steps:
      - name: Bump patch version and create tag
        id: bump
        env:
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
        run: |
          set -eu
          apk add --no-cache curl jq git

          API="http://172.0.0.29:3000/api/v1/repos/$GITHUB_REPOSITORY"

          # Checkout the source so we can read Cargo.toml
          git init
          git remote add origin "http://oauth2:${RELEASE_TOKEN}@172.0.0.29:3000/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "$GITHUB_SHA"
          git checkout FETCH_HEAD
          git config user.name "gitea-actions[bot]"
          git config user.email "gitea-actions@local"

          # Read the version declared in Cargo.toml
          CARGO_VERSION=$(grep '^version' src-tauri/Cargo.toml | head -1 | sed 's/version = "//;s/"//')
          CARGO_TAG="v${CARGO_VERSION}"
          echo "Cargo.toml declares: $CARGO_TAG"

          # Get the latest clean semver tag (vX.Y.Z only, ignore rc/test suffixes)
          LATEST=$(curl -s "$API/tags?limit=50" \
            -H "Authorization: token $RELEASE_TOKEN" | \
            jq -r '.[].name' | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | \
            sort -V | tail -1)
          echo "Latest git tag: ${LATEST:-none}"

          # Version resolution:
          #   1. Cargo.toml > latest tag → use Cargo.toml (major/minor bump)
          #   2. Cargo.toml == latest tag → tag already exists, use it for builds
          #   3. Cargo.toml < latest tag  → auto-increment patch on latest tag
          if [ -z "$LATEST" ]; then
            NEXT="$CARGO_TAG"
          elif [ "$(printf '%s\n' "$LATEST" "$CARGO_TAG" | sort -V | tail -1)" = "$CARGO_TAG" ]; then
            # Cargo.toml >= latest tag (covers both "ahead" and "equal" cases)
            NEXT="$CARGO_TAG"
            if [ "$CARGO_TAG" = "$LATEST" ]; then
              echo "Cargo.toml matches latest tag — reusing $NEXT for builds"
            else
              echo "Cargo.toml version $CARGO_TAG is ahead of $LATEST — using Cargo.toml"
            fi
          else
            MAJOR=$(echo "$LATEST" | cut -d. -f1 | tr -d 'v')
            MINOR=$(echo "$LATEST" | cut -d. -f2)
            PATCH=$(echo "$LATEST" | cut -d. -f3)
            NEXT="v${MAJOR}.${MINOR}.$((PATCH + 1))"
          fi

          echo "Latest tag: ${LATEST:-none}  →  Next: $NEXT"

          if git ls-remote --exit-code --tags origin "refs/tags/$NEXT" >/dev/null 2>&1; then
            echo "Tag $NEXT already exists; builds will target this tag."
          else
            git tag -a "$NEXT" -m "Release $NEXT"
            git push origin "refs/tags/$NEXT"
            echo "Tag $NEXT pushed successfully"
          fi

          # Export for downstream jobs — avoids git-describe guessing wrong tag
          echo "release_tag=$NEXT" >> "$GITHUB_OUTPUT"

  changelog:
    needs: autotag
    runs-on: linux-amd64
    container:
      image: alpine:latest
    steps:
      - name: Install dependencies
        run: |
          set -eu
          apk add --no-cache git curl jq

      - name: Checkout (full history + all tags)
        env:
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
        run: |
          set -eu
          git init
          git remote add origin \
            "http://oauth2:${RELEASE_TOKEN}@172.0.0.29:3000/${GITHUB_REPOSITORY}.git"
          git fetch --unshallow origin || git fetch --depth=2147483647 origin || true
          git fetch --tags origin
          git checkout "$GITHUB_SHA" 2>/dev/null || git checkout FETCH_HEAD
          git config user.name "gitea-actions[bot]"
          git config user.email "gitea-actions@local"

      - name: Install git-cliff
        run: |
          set -eu
          CLIFF_VER="2.7.0"
          curl -fsSL \
            "https://github.com/orhun/git-cliff/releases/download/v${CLIFF_VER}/git-cliff-${CLIFF_VER}-x86_64-unknown-linux-musl.tar.gz" \
            | tar -xz --strip-components=1 -C /usr/local/bin \
              "git-cliff-${CLIFF_VER}/git-cliff"

