cd.yml

name: Continuous Deployment

permissions:
  contents: read

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always
  BINARY_NAME: spotatui

jobs:
  build:
    name: Build ${{ matrix.target }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # Multi-source features (local-files, subsonic, internet-radio, youtube, qobuz)
          # ship on all three platforms: they share the rodio output engine, which
          # is now opened on macOS too (the #9/#20 crashes were librespot's own
          # older rodio backend, not this one — librespot still uses portaudio
          # there, which is why `portaudio-backend` stays on the macOS rows).
          # The youtube source needs a yt-dlp binary at runtime (ffmpeg
          # recommended); without one it shows an actionable error.
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            artifact_prefix: linux-x86_64 # most Linux distros
            binary_postfix: ""
            audio_features: "audio-viz,mpris,local-files,subsonic,internet-radio,youtube,qobuz"
          - os: ubuntu-24.04-arm # free native ARM64 runner for public repos
            target: aarch64-unknown-linux-gnu
            artifact_prefix: linux-aarch64 # Raspberry Pi 4/5, ARM servers, Asahi Linux
            binary_postfix: ""
            audio_features: "audio-viz,mpris,local-files,subsonic,internet-radio,youtube,qobuz"
          - os: macos-15-intel # Intel runner for x86_64 (available until Aug 2027)
            target: x86_64-apple-darwin
            artifact_prefix: macos-x86_64
            binary_postfix: ""
            audio_features: "audio-viz-cpal,portaudio-backend,macos-media,local-files,subsonic,internet-radio,youtube,qobuz"
          - os: macos-latest # Apple Silicon runner for aarch64
            target: aarch64-apple-darwin
            artifact_prefix: macos-aarch64
            binary_postfix: ""
            audio_features: "audio-viz-cpal,portaudio-backend,macos-media,local-files,subsonic,internet-radio,youtube,qobuz"
          - os: windows-latest
            target: x86_64-pc-windows-msvc
            artifact_prefix: windows-x86_64
            binary_postfix: ".exe"
            audio_features: "audio-viz-cpal,windows-media,local-files,subsonic,internet-radio,youtube,qobuz"

    steps:
      - name: Checkout sources
        uses: actions/checkout@v7

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Install Linux dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y -qq pkg-config libssl-dev libxcb1-dev libxcb-render0-dev libxcb-shape0-dev libxcb-xfixes0-dev libpipewire-0.3-dev libspa-0.2-dev libasound2-dev

      - name: Install cargo-deb
        if: runner.os == 'Linux'
        run: cargo install cargo-deb --locked

      - name: Install macOS dependencies
        if: runner.os == 'macOS'
        run: brew install openssl@3 portaudio

      - name: Build release binary
        run: |
          if [ -z "${{ matrix.audio_features }}" ]; then
            cargo build --release --target ${{ matrix.target }} --no-default-features --features telemetry,tui,streaming,discord-rpc,cover-art,self-update,scripting,mcp-server,ai-dj
          else
            cargo build --release --target ${{ matrix.target }} --no-default-features --features telemetry,tui,streaming,discord-rpc,cover-art,self-update,scripting,mcp-server,ai-dj,${{ matrix.audio_features }}
          fi
        shell: bash

      - name: Package binary (Unix)
        if: runner.os != 'Windows'
        shell: bash
        run: |
          cd target/${{ matrix.target }}/release
          BINARY=${{ env.BINARY_NAME }}${{ matrix.binary_postfix }}
          strip $BINARY || true
          RELEASE_NAME=${{ env.BINARY_NAME }}-${{ matrix.artifact_prefix }}
          tar czvf ../../../$RELEASE_NAME.tar.gz $BINARY
          cd ../../..
          shasum -a 256 $RELEASE_NAME.tar.gz > $RELEASE_NAME.tar.gz.sha256

      - name: Package Debian (.deb)
        if: runner.os == 'Linux'
        shell: bash
        run: |
          cargo deb --no-build --target ${{ matrix.target }}
          DEB_PATH=$(ls target/${{ matrix.target }}/debian/*.deb)
          cp "$DEB_PATH" .
          sha256sum "$(basename "$DEB_PATH")" > "$(basename "$DEB_PATH").sha256"

      - name: Package binary (Windows)
        if: runner.os == 'Windows'
        shell: bash
        run: |
          cd target/${{ matrix.target }}/release
          BINARY=${{ env.BINARY_NAME }}${{ matrix.binary_postfix }}
          RELEASE_NAME=${{ env.BINARY_NAME }}-${{ matrix.artifact_prefix }}
          7z a ../../../$RELEASE_NAME.zip $BINARY
          cd ../../..
          certutil -hashfile $RELEASE_NAME.zip sha256 | grep -E [A-Fa-f0-9]{64} > $RELEASE_NAME.zip.sha256

