name: Build

on:
  workflow_call:
    inputs:
      build_type:
        description: Type of build (Debug, Release, RelWithDebInfo, MinSizeRel)
        type: string
        default: Debug
      is_qt_cached:
        description: Enable Qt caching or not
        type: string
        default: true
    secrets:
      SPARKLE_ED25519_KEY:
        description: Private key for signing Sparkle updates
        required: false
      WINDOWS_CODESIGN_CERT:
        description: Certificate for signing Windows builds
        required: false
      WINDOWS_CODESIGN_PASSWORD:
        description: Password for signing Windows builds
        required: false
      APPLE_CODESIGN_CERT:
        description: Certificate for signing macOS builds
        required: false
      APPLE_CODESIGN_PASSWORD:
        description: Password for signing macOS builds
        required: false
      APPLE_CODESIGN_ID:
        description: Certificate ID for signing macOS builds
        required: false
      APPLE_NOTARIZE_APPLE_ID:
        description: Apple ID used for notarizing macOS builds
        required: false
      APPLE_NOTARIZE_TEAM_ID:
        description: Team ID used for notarizing macOS builds
        required: false
      APPLE_NOTARIZE_PASSWORD:
        description: Password used for notarizing macOS builds
        required: false
      CACHIX_AUTH_TOKEN:
        description: Private token for authenticating against Cachix cache
        required: false
      GPG_PRIVATE_KEY:
        description: Private key for AppImage signing
        required: false
      GPG_PRIVATE_KEY_ID:
        description: ID for the GPG_PRIVATE_KEY, to select the signing key
        required: false

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-20.04
            qt_ver: 5
            qt_host: linux
            qt_arch: ""
            qt_version: "5.15.2"
            qt_modules: "qtnetworkauth"

          - os: ubuntu-20.04
            qt_ver: 6
            qt_host: linux
            qt_arch: ""
            qt_version: "6.5.3"
            qt_modules: "qt5compat qtimageformats qtnetworkauth"

          - os: windows-2022
            name: "Windows-MinGW-w64"
            msystem: clang64
            vcvars_arch: "amd64_x86"

          - os: windows-2022
            name: "Windows-MSVC"
            msystem: ""
            architecture: "x64"
            vcvars_arch: "amd64"
            qt_ver: 6
            qt_host: windows
            qt_arch: ""
            qt_version: "6.7.3"
            qt_modules: "qt5compat qtimageformats qtnetworkauth"
            nscurl_tag: "v24.9.26.122"
            nscurl_sha256: "AEE6C4BE3CB6455858E9C1EE4B3AFE0DB9960FA03FE99CCDEDC28390D57CCBB0"

          - os: windows-2022
            name: "Windows-MSVC-arm64"
            msystem: ""
            architecture: "arm64"
            vcvars_arch: "amd64_arm64"
            qt_ver: 6
            qt_host: windows
            qt_arch: "win64_msvc2019_arm64"
            qt_version: "6.7.3"
            qt_modules: "qt5compat qtimageformats qtnetworkauth"
            nscurl_tag: "v24.9.26.122"
            nscurl_sha256: "AEE6C4BE3CB6455858E9C1EE4B3AFE0DB9960FA03FE99CCDEDC28390D57CCBB0"

          - os: macos-14
            name: macOS
            macosx_deployment_target: 11.0
            qt_ver: 6
            qt_host: mac
            qt_arch: ""
            qt_version: "6.7.3"
            qt_modules: "qt5compat qtimageformats qtnetworkauth"

          - os: macos-14
            name: macOS-Legacy
            macosx_deployment_target: 10.13
            qt_ver: 5
            qt_host: mac
            qt_version: "5.15.2"
            qt_modules: "qtnetworkauth"

    runs-on: ${{ matrix.os }}

    env:
      MACOSX_DEPLOYMENT_TARGET: ${{ matrix.macosx_deployment_target }}
      INSTALL_DIR: "install"
      INSTALL_PORTABLE_DIR: "install-portable"
      INSTALL_APPIMAGE_DIR: "install-appdir"
      BUILD_DIR: "build"
      CCACHE_VAR: ""
      HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK: 1

    steps:
      ##
      # PREPARE
      ##
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: "true"

      - name: "Setup MSYS2"
        if: runner.os == 'Windows' && matrix.msystem != ''
        uses: msys2/setup-msys2@v2
        with:
          msystem: ${{ matrix.msystem }}
          update: true
          install: >-
            git
            mingw-w64-x86_64-binutils
          pacboy: >-
            toolchain:p
            cmake:p
            extra-cmake-modules:p
            ninja:p
            qt6-base:p
            qt6-svg:p
            qt6-imageformats:p
            quazip-qt6:p
            ccache:p
            qt6-5compat:p
            qt6-networkauth:p
            cmark:p