      - name: Generate changelog
        env:
          RELEASE_TAG: ${{ needs.autotag.outputs.release_tag }}
        run: |
          set -eu
          CURRENT_TAG="${RELEASE_TAG}"
          echo "Building changelog for $CURRENT_TAG"

          # Verify the tag is present locally after fetch
          if ! git rev-parse "refs/tags/${CURRENT_TAG}" >/dev/null 2>&1; then
            echo "ERROR: tag ${CURRENT_TAG} not found locally after fetch"
            exit 1
          fi

          # Generate changelog for current tag only (range: PREV_TAG..CURRENT_TAG)
          PREV_TAG=$(git tag --sort=-version:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \
            | grep -v "^${CURRENT_TAG}$" | head -1 || echo "")
          if [ -n "$PREV_TAG" ]; then
            # Generate release body for this tag only (commits since previous tag)
            git-cliff --config cliff.toml "${PREV_TAG}..${CURRENT_TAG}" > /tmp/release_body.md || true
            # Generate full CHANGELOG.md from all tags
            git-cliff --config cliff.toml --output CHANGELOG.md
          else
            echo "No previous tag found, generating from git commits"
            git log --pretty=format:"- %s" > /tmp/release_body.md || true
            git-cliff --config cliff.toml --output CHANGELOG.md
          fi
          echo "=== Release body preview ==="
          cat /tmp/release_body.md

      - name: Create or update Gitea release
        env:
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
          RELEASE_TAG: ${{ needs.autotag.outputs.release_tag }}
        run: |
          set -eu
          TAG="${RELEASE_TAG}"
          API="http://172.0.0.29:3000/api/v1/repos/$GITHUB_REPOSITORY"

          # Try to find an existing release for this tag
          RELEASE_ID=$(curl -s "$API/releases/tags/$TAG" \
            -H "Authorization: token $RELEASE_TOKEN" | jq -r '.id // empty')

          if [ -z "$RELEASE_ID" ]; then
            # First run: changelog job owns release creation so build jobs
            # never race against a missing release object
            echo "Creating release $TAG..."
            IS_PRERELEASE="false"
            if echo "$TAG" | grep -qE '-(rc|alpha|beta|pre|dev)'; then
              IS_PRERELEASE="true"
            fi
            RELEASE_ID=$(jq -n \
              --arg tag "$TAG" \
              --arg name "TFTSR $TAG" \
              --rawfile body /tmp/release_body.md \
              --argjson prerelease "$IS_PRERELEASE" \
              '{tag_name: $tag, name: $name, body: $body, draft: true, prerelease: $prerelease}' \
              | curl -sf -X POST "$API/releases" \
                  -H "Authorization: token $RELEASE_TOKEN" \
                  -H "Content-Type: application/json" \
                  --data @- \
              | jq -r '.id')
            echo "✓ Release created (id=$RELEASE_ID, prerelease=$IS_PRERELEASE)"
          else
            # Re-run: patch the body only
            echo "Updating existing release $TAG (id=$RELEASE_ID)..."
            jq -n --rawfile body /tmp/release_body.md '{body: $body}' \
              | curl -sf -X PATCH "$API/releases/$RELEASE_ID" \
                  -H "Authorization: token $RELEASE_TOKEN" \
                  -H "Content-Type: application/json" \
                  --data @-
            echo "✓ Release body updated"
          fi

          if [ -z "$RELEASE_ID" ] || [ "$RELEASE_ID" = "null" ]; then
            echo "ERROR: Failed to create or locate release for $TAG"
            exit 1
          fi

      - name: Commit CHANGELOG.md to master
        env:
          RELEASE_TAG: ${{ needs.autotag.outputs.release_tag }}
        run: |
          set -euo pipefail
          TAG="${RELEASE_TAG}"
          if ! echo "$TAG" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "ERROR: Unexpected tag format: $TAG"
            exit 1
          fi
          git add CHANGELOG.md
          # Only commit if CHANGELOG.md actually changed — avoids ambiguous
          # exit-code handling from 'git commit || echo' with set -e
          if git diff --staged --quiet; then
            echo "No CHANGELOG.md changes to commit"
          else
            git commit -m "chore: update CHANGELOG.md for ${TAG} [skip ci]"
          fi
          # HEAD:master works in detached HEAD state; 'git push origin master'
          # would fail because there is no local branch named master
          git push origin HEAD:master
          echo "✓ CHANGELOG.md committed to master"