      - name: Upload artifact (Unix)
        if: runner.os != 'Windows'
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.BINARY_NAME }}-${{ matrix.artifact_prefix }}
          path: |
            ${{ env.BINARY_NAME }}-${{ matrix.artifact_prefix }}.tar.gz
            ${{ env.BINARY_NAME }}-${{ matrix.artifact_prefix }}.tar.gz.sha256

      - name: Upload artifact (Linux .deb)
        if: runner.os == 'Linux'
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.BINARY_NAME }}-${{ matrix.artifact_prefix }}-deb
          path: |
            *.deb
            *.deb.sha256

      - name: Upload artifact (Windows)
        if: runner.os == 'Windows'
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.BINARY_NAME }}-${{ matrix.artifact_prefix }}
          path: |
            ${{ env.BINARY_NAME }}-${{ matrix.artifact_prefix }}.zip
            ${{ env.BINARY_NAME }}-${{ matrix.artifact_prefix }}.zip.sha256

  release:
    name: Create GitHub Release
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Checkout sources
        uses: actions/checkout@v7

      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts
          merge-multiple: true

      - name: Resolve .deb file names
        id: deb
        # cargo-deb names the package from Cargo.toml, not from the tag, so the
        # download links must use the file names that were built.
        run: |
          for arch in amd64 arm64; do
            f=$(find artifacts -maxdepth 1 -type f -name "spotatui_*_${arch}.deb" -print -quit)
            if [ -z "$f" ]; then
              echo "No ${arch} .deb found in artifacts/" >&2
              exit 1
            fi
            echo "${arch}=$(basename "$f")" >> "$GITHUB_OUTPUT"
          done

      - name: Create Release
        uses: softprops/action-gh-release@v3
        with:
          files: artifacts/*
          generate_release_notes: true
          prerelease: ${{ contains(github.ref_name, '-') }}
          body: |
            ## Downloads

            - **Windows 10/11 (64-bit)** → [Download spotatui-windows-x86_64.zip](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/spotatui-windows-x86_64.zip)
            - **Linux (Ubuntu, Arch, Fedora, etc.)** → [Download spotatui-linux-x86_64.tar.gz](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/spotatui-linux-x86_64.tar.gz)
            - **Linux ARM64 (Raspberry Pi 4/5, ARM servers)** → [Download spotatui-linux-aarch64.tar.gz](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/spotatui-linux-aarch64.tar.gz)
            - **Debian/Ubuntu (amd64)** → [Download .deb](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/${{ steps.deb.outputs.amd64 }})
            - **Debian/Ubuntu (arm64)** → [Download .deb](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/${{ steps.deb.outputs.arm64 }})
            - **macOS with Intel CPU** → [Download spotatui-macos-x86_64.tar.gz](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/spotatui-macos-x86_64.tar.gz)
            - **macOS with Apple Silicon (M1/M2/M3)** → [Download spotatui-macos-aarch64.tar.gz](https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/spotatui-macos-aarch64.tar.gz)

            Or just run the one-line installer: `curl -fsSL https://spotatui.com/install.sh | bash` (macOS/Linux) or `irm https://spotatui.com/install.ps1 | iex` (Windows).

            Checksums (`.sha256`) are optional and only needed if you want to verify the download.

            The Linux, macOS, and Windows builds include the extra music sources (Local Files, Subsonic, Internet Radio, YouTube, Qobuz). The YouTube source needs [yt-dlp](https://github.com/yt-dlp/yt-dlp) installed (ffmpeg recommended).

            To update use "spotatui update --install" or use your package manager of choice.
          draft: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upate Nix Version Reference
        id: nix_version
        run: |
          OLD_VERSION=$(grep -oP 'version\s*=\s*"\K[^"]+' flake.nix)
          echo "Version: $OLD_VERSION"
          NEW_VERSION=$(grep '^version = ' Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
          echo "Version: $NEW_VERSION"
          sed -i "s/version *= *\"$OLD_VERSION\"/version = \"$NEW_VERSION\"/" flake.nix

  publish-cargo:
    name: Publish to crates.io
    needs: release
    runs-on: ubuntu-latest
    if: ${{ !contains(github.ref_name, '-') }}
    steps:
      - name: Checkout sources
        uses: actions/checkout@v7

