plugin.yml

name: Plugin

on:
  workflow_dispatch:
  workflow_call:
    inputs:
      version:
        type: string
        description: "Version for the build, without v prefix"
        required: false

jobs:
  lint:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./plugin
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Installing dependencies
        uses: ./.github/actions/install
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Task generate
        run: task generate

      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@v6
        with:
          version: v1.64
          args: --timeout=3m
          working-directory: ./plugin

      - name: Install gofumpt
        run: go install mvdan.cc/gofumpt@v0.7.0

      - name: Run gofumpt
        run: |
          ERRORS=$(gofumpt -l . | wc -l)
          if [[ "$ERRORS" != "0" ]]; then
            echo "following files are not gofumpted:"
            gofumpt -l .
            exit 1
          fi

  build:
    name: Build plugin
    strategy:
      matrix:
        include:
          - os: ubuntu-24.04
            arch: amd64
            target: windows
            ext: .exe
          - os: ubuntu-24.04
            arch: amd64
            target: linux
          - os: ubuntu-24.04
            arch: arm64
            target: linux
          - os: macos-15
            arch: amd64
            target: darwin
          - os: macos-15
            arch: arm64
            target: darwin

    runs-on: ${{ matrix.os }}
    defaults:
      run:
        working-directory: ./plugin
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Installing dependencies
        uses: ./.github/actions/install
        with:
          os: ${{ matrix.os }}
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Plugin Go Dependencies
        run: task install
        shell: bash

      - name: Go Generate Plugin
        run: task generate
        shell: bash

      - name: Check if VERSION exists
        shell: bash
        id: check_version
        run: |
          if [ ! -z "${{ inputs.version }}" ]; then
            echo "PRODUCTION=true" >> $GITHUB_ENV
          fi

      - name: Download server artifacts
        uses: actions/download-artifact@v4
        with:
          name: deweb-server_${{ matrix.target }}_${{ matrix.arch }}
          path: server/build

      - name: Rename server binary
        shell: bash
        run: |
          mkdir -p build
          mv ../server/build/deweb-server_${{ matrix.target }}_${{ matrix.arch }}${{ matrix.ext }} build/deweb-server${{ matrix.ext }}
          chmod +x build/deweb-server${{ matrix.ext }}

      - name: Build Plugin
        shell: bash
        run: task build
        env:
          OS: ${{ matrix.target }}
          ARCH: ${{ matrix.arch }}

      - name: Sign Macos binary
        uses: massalabs/massa/.github/actions/sign-macos@ccc3f02e34544f722634a6fb7732cc4bb515e90b
        if: ${{ runner.os == 'macOS' }}
        with:
          paths: "plugin/build/deweb-plugin"
          certificate-p12-base64: ${{ secrets.APPLE_CERTIFICATE_P12_BASE64 }}
          certificate-password: ${{ secrets.APPLE_CERTIFICATE_P12_PASSWORD }}
          signing-identity: ${{ vars.APPLE_DEVELOPER_ID_APPLICATION }}

      - name: Rename Plugin artifact
        run: mv build/deweb-plugin${{ matrix.ext }} deweb-plugin_${{ matrix.target }}_${{ matrix.arch }}${{ matrix.ext }}

      - name: Create platform directory with all required files
        shell: bash
        run: |
          mkdir -p platform_${{ matrix.target }}_${{ matrix.arch }}
          cp deweb-plugin_${{ matrix.target }}_${{ matrix.arch }}${{ matrix.ext }} platform_${{ matrix.target }}_${{ matrix.arch }}/
          cp build/deweb-server${{ matrix.ext }} platform_${{ matrix.target }}_${{ matrix.arch }}/
          cp favicon.png platform_${{ matrix.target }}_${{ matrix.arch }}/
          cp manifest.json platform_${{ matrix.target }}_${{ matrix.arch }}/

      - name: Create zip package
        shell: bash
        run: |
          cd platform_${{ matrix.target }}_${{ matrix.arch }}
          zip -r ../deweb-plugin_${{ matrix.target }}_${{ matrix.arch }}.zip *

      - name: Notarize zip for MacOS ${{ matrix.arch }}
        uses: massalabs/massa/.github/actions/notarize-macos@ccc3f02e34544f722634a6fb7732cc4bb515e90b
        if: matrix.target == 'darwin'
        with:
          paths: "./plugin/deweb-plugin_${{ matrix.target }}_${{ matrix.arch }}.zip"
          apple-id: ${{ secrets.APPLE_ID }}
          apple-team-id: ${{ secrets.APPLE_TEAM_ID }}
          apple-app-password: ${{ secrets.APPLE_APP_PASSWORD }}

      - name: Upload Plugin zip package
        uses: actions/upload-artifact@v4
        with:
          name: deweb-plugin_${{ matrix.target }}_${{ matrix.arch }}
          path: plugin/deweb-plugin_${{ matrix.target }}_${{ matrix.arch }}.zip

  sign-windows-binary:
    name: Sign Windows binary
    needs: build
    runs-on: windows-latest
    permissions:
      contents: write
      id-token: write
    steps:
      - name: Download Windows artifacts
        uses: actions/download-artifact@v4
        with:
          name: deweb-plugin_windows_amd64
          path: .

      - name: Unzip Plugin zip package
        shell: bash
        run: |
          unzip deweb-plugin_windows_amd64.zip -d windows-package

      - name: Sign Windows binary
        uses: massalabs/station/.github/actions/sign-file-digicert@413d4c0bbd042d5e797fbb66bcd2c96be5c3e71a
        with:
          files: ./windows-package/deweb-plugin_windows_amd64.exe
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
          SM_CERT_FINGERPRINT: ${{ secrets.SM_CERT_FINGERPRINT }}
          SM_HOST: ${{ secrets.SM_HOST }}

      - name: zip again
        shell: pwsh
        run: |
          Compress-Archive -Path "windows-package\*" -DestinationPath "deweb-plugin_windows_amd64.zip" -Force

      - name: Upload signed Windows zip (overwrite original)
        uses: actions/upload-artifact@v4
        with:
          name: deweb-plugin_windows_amd64
          path: ./deweb-plugin_windows_amd64.zip
          overwrite: true