      - name: Upload CHANGELOG.md as release asset
        env:
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
          RELEASE_TAG: ${{ needs.autotag.outputs.release_tag }}
        run: |
          set -eu
          TAG="${RELEASE_TAG}"
          API="http://172.0.0.29:3000/api/v1/repos/$GITHUB_REPOSITORY"
          RELEASE_ID=$(curl -sf "$API/releases/tags/$TAG" \
            -H "Authorization: token $RELEASE_TOKEN" | jq -r '.id')
          if [ -z "$RELEASE_ID" ] || [ "$RELEASE_ID" = "null" ]; then
            echo "ERROR: Could not find release for tag $TAG"
            exit 1
          fi
          # Delete existing asset if present to allow re-upload
          EXISTING_ID=$(curl -sf "$API/releases/$RELEASE_ID" \
            -H "Authorization: token $RELEASE_TOKEN" \
            | jq -r '.assets[]? | select(.name == "CHANGELOG.md") | .id')
          if [ -n "$EXISTING_ID" ]; then
            curl -sf -X DELETE "$API/releases/$RELEASE_ID/assets/$EXISTING_ID" \
              -H "Authorization: token $RELEASE_TOKEN"
          fi
          curl -sf -X POST "$API/releases/$RELEASE_ID/assets" \
            -H "Authorization: token $RELEASE_TOKEN" \
            -F "attachment=@CHANGELOG.md;filename=CHANGELOG.md"
          echo "✓ CHANGELOG.md uploaded"

  wiki-sync:
    runs-on: linux-amd64
    container:
      image: alpine:latest
    steps:
      - name: Install dependencies
        run: apk add --no-cache git

      - name: Checkout main repository
        run: |
          git init
          git remote add origin http://172.0.0.29:3000/sarman/tftsr-devops_investigation.git
          git fetch --depth=1 origin $GITHUB_SHA
          git checkout FETCH_HEAD

      - name: Configure git
        run: |
          git config --global user.email "actions@gitea.local"
          git config --global user.name "Gitea Actions"
          git config --global credential.helper ''

      - name: Clone and sync wiki
        env:
          WIKI_TOKEN: ${{ secrets.Wiki }}
        run: |
          cd /tmp
          if [ -n "$WIKI_TOKEN" ]; then
            WIKI_URL="http://${WIKI_TOKEN}@172.0.0.29:3000/sarman/tftsr-devops_investigation.wiki.git"
          else
            WIKI_URL="http://172.0.0.29:3000/sarman/tftsr-devops_investigation.wiki.git"
          fi

          if ! git clone "$WIKI_URL" wiki 2>/dev/null; then
            echo "Wiki doesn't exist yet, creating initial structure..."
            mkdir -p wiki
            cd wiki
            git init
            git checkout -b master
            echo "# Wiki" > Home.md
            git add Home.md
            git commit -m "Initial wiki commit"
            git remote add origin "$WIKI_URL"
          fi

          cd /tmp/wiki
          if [ -d "$GITHUB_WORKSPACE/docs/wiki" ]; then
            cp -v "$GITHUB_WORKSPACE"/docs/wiki/*.md . 2>/dev/null || echo "No wiki files to copy"
          fi

          git add -A
          if ! git diff --staged --quiet; then
            git commit -m "docs: sync from docs/wiki/ at commit ${GITHUB_SHA:0:8}"
            echo "Pushing to wiki..."
            if git push origin master; then
              echo "✓ Wiki successfully synced"
            else
              echo "⚠ Wiki push failed - check token permissions"
              exit 1
            fi
          else
            echo "No wiki changes to commit"
          fi