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y -qq pkg-config libssl-dev libxcb1-dev libxcb-render0-dev libxcb-shape0-dev libxcb-xfixes0-dev libasound2-dev

      - name: Publish to crates.io
        run: cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }} --allow-dirty

  publish-aur:
    name: Publish to AUR
    needs: release
    runs-on: ubuntu-latest
    if: ${{ !contains(github.ref_name, '-') }}
    steps:
      - name: Checkout sources
        uses: actions/checkout@v7

      - name: Extract version
        id: version
        run: |
          VERSION=$(grep '^version = ' Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "Version: $VERSION"

      - name: Calculate SHA256
        id: sha256
        run: |
          TARBALL_URL="https://github.com/${{ github.repository }}/archive/refs/tags/v${{ steps.version.outputs.version }}.tar.gz"
          SHA256=$(curl -sL "$TARBALL_URL" | sha256sum | awk '{print $1}')
          echo "sha256=$SHA256" >> $GITHUB_OUTPUT
          echo "SHA256: $SHA256"

      - name: Setup SSH for AUR
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.AUR_SSH_PRIVATE_KEY }}" > ~/.ssh/aur
          chmod 600 ~/.ssh/aur
          ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts
          git config --global user.name "${{ secrets.AUR_USERNAME }}"
          git config --global user.email "${{ secrets.AUR_EMAIL }}"

      - name: Clone AUR repository
        run: |
          GIT_SSH_COMMAND='ssh -i ~/.ssh/aur -o IdentitiesOnly=yes' git clone ssh://aur@aur.archlinux.org/spotatui.git aur

      - name: Update PKGBUILD
        working-directory: aur
        run: |
          sed -i "s/^pkgver=.*/pkgver=${{ steps.version.outputs.version }}/" PKGBUILD
          sed -i "s/^pkgrel=.*/pkgrel=1/" PKGBUILD
          sed -i "s/^sha256sums=.*/sha256sums=('${{ steps.sha256.outputs.sha256 }}')/" PKGBUILD
          # Ensure AUR builds work with default system linker (avoids LLVM bitcode/LTO linker errors).
          if ! grep -q "CARGO_PROFILE_RELEASE_LTO=false" PKGBUILD; then
            sed -i "/^[[:space:]]*build() {[[:space:]]*$/a\\  export CARGO_PROFILE_RELEASE_LTO=false" PKGBUILD
          fi

      - name: Generate .SRCINFO
        working-directory: aur
        run: |
          docker run --rm -v $PWD:/pkg archlinux:latest /bin/bash -c "
            pacman -Syu --noconfirm --needed base-devel &&
            useradd -m builder &&
            chown -R builder:builder /pkg &&
            cd /pkg &&
            su builder -c 'makepkg --printsrcinfo' > .SRCINFO
          "
          sudo chown -R $(id -u):$(id -g) .

      - name: Commit and push to AUR
        working-directory: aur
        run: |
          git add PKGBUILD .SRCINFO
          git commit -m "Update to ${{ steps.version.outputs.version }}"
          GIT_SSH_COMMAND='ssh -i ~/.ssh/aur -o IdentitiesOnly=yes' git push

  publish-aur-bin:
    name: Publish to AUR (spotatui-bin)
    needs: release
    runs-on: ubuntu-latest
    if: ${{ !contains(github.ref_name, '-') }}
    steps:
      - name: Checkout sources
        uses: actions/checkout@v7

      - name: Extract version
        id: version
        run: |
          VERSION=$(grep '^version = ' Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "Version: $VERSION"

      - name: Calculate SHA256 checksums
        id: sha256
        run: |
          VERSION="${{ steps.version.outputs.version }}"

          # SHA256 for the binary tarball
          BINARY_URL="https://github.com/${{ github.repository }}/releases/download/v${VERSION}/spotatui-linux-x86_64.tar.gz"
          SHA256_BINARY=$(curl -sL "$BINARY_URL" | sha256sum | awk '{print $1}')
          echo "sha256_binary=$SHA256_BINARY" >> $GITHUB_OUTPUT
          echo "Binary SHA256: $SHA256_BINARY"

          # SHA256 for LICENSE
          LICENSE_URL="https://raw.githubusercontent.com/${{ github.repository }}/v${VERSION}/LICENSE"
          SHA256_LICENSE=$(curl -sL "$LICENSE_URL" | sha256sum | awk '{print $1}')
          echo "sha256_license=$SHA256_LICENSE" >> $GITHUB_OUTPUT
          echo "LICENSE SHA256: $SHA256_LICENSE"

