name: Universal CI/CD Release Matrix

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: write

# ── Global defaults ─────────────────────────────────────────────────────────
env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  RUST_BACKTRACE: short

jobs:
  publish-release-matrix:
    name: Release for ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # ── Windows ──────────────────────────────────────────────────────
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            artifact_name: ostp.exe
            release_name: ostp-windows-amd64.zip
            tun2socks_arch: windows-amd64
            wintun_arch: amd64

          - os: windows-latest
            target: i686-pc-windows-msvc
            artifact_name: ostp.exe
            release_name: ostp-windows-386.zip
            tun2socks_arch: windows-386
            wintun_arch: x86

          - os: windows-latest
            target: aarch64-pc-windows-msvc
            artifact_name: ostp.exe
            release_name: ostp-windows-arm64.zip
            tun2socks_arch: windows-arm64
            wintun_arch: arm64

          # ── macOS ─────────────────────────────────────────────────────────
          - os: macos-latest
            target: x86_64-apple-darwin
            artifact_name: ostp
            release_name: ostp-darwin-amd64.tar.gz
            tun2socks_arch: darwin-amd64

          - os: macos-latest
            target: aarch64-apple-darwin
            artifact_name: ostp
            release_name: ostp-darwin-arm64.tar.gz
            tun2socks_arch: darwin-arm64

          # ── Linux native ──────────────────────────────────────────────────
          - os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            artifact_name: ostp
            release_name: ostp-linux-amd64.tar.gz
            tun2socks_arch: linux-amd64

          - os: ubuntu-latest
            target: i686-unknown-linux-musl
            artifact_name: ostp
            release_name: ostp-linux-386.tar.gz
            tun2socks_arch: linux-386
            use_cross: true

          # ── Linux cross ───────────────────────────────────────────────────
          - os: ubuntu-latest
            target: aarch64-unknown-linux-musl
            artifact_name: ostp
            release_name: ostp-linux-arm64.tar.gz
            tun2socks_arch: linux-arm64
            use_cross: true

          - os: ubuntu-latest
            target: armv7-unknown-linux-musleabihf
            artifact_name: ostp
            release_name: ostp-linux-armv7.tar.gz
            tun2socks_arch: linux-armv7
            use_cross: true

          - os: ubuntu-latest
            target: x86_64-unknown-freebsd
            artifact_name: ostp
            release_name: ostp-freebsd-amd64.tar.gz
            tun2socks_arch: freebsd-amd64
            use_cross: true

          - os: ubuntu-latest
            target: mipsel-unknown-linux-musl
            artifact_name: ostp
            release_name: ostp-linux-mipsle.tar.gz
            tun2socks_arch: linux-mipsle-softfloat
            use_cross: true
            toolchain: nightly

          - os: ubuntu-latest
            target: riscv64gc-unknown-linux-gnu
            artifact_name: ostp
            release_name: ostp-linux-riscv64.tar.gz
            tun2socks_arch: linux-riscv64
            use_cross: true



    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      # ── Frontend Build ─────────────────────────────────────────────────────
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
      - name: Build Web Panel
        working-directory: ostp-control
        run: |
          npm install
          npm run build

      # ── Rust toolchain ─────────────────────────────────────────────────────
      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ matrix.toolchain || 'stable' }}
          targets: ${{ !matrix.use_cross && matrix.target || '' }}

      # ── Cargo cache (shared per target) ───────────────────────────────────
      - name: Restore Cargo cache
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: cargo-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            cargo-${{ matrix.target }}-

      # ── MUSL tools for native Linux musl builds ────────────────────────────
      - name: Install musl-tools
        if: ${{ matrix.os == 'ubuntu-latest' && !matrix.use_cross }}
        run: sudo apt-get update && sudo apt-get install -y musl-tools

      # ── Native build ───────────────────────────────────────────────────────
      - name: Build (native)
        if: ${{ !matrix.use_cross }}
        shell: bash
        run: cargo build --release --target ${{ matrix.target }} --bin ostp

      # ── Cross build ────────────────────────────────────────────────────────
      - name: Restore cross binary cache
        if: ${{ matrix.use_cross }}
        id: cross-cache
        uses: actions/cache@v4
        with:
          path: ~/.cargo/bin/cross
          key: cross-bin-${{ runner.os }}-v1

      - name: Install cross (if not cached)
        if: ${{ matrix.use_cross && steps.cross-cache.outputs.cache-hit != 'true' }}
        run: cargo install cross --git https://github.com/cross-rs/cross.git --locked

      - name: Build (cross)
        if: ${{ matrix.use_cross }}
        run: cross build --release --target ${{ matrix.target }} --bin ostp

      # ── Driver dependencies ────────────────────────────────────────────────
      - name: Download tun2socks + wintun (Windows)
        if: ${{ matrix.os == 'windows-latest' && matrix.tun2socks_arch }}
        shell: pwsh
        run: |
          $ProgressPreference = 'SilentlyContinue'
          $dir = "target/${{ matrix.target }}/release"
          Invoke-WebRequest -Uri "https://github.com/xjasonlyu/tun2socks/releases/download/v2.6.0/tun2socks-${{ matrix.tun2socks_arch }}.zip" -OutFile "$dir/t2s.zip"
          Expand-Archive "$dir/t2s.zip" -DestinationPath "$dir/t2s_tmp" -Force
          Get-ChildItem "$dir/t2s_tmp" -Filter "*.exe" -Recurse | Select-Object -First 1 | Copy-Item -Destination "$dir/tun2socks.exe"
          Invoke-WebRequest -Uri "https://www.wintun.net/builds/wintun-0.14.1.zip" -OutFile "$dir/wt.zip"
          Expand-Archive "$dir/wt.zip" -DestinationPath "$dir/wt_tmp" -Force
          Get-ChildItem "$dir/wt_tmp" -Filter "wintun.dll" -Recurse | Where-Object { $_.FullName -match 'bin[\\/]${{ matrix.wintun_arch }}[\\/]' } | Copy-Item -Destination "$dir/"
          Remove-Item "$dir/t2s.zip","$dir/t2s_tmp","$dir/wt.zip","$dir/wt_tmp" -Recurse -Force