  build-linux-amd64:
    needs: autotag
    runs-on: linux-amd64
    container:
      image: 172.0.0.29:3000/sarman/tftsr-linux-amd64:rust1.88-node22
    steps:
      - name: Checkout
        run: |
          git init
          git remote add origin http://172.0.0.29:3000/sarman/tftsr-devops_investigation.git
          git fetch --depth=1 origin "$GITHUB_SHA"
          git checkout FETCH_HEAD
      - name: Cache cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry/index
            ~/.cargo/registry/cache
            ~/.cargo/git/db
          key: ${{ runner.os }}-cargo-linux-amd64-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-linux-amd64-
      - name: Cache npm
        uses: actions/cache@v4
        with:
          path: ~/.npm
          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-npm-
      - name: Build
        env:
          APPIMAGE_EXTRACT_AND_RUN: "1"
        run: |
          npm ci --legacy-peer-deps
          CI=true npx tauri build --target x86_64-unknown-linux-gnu
      - name: Upload artifacts
        env:
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
        run: |
          set -eu
          API="http://172.0.0.29:3000/api/v1/repos/$GITHUB_REPOSITORY"
          TAG=$(curl -s "$API/tags?limit=50" \
            -H "Authorization: token $RELEASE_TOKEN" | \
            jq -r '.[].name' | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | \
            sort -V | tail -1 || true)
          if [ -z "$TAG" ]; then
            echo "ERROR: Could not resolve release tag from repository tags."
            exit 1
          fi
          echo "Creating release for $TAG..."
          curl -sf -X POST "$API/releases" \
            -H "Authorization: token $RELEASE_TOKEN" \
            -H "Content-Type: application/json" \
            -d "{\"tag_name\":\"$TAG\",\"name\":\"TFTSR $TAG\",\"body\":\"Release $TAG\",\"draft\":false}" || true
          RELEASE_ID=$(curl -sf "$API/releases/tags/$TAG" \
            -H "Authorization: token $RELEASE_TOKEN" | jq -r '.id')
          if [ -z "$RELEASE_ID" ] || [ "$RELEASE_ID" = "null" ]; then
            echo "ERROR: Failed to get release ID for $TAG"
            exit 1
          fi
          echo "Release ID: $RELEASE_ID"
          ARTIFACTS=$(find src-tauri/target/x86_64-unknown-linux-gnu/release/bundle -type f \
            \( -name "*.deb" -o -name "*.rpm" \))
          if [ -z "$ARTIFACTS" ]; then
            echo "ERROR: No Linux amd64 artifacts were found to upload."
            exit 1
          fi
          printf '%s\n' "$ARTIFACTS" | while IFS= read -r f; do
            NAME=$(basename "$f")
            UPLOAD_NAME="linux-amd64-$NAME"
            echo "Uploading $UPLOAD_NAME..."
            EXISTING_IDS=$(curl -sf "$API/releases/$RELEASE_ID" \
              -H "Authorization: token $RELEASE_TOKEN" \
              | jq -r --arg name "$UPLOAD_NAME" '.assets[]? | select(.name == $name) | .id')
            if [ -n "$EXISTING_IDS" ]; then
              printf '%s\n' "$EXISTING_IDS" | while IFS= read -r id; do
                [ -n "$id" ] || continue
                echo "Deleting existing asset id=$id name=$UPLOAD_NAME before upload..."
                curl -sf -X DELETE "$API/releases/$RELEASE_ID/assets/$id" \
                  -H "Authorization: token $RELEASE_TOKEN"
              done
            fi
            RESP_FILE=$(mktemp)
            HTTP_CODE=$(curl -sS -o "$RESP_FILE" -w "%{http_code}" -X POST "$API/releases/$RELEASE_ID/assets" \
              -H "Authorization: token $RELEASE_TOKEN" \
              -F "attachment=@$f;filename=$UPLOAD_NAME")
            if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
              echo "✓ Uploaded $UPLOAD_NAME"
            else
              echo "✗ Upload failed for $UPLOAD_NAME (HTTP $HTTP_CODE)"
              python -c 'import pathlib,sys;print(pathlib.Path(sys.argv[1]).read_text(errors="replace")[:2000])' "$RESP_FILE"
              exit 1
            fi
          done