      - name: Force newer ccache
        if: runner.os == 'Windows' && matrix.msystem == '' && inputs.build_type == 'Debug'
        run: |
          choco install ccache --version 4.7.1

      - name: Setup ccache
        if: (runner.os != 'Windows' || matrix.msystem == '') && inputs.build_type == 'Debug'
        uses: hendrikmuhs/ccache-action@v1.2.14
        with:
          key: ${{ matrix.os }}-qt${{ matrix.qt_ver }}-${{ matrix.architecture }}

      - name: Retrieve ccache cache (Windows MinGW-w64)
        if: runner.os == 'Windows' && matrix.msystem != '' && inputs.build_type == 'Debug'
        uses: actions/cache@v4.2.0
        with:
          path: '${{ github.workspace }}\.ccache'
          key: ${{ matrix.os }}-mingw-w64-ccache-${{ github.run_id }}
          restore-keys: |
            ${{ matrix.os }}-mingw-w64-ccache

      - name: Setup ccache (Windows MinGW-w64)
        if: runner.os == 'Windows' && matrix.msystem != '' && inputs.build_type == 'Debug'
        shell: msys2 {0}
        run: |
          ccache --set-config=cache_dir='${{ github.workspace }}\.ccache'
          ccache --set-config=max_size='500M'
          ccache --set-config=compression=true
          ccache -p  # Show config
          ccache -z  # Zero stats

      - name: Use ccache on Debug builds only
        if: inputs.build_type == 'Debug'
        shell: bash
        run: |
          echo "CCACHE_VAR=ccache" >> $GITHUB_ENV

      - name: Set short version
        shell: bash
        run: |
          ver_short=`git rev-parse --short HEAD`
          echo "VERSION=$ver_short" >> $GITHUB_ENV

      - name: Install Dependencies (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get -y update
          sudo apt-get -y install ninja-build extra-cmake-modules scdoc appstream libxcb-cursor-dev

      - name: Install Dependencies (macOS)
        if: runner.os == 'macOS'
        run: |
          brew update
          brew install ninja extra-cmake-modules

      - name: Install host Qt (Windows MSVC arm64)
        if: runner.os == 'Windows' && matrix.architecture == 'arm64'
        uses: jurplel/install-qt-action@v3
        with:
          aqtversion: "==3.1.*"
          py7zrversion: ">=0.20.2"
          version: ${{ matrix.qt_version }}
          host: "windows"
          target: "desktop"
          arch: ""
          modules: ${{ matrix.qt_modules }}
          cache: ${{ inputs.is_qt_cached }}
          cache-key-prefix: host-qt-arm64-windows
          dir: ${{ github.workspace }}\HostQt
          set-env: false

      - name: Install Qt (macOS, Linux & Windows MSVC)
        if: matrix.msystem == ''
        uses: jurplel/install-qt-action@v3
        with:
          aqtversion: "==3.1.*"
          py7zrversion: ">=0.20.2"
          version: ${{ matrix.qt_version }}
          target: "desktop"
          arch: ${{ matrix.qt_arch }}
          modules: ${{ matrix.qt_modules }}
          tools: ${{ matrix.qt_tools }}
          cache: ${{ inputs.is_qt_cached }}

      - name: Install MSVC (Windows MSVC)
        if: runner.os == 'Windows' # We want this for MinGW builds as well, as we need SignTool
        uses: ilammy/msvc-dev-cmd@v1
        with:
          vsversion: 2022
          arch: ${{ matrix.vcvars_arch }}

      - name: Prepare AppImage (Linux)
        if: runner.os == 'Linux' && matrix.qt_ver != 5
        run: |
          wget "https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage"
          wget "https://github.com/linuxdeploy/linuxdeploy-plugin-appimage/releases/download/continuous/linuxdeploy-plugin-appimage-x86_64.AppImage"
          wget "https://github.com/linuxdeploy/linuxdeploy-plugin-qt/releases/download/continuous/linuxdeploy-plugin-qt-x86_64.AppImage"

          wget "https://github.com/AppImageCommunity/AppImageUpdate/releases/download/continuous/AppImageUpdate-x86_64.AppImage"

          sudo apt install libopengl0

      - name: Add QT_HOST_PATH var (Windows MSVC arm64)
        if: runner.os == 'Windows' && matrix.architecture == 'arm64'
        run: |
          echo "QT_HOST_PATH=${{ github.workspace }}\HostQt\Qt\${{ matrix.qt_version }}\msvc2019_64" >> $env:GITHUB_ENV

      - name: Setup java (macOS)
        if: runner.os == 'macOS'
        uses: actions/setup-java@v4
        with:
          distribution: "temurin"
          java-version: "17"
      ##
      # CONFIGURE
      ##

      - name: Configure CMake (macOS)
        if: runner.os == 'macOS' && matrix.