name: Desktop testing build

# Builds UNSIGNED desktop artifacts on a `0.0.0-testing-<sha>` tag and attaches
# them to a GitHub prerelease, so the packaging pipeline can be exercised
# end-to-end before any signing/notarization secrets exist.
#
# Per OS the current electron-forge makers produce:
#   - macOS   → .zip          (the .dmg maker is a follow-up)
#   - Windows → Setup.exe + .nupkg + RELEASES (Squirrel)
#   - Linux   → .deb and .rpm
#
# Each OS builds on its own native runner because build-daemon.mjs compiles the
# bundled `ao` daemon for the build host's platform; cross-OS packaging would
# ship the wrong daemon (issues #235/#256). The macOS runner is arm64, so the
# macOS artifact is arm64-only until per-arch builds are wired.
#
# Signing is intentionally OFF (no CSC_LINK / APPLE_ID / Windows cert), so these
# builds do NOT pass Gatekeeper/SmartScreen. They are for pipeline validation,
# not distribution.

# Disabled: the Linux-only `linux-testing-build.yml` owns the 0.0.0-testing-* tag
# for now. Re-enable by restoring the `push.tags` trigger below when macOS/Windows
# testing builds are wanted again.
on:
  workflow_dispatch:
  # push:
  #   tags:
  #     - "0.0.0-testing-*"

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, windows-latest, ubuntu-latest]
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      # The daemon is compiled by build-daemon.mjs during premake, so the Go
      # toolchain must be present and pinned on every runner.
      - uses: actions/setup-go@v5
        with:
          go-version-file: backend/go.mod
          cache-dependency-path: backend/go.sum
      # The Linux rpm maker needs rpmbuild, which ubuntu-latest does not ship.
      - name: Install rpm tooling (Linux)
        if: runner.os == 'Linux'
        run: sudo apt-get update && sudo apt-get install -y rpm
      - run: npm ci
      - name: Build artifacts (unsigned)
        run: npm run make
      - name: Publish artifacts to the tag's GitHub release
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          # Create the prerelease once. Parallel matrix jobs race here, so a
          # second job's "already exists" failure is expected and ignored.
          gh release create "$TAG" --prerelease --title "$TAG" \
            --notes "Unsigned desktop testing build (pipeline validation only — not signed or notarized)." \
            || true
          # Upload every maker output. NUL-delimited to survive spaces in the
          # app name ("Agent Orchestrator-..."); --clobber makes re-runs idempotent.
          find out/make -type f -print0 | while IFS= read -r -d '' f; do
            echo "uploading: $f"
            gh release upload "$TAG" "$f" --clobber
          done