  build-windows-amd64:
    needs: autotag
    runs-on: linux-amd64
    container:
      image: 172.0.0.29:3000/sarman/tftsr-windows-cross:rust1.88-node22
    steps:
      - name: Checkout
        run: |
          git init
          git remote add origin http://172.0.0.29:3000/sarman/tftsr-devops_investigation.git
          git fetch --depth=1 origin "$GITHUB_SHA"
          git checkout FETCH_HEAD
      - name: Cache cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry/index
            ~/.cargo/registry/cache
            ~/.cargo/git/db
          key: ${{ runner.os }}-cargo-windows-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-windows-
      - name: Cache npm
        uses: actions/cache@v4
        with:
          path: ~/.npm
          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-npm-
      - name: Build
        env:
          CC_x86_64_pc_windows_gnu: x86_64-w64-mingw32-gcc
          CXX_x86_64_pc_windows_gnu: x86_64-w64-mingw32-g++
          AR_x86_64_pc_windows_gnu: x86_64-w64-mingw32-ar
          CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: x86_64-w64-mingw32-gcc
          OPENSSL_NO_VENDOR: "0"
          OPENSSL_STATIC: "1"
        run: |
          npm ci --legacy-peer-deps
          CI=true npx tauri build --target x86_64-pc-windows-gnu
      - name: Upload artifacts
        env:
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
        run: |
          set -eu
          API="http://172.0.0.29:3000/api/v1/repos/$GITHUB_REPOSITORY"
          TAG=$(curl -s "$API/tags?limit=50" \
            -H "Authorization: token $RELEASE_TOKEN" | \
            jq -r '.[].name' | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | \
            sort -V | tail -1 || true)
          if [ -z "$TAG" ]; then
            echo "ERROR: Could not resolve release tag from repository tags."
            exit 1
          fi
          echo "Creating release for $TAG..."
          curl -sf -X POST "$API/releases" \
            -H "Authorization: token $RELEASE_TOKEN" \
            -H "Content-Type: application/json" \
            -d "{\"tag_name\":\"$TAG\",\"name\":\"TFTSR $TAG\",\"body\":\"Release $TAG\",\"draft\":false}" || true
          RELEASE_ID=$(curl -sf "$API/releases/tags/$TAG" \
            -H "Authorization: token $RELEASE_TOKEN" | jq -r '.id')
          if [ -z "$RELEASE_ID" ] || [ "$RELEASE_ID" = "null" ]; then
            echo "ERROR: Failed to get release ID for $TAG"
            exit 1
          fi
          echo "Release ID: $RELEASE_ID"
          ARTIFACTS=$(find src-tauri/target/x86_64-pc-windows-gnu/release/bundle -type f \
            \( -name "*.exe" -o -name "*.msi" \) 2>/dev/null)
          if [ -z "$ARTIFACTS" ]; then
            echo "ERROR: No Windows amd64 artifacts were found to upload."
            exit 1
          fi
          printf '%s\n' "$ARTIFACTS" | while IFS= read -r f; do
            NAME=$(basename "$f")
            echo "Uploading $NAME..."
            EXISTING_IDS=$(curl -sf "$API/releases/$RELEASE_ID" \
              -H "Authorization: token $RELEASE_TOKEN" \
              | jq -r --arg name "$NAME" '.assets[]? | select(.name == $name) | .id')
            if [ -n "$EXISTING_IDS" ]; then
              printf '%s\n' "$EXISTING_IDS" | while IFS= read -r id; do
                [ -n "$id" ] || continue
                echo "Deleting existing asset id=$id name=$NAME before upload..."
                curl -sf -X DELETE "$API/releases/$RELEASE_ID/assets/$id" \
                  -H "Authorization: token $RELEASE_TOKEN"
              done
            fi
            RESP_FILE=$(mktemp)
            HTTP_CODE=$(curl -sS -o "$RESP_FILE" -w "%{http_code}" -X POST "$API/releases/$RELEASE_ID/assets" \
              -H "Authorization: token $RELEASE_TOKEN" \
              -F "attachment=@$f;filename=$NAME")
            if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
              echo "✓ Uploaded $NAME"
            else
              echo "✗ Upload failed for $NAME (HTTP $HTTP_CODE)"
              python -c 'import pathlib,sys;print(pathlib.Path(sys.argv[1]).read_text(errors="replace")[:2000])' "$RESP_FILE"
              exit 1
            fi
          done