          # SHA256 for README.md
          README_URL="https://raw.githubusercontent.com/${{ github.repository }}/v${VERSION}/README.md"
          SHA256_README=$(curl -sL "$README_URL" | sha256sum | awk '{print $1}')
          echo "sha256_readme=$SHA256_README" >> $GITHUB_OUTPUT
          echo "README SHA256: $SHA256_README"

      - name: Setup SSH for AUR
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.AUR_SSH_PRIVATE_KEY }}" > ~/.ssh/aur
          chmod 600 ~/.ssh/aur
          ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts
          git config --global user.name "${{ secrets.AUR_USERNAME }}"
          git config --global user.email "${{ secrets.AUR_EMAIL }}"

      - name: Clone AUR repository
        run: |
          GIT_SSH_COMMAND='ssh -i ~/.ssh/aur -o IdentitiesOnly=yes' git clone ssh://aur@aur.archlinux.org/spotatui-bin.git aur-bin

      - name: Update PKGBUILD
        working-directory: aur-bin
        run: |
          # Update version and release
          sed -i "s/^pkgver=.*/pkgver=${{ steps.version.outputs.version }}/" PKGBUILD
          sed -i "s/^pkgrel=.*/pkgrel=1/" PKGBUILD

          # Remove existing checksum lines (handles both single and multi-line)
          sed -i '/^sha256sums=/d' PKGBUILD
          sed -i '/^sha256sums_x86_64=/d' PKGBUILD
          sed -i "/^[[:space:]]*'[a-f0-9]\{64\}')/d" PKGBUILD

          # Insert new single-line checksums before package()
          SHA_L="${{ steps.sha256.outputs.sha256_license }}"
          SHA_R="${{ steps.sha256.outputs.sha256_readme }}"
          SHA_B="${{ steps.sha256.outputs.sha256_binary }}"
          sed -i "/^package()/i sha256sums=('${SHA_L}' '${SHA_R}')\nsha256sums_x86_64=('${SHA_B}')" PKGBUILD

          # Validation
          echo "=== Validating PKGBUILD ==="
          grep "^pkgver=" PKGBUILD
          grep "^sha256sums=" PKGBUILD || { echo "ERROR: sha256sums not found"; exit 1; }
          grep "^sha256sums_x86_64=" PKGBUILD || { echo "ERROR: sha256sums_x86_64 not found"; exit 1; }
          grep -q "package()" PKGBUILD || { echo "ERROR: package() function missing"; exit 1; }
          echo "=== PKGBUILD validation successful ==="

      - name: Generate .SRCINFO
        working-directory: aur-bin
        run: |
          docker run --rm -v $PWD:/pkg archlinux:latest /bin/bash -c "
            pacman -Syu --noconfirm --needed base-devel &&
            useradd -m builder &&
            chown -R builder:builder /pkg &&
            cd /pkg &&
            su builder -c 'makepkg --printsrcinfo' > .SRCINFO
          "
          sudo chown -R $(id -u):$(id -g) .

      - name: Commit and push to AUR
        working-directory: aur-bin
        run: |
          git add PKGBUILD .SRCINFO
          git commit -m "Update to ${{ steps.version.outputs.version }}"
          GIT_SSH_COMMAND='ssh -i ~/.ssh/aur -o IdentitiesOnly=yes' git push

  publish-winget:
    name: Publish to winget
    needs: release
    runs-on: windows-latest
    if: ${{ !contains(github.ref_name, '-') }}
    steps:
      - name: Install cargo-binstall
        uses: cargo-bins/cargo-binstall@main
        env:
          GITHUB_TOKEN: ${{ github.token }}

      - name: Install komac
        shell: pwsh
        run: cargo binstall komac@2.15.0 -y
        env:
          GITHUB_TOKEN: ${{ github.token }}

      - name: Submit to winget-pkgs
        shell: pwsh
        run: |
          $ReleaseInfo = Invoke-RestMethod `
            -Uri "https://api.github.com/repos/${{ github.repository }}/releases/tags/${{ github.ref_name }}" `
            -Headers @{ Authorization = "token $env:GITHUB_TOKEN" }