      - name: Download tun2socks (Unix)
        if: ${{ matrix.os != 'windows-latest' && matrix.tun2socks_arch }}
        shell: bash
        run: |
          dir="target/${{ matrix.target }}/release"
          URL="https://github.com/xjasonlyu/tun2socks/releases/download/v2.6.0/tun2socks-${{ matrix.tun2socks_arch }}.zip"
          curl -fsSL "$URL" -o "$dir/t2s.zip" || exit 0
          unzip -o "$dir/t2s.zip" -d "$dir/t2s_tmp"
          find "$dir/t2s_tmp" -type f -name "tun2socks*" ! -name "*.zip" | head -1 | xargs -I{} cp {} "$dir/tun2socks"
          chmod +x "$dir/tun2socks" 2>/dev/null || true
          rm -rf "$dir/t2s.zip" "$dir/t2s_tmp"

      # ── Package ────────────────────────────────────────────────────────────
      - name: Package (Windows)
        if: ${{ matrix.os == 'windows-latest' }}
        shell: pwsh
        run: |
          $dir = "target/${{ matrix.target }}/release"
          $files = @("ostp.exe")
          if (Test-Path "$dir/tun2socks.exe") { $files += "tun2socks.exe" }
          if (Test-Path "$dir/wintun.dll")    { $files += "wintun.dll" }
          Push-Location $dir
          Compress-Archive -Path $files -DestinationPath "../../../${{ matrix.release_name }}" -Force
          Pop-Location

      - name: Package (Unix)
        if: ${{ matrix.os != 'windows-latest' }}
        run: |
          dir="target/${{ matrix.target }}/release"
          FILES="${{ matrix.artifact_name }}"
          [ -f "$dir/tun2socks" ] && FILES="$FILES tun2socks"
          tar -czf "${{ matrix.release_name }}" -C "$dir" $FILES

      # ── Upload ─────────────────────────────────────────────────────────────
      - name: Upload to GitHub Release
        if: ${{ startsWith(github.ref, 'refs/tags/') }}
        uses: softprops/action-gh-release@v2
        with:
          files: ${{ matrix.release_name }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-windows-gui:
    name: Build Windows GUI (Tauri)
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-pc-windows-msvc

      - name: Install Tauri CLI
        run: npm install -g @tauri-apps/cli

      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: cargo-windows-gui-${{ hashFiles('**/Cargo.lock') }}

      - name: Download wintun and tun2socks
        shell: pwsh
        run: |
          $ProgressPreference = 'SilentlyContinue'
          
          # Download tun2socks
          New-Item -ItemType Directory -Force -Path "t2s_tmp"
          Invoke-WebRequest -Uri "https://github.com/xjasonlyu/tun2socks/releases/download/v2.6.0/tun2socks-windows-amd64.zip" -OutFile "t2s_tmp/t2s.zip"
          Expand-Archive "t2s_tmp/t2s.zip" -DestinationPath "t2s_tmp/ext" -Force
          Get-ChildItem "t2s_tmp/ext" -Filter "*.exe" -Recurse | Select-Object -First 1 | Copy-Item -Destination "t2s_tmp/tun2socks-windows-amd64.exe" -Force
          
          # Download wintun
          New-Item -ItemType Directory -Force -Path "target/release"
          Invoke-WebRequest -Uri "https://www.wintun.net/builds/wintun-0.14.1.zip" -OutFile "target/release/wt.zip"
          Expand-Archive "target/release/wt.zip" -DestinationPath "target/release/wt_tmp" -Force
          Get-ChildItem "target/release/wt_tmp" -Filter "wintun.dll" -Recurse | Where-Object { $_.FullName -match 'bin[\\/]amd64[\\/]' } | Copy-Item -Destination "target/release/wintun.dll" -Force

      - name: Build Tauri App
        working-directory: ostp-gui
        run: |
          npm install
          npm run build:installer

      - name: Rename Installer
        shell: pwsh
        run: |
          $installer = Get-ChildItem "ostp-gui/src-tauri/target/release/bundle/nsis/*.exe" | Select-Object -First 1
          if ($installer) {
            Rename-Item -Path $installer.FullName -NewName "ostp-windows-installer.exe"
            Write-Host "Renamed installer to ostp-windows-installer.exe"
          }

      - name: Upload to GitHub Release
        if: ${{ startsWith(github.ref, 'refs/tags/') }}
        uses: softprops/action-gh-release@v2
        with:
          files: ostp-gui/src-tauri/target/release/bundle/nsis/ostp-windows-installer.exe
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-android:
    name: Build Android Client (Flutter)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Java
        uses: actions/setup-java@v3
        with:
          distribution: 'zulu'
          java-version: '17'

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: '3.19.0'
          channel: 'stable'

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-linux-android

      - name: Setup Android NDK
        uses: nttld/setup-ndk@v1
        with:
          ndk-version: r26b

      - name: Install cargo-ndk
        run: cargo install cargo-ndk

      - name: Build Android APK
        shell: pwsh
        working-directory: ostp-flutter
        run: ./build.ps1

      - name: Upload to GitHub Release
        if: ${{ startsWith(github.ref, 'refs/tags/') }}
        uses: softprops/action-gh-release@v2
        with:
          files: ostp-flutter/ostp-client-release.apk
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}