  build-macos-arm64:
    needs: autotag
    runs-on: macos-arm64
    steps:
      - name: Checkout
        run: |
          git init
          git remote add origin http://172.0.0.29:3000/sarman/tftsr-devops_investigation.git
          git fetch --depth=1 origin "$GITHUB_SHA"
          git checkout FETCH_HEAD
      - name: Build
        env:
          MACOSX_DEPLOYMENT_TARGET: "11.0"
        run: |
          npm ci --legacy-peer-deps
          rustup target add aarch64-apple-darwin
          CI=true npx tauri build --target aarch64-apple-darwin --bundles app
          APP=$(find src-tauri/target/aarch64-apple-darwin/release/bundle/macos -maxdepth 1 -type d -name "*.app" | head -n 1)
          if [ -z "$APP" ]; then
            echo "ERROR: Could not find macOS app bundle"
            exit 1
          fi
          APP_NAME=$(basename "$APP" .app)
          codesign --deep --force --sign - "$APP"
          mkdir -p src-tauri/target/aarch64-apple-darwin/release/bundle/dmg
          DMG=src-tauri/target/aarch64-apple-darwin/release/bundle/dmg/${APP_NAME}.dmg
          hdiutil create -volname "$APP_NAME" -srcfolder "$APP" -ov -format UDZO "$DMG"
      - name: Upload artifacts
        env:
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
        run: |
          set -eu
          API="http://172.0.0.29:3000/api/v1/repos/$GITHUB_REPOSITORY"
          TAG=$(curl -s "$API/tags?limit=50" \
            -H "Authorization: token $RELEASE_TOKEN" | \
            jq -r '.[].name' | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | \
            sort -V | tail -1 || true)
          if [ -z "$TAG" ]; then
            echo "ERROR: Could not resolve release tag from repository tags."
            exit 1
          fi
          echo "Creating release for $TAG..."
          curl -sf -X POST "$API/releases" \
            -H "Authorization: token $RELEASE_TOKEN" \
            -H "Content-Type: application/json" \
            -d "{\"tag_name\":\"$TAG\",\"name\":\"TFTSR $TAG\",\"body\":\"Release $TAG\",\"draft\":false}" || true
          RELEASE_ID=$(curl -sf "$API/releases/tags/$TAG" \
            -H "Authorization: token $RELEASE_TOKEN" | jq -r '.id')
          if [ -z "$RELEASE_ID" ] || [ "$RELEASE_ID" = "null" ]; then
            echo "ERROR: Failed to get release ID for $TAG"
            exit 1
          fi
          echo "Release ID: $RELEASE_ID"
          ARTIFACTS=$(find src-tauri/target/aarch64-apple-darwin/release/bundle -type f -name "*.dmg")
          if [ -z "$ARTIFACTS" ]; then
            echo "ERROR: No macOS arm64 DMG artifacts were found to upload."
            exit 1
          fi
          printf '%s\n' "$ARTIFACTS" | while IFS= read -r f; do
            NAME=$(basename "$f")
            echo "Uploading $NAME..."
            EXISTING_IDS=$(curl -sf "$API/releases/$RELEASE_ID" \
              -H "Authorization: token $RELEASE_TOKEN" \
              | jq -r --arg name "$NAME" '.assets[]? | select(.name == $name) | .id')
            if [ -n "$EXISTING_IDS" ]; then
              printf '%s\n' "$EXISTING_IDS" | while IFS= read -r id; do
                [ -n "$id" ] || continue
                echo "Deleting existing asset id=$id name=$NAME before upload..."
                curl -sf -X DELETE "$API/releases/$RELEASE_ID/assets/$id" \
                  -H "Authorization: token $RELEASE_TOKEN"
              done
            fi
            RESP_FILE=$(mktemp)
            HTTP_CODE=$(curl -sS -o "$RESP_FILE" -w "%{http_code}" -X POST "$API/releases/$RELEASE_ID/assets" \
              -H "Authorization: token $RELEASE_TOKEN" \
              -F "attachment=@$f;filename=$NAME")
            if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
              echo "✓ Uploaded $NAME"
            else
              echo "✗ Upload failed for $NAME (HTTP $HTTP_CODE)"
              python -c 'import pathlib,sys;print(pathlib.Path(sys.argv[1]).read_text(errors="replace")[:2000])' "$RESP_FILE"
              exit 1
            fi
          done