          $Version = "${{ github.ref_name }}" -replace '^v'
          $Urls = $ReleaseInfo.assets.Where({ $_.name -match '-windows-x86_64\.zip$' }).browser_download_url -join ' '

          if ([string]::IsNullOrWhiteSpace($Urls)) {
            Write-Error "No Windows x86_64 zip release asset found"
            exit 1
          }

          komac update 'LargeModGames.spotatui' --version "$Version" --submit --urls $Urls
        env:
          GITHUB_TOKEN: ${{ secrets.WINGET_TOKEN }}
          KOMAC_FORK_OWNER: LargeModGames
          KOMAC_CREATED_WITH: spotatui CD workflow
          KOMAC_CREATED_WITH_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

  publish-homebrew:
    name: Publish to Homebrew
    needs: release
    runs-on: ubuntu-latest
    if: ${{ !contains(github.ref_name, '-') }}
    steps:
      - name: Checkout sources
        uses: actions/checkout@v7

      - name: Extract version
        id: version
        run: |
          VERSION=$(grep '^version = ' Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "Version: $VERSION"

      - name: Calculate SHA256 checksums
        id: sha256
        run: |
          VERSION="${{ steps.version.outputs.version }}"

          # macOS aarch64
          AARCH64_URL="https://github.com/${{ github.repository }}/releases/download/v${VERSION}/spotatui-macos-aarch64.tar.gz"
          SHA256_AARCH64=$(curl -sL "$AARCH64_URL" | sha256sum | awk '{print $1}')
          echo "sha256_aarch64=$SHA256_AARCH64" >> $GITHUB_OUTPUT
          echo "macOS aarch64 SHA256: $SHA256_AARCH64"

          # macOS x86_64
          X86_64_URL="https://github.com/${{ github.repository }}/releases/download/v${VERSION}/spotatui-macos-x86_64.tar.gz"
          SHA256_X86_64=$(curl -sL "$X86_64_URL" | sha256sum | awk '{print $1}')
          echo "sha256_x86_64=$SHA256_X86_64" >> $GITHUB_OUTPUT
          echo "macOS x86_64 SHA256: $SHA256_X86_64"

      - name: Setup SSH for Homebrew tap
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.HOMEBREW_TAP_SSH_KEY }}" > ~/.ssh/homebrew_tap
          chmod 600 ~/.ssh/homebrew_tap
          ssh-keyscan github.com >> ~/.ssh/known_hosts
          git config --global user.name "github-actions[bot]"
          git config --global user.email "github-actions[bot]@users.noreply.github.com"

      - name: Clone Homebrew tap repository
        run: |
          GIT_SSH_COMMAND='ssh -i ~/.ssh/homebrew_tap -o IdentitiesOnly=yes' \
            git clone git@github.com:LargeModGames/homebrew-spotatui.git homebrew-tap

      - name: Update formula
        working-directory: homebrew-tap
        run: |
          cat > Formula/spotatui.rb << 'FORMULA_EOF'
          # typed: false
          # frozen_string_literal: true

          # This formula is automatically updated by the CD workflow on each release.
          # Manual changes will be overwritten.

          class Spotatui < Formula
            desc "Spotify client for the terminal written in Rust, powered by Ratatui"
            homepage "https://github.com/LargeModGames/spotatui"
            version "${{ steps.version.outputs.version }}"
            license "MIT"

            depends_on :macos
            depends_on "portaudio"
            depends_on "openssl@3"

            on_arm do
              url "https://github.com/LargeModGames/spotatui/releases/download/v#{version}/spotatui-macos-aarch64.tar.gz"
              sha256 "${{ steps.sha256.outputs.sha256_aarch64 }}"
            end

            on_intel do
              url "https://github.com/LargeModGames/spotatui/releases/download/v#{version}/spotatui-macos-x86_64.tar.gz"
              sha256 "${{ steps.sha256.outputs.sha256_x86_64 }}"
            end

            def install
              bin.install "spotatui"
            end

            def caveats
              <<~EOS
                To use spotatui, you need a Spotify Premium account and must set up
                Spotify API credentials. Run `spotatui` for first-time setup instructions.

                For native streaming support, ensure you have a Spotify Premium subscription.
                Note: Native streaming on macOS requires 'portaudio' (installed as a dependency).

                More info: https://github.com/LargeModGames/spotatui
              EOS
            end

            test do
              assert_match "spotatui", shell_output("#{bin}/spotatui --version")
            end
          end
          FORMULA_EOF

      - name: Commit and push to Homebrew tap
        working-directory: homebrew-tap
        run: |
          git add Formula/spotatui.rb
          git diff --cached --quiet && echo "No changes to commit" && exit 0
          git commit -m "Update spotatui to ${{ steps.version.outputs.version }}"
          GIT_SSH_COMMAND='ssh -i ~/.ssh/homebrew_tap -o IdentitiesOnly=yes' git push