  build-linux-arm64:
    needs: autotag
    runs-on: linux-amd64
    container:
      image: 172.0.0.29:3000/sarman/tftsr-linux-arm64:rust1.88-node22
    steps:
      - name: Checkout
        run: |
          git init
          git remote add origin http://172.0.0.29:3000/sarman/tftsr-devops_investigation.git
          git fetch --depth=1 origin "$GITHUB_SHA"
          git checkout FETCH_HEAD
      - name: Cache cargo registry
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry/index
            ~/.cargo/registry/cache
            ~/.cargo/git/db
          key: ${{ runner.os }}-cargo-arm64-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-arm64-
      - name: Cache npm
        uses: actions/cache@v4
        with:
          path: ~/.npm
          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-npm-
      - name: Build
        env:
          CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
          CXX_aarch64_unknown_linux_gnu: aarch64-linux-gnu-g++
          AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
          PKG_CONFIG_SYSROOT_DIR: /usr/aarch64-linux-gnu
          PKG_CONFIG_PATH: /usr/lib/aarch64-linux-gnu/pkgconfig
          PKG_CONFIG_ALLOW_CROSS: "1"
          OPENSSL_NO_VENDOR: "0"
          OPENSSL_STATIC: "1"
          APPIMAGE_EXTRACT_AND_RUN: "1"
        run: |
          npm ci --legacy-peer-deps
          CI=true npx tauri build --target aarch64-unknown-linux-gnu --bundles deb,rpm
      - name: Upload artifacts
        env:
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
        run: |
          set -eu
          API="http://172.0.0.29:3000/api/v1/repos/$GITHUB_REPOSITORY"
          TAG=$(curl -s "$API/tags?limit=50" \
            -H "Authorization: token $RELEASE_TOKEN" | \
            jq -r '.[].name' | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | \
            sort -V | tail -1 || true)
          if [ -z "$TAG" ]; then
            echo "ERROR: Could not resolve release tag from repository tags."
            exit 1
          fi
          echo "Creating release for $TAG..."
          curl -sf -X POST "$API/releases" \
            -H "Authorization: token $RELEASE_TOKEN" \
            -H "Content-Type: application/json" \
            -d "{\"tag_name\":\"$TAG\",\"name\":\"TFTSR $TAG\",\"body\":\"Release $TAG\",\"draft\":false}" || true
          RELEASE_ID=$(curl -sf "$API/releases/tags/$TAG" \
            -H "Authorization: token $RELEASE_TOKEN" | jq -r '.id')
          if [ -z "$RELEASE_ID" ] || [ "$RELEASE_ID" = "null" ]; then
            echo "ERROR: Failed to get release ID for $TAG"
            exit 1
          fi
          echo "Release ID: $RELEASE_ID"
          ARTIFACTS=$(find src-tauri/target/aarch64-unknown-linux-gnu/release/bundle -type f \
            \( -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" \))
          if [ -z "$ARTIFACTS" ]; then
            echo "ERROR: No Linux arm64 artifacts were found to upload."
            exit 1
          fi
          printf '%s\n' "$ARTIFACTS" | while IFS= read -r f; do
            NAME=$(basename "$f")
            UPLOAD_NAME="linux-arm64-$NAME"
            echo "Uploading $UPLOAD_NAME..."
            EXISTING_IDS=$(curl -sf "$API/releases/$RELEASE_ID" \
              -H "Authorization: token $RELEASE_TOKEN" \
              | jq -r --arg name "$UPLOAD_NAME" '.assets[]? | select(.name == $name) | .id')
            if [ -n "$EXISTING_IDS" ]; then
              printf '%s\n' "$EXISTING_IDS" | while IFS= read -r id; do
                [ -n "$id" ] || continue
                echo "Deleting existing asset id=$id name=$UPLOAD_NAME before upload..."
                curl -sf -X DELETE "$API/releases/$RELEASE_ID/assets/$id" \
                  -H "Authorization: token $RELEASE_TOKEN"
              done
            fi
            RESP_FILE=$(mktemp)
            HTTP_CODE=$(curl -sS -o "$RESP_FILE" -w "%{http_code}" -X POST "$API/releases/$RELEASE_ID/assets" \
              -H "Authorization: token $RELEASE_TOKEN" \
              -F "attachment=@$f;filename=$UPLOAD_NAME")
            if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
              echo "✓ Uploaded $UPLOAD_NAME"
            else
              echo "✗ Upload failed for $UPLOAD_NAME (HTTP $HTTP_CODE)"
              python -c 'import pathlib,sys;print(pathlib.Path(sys.argv[1]).read_text(errors="replace")[:2000])' "$RESP_FILE"
              exit 1
            fi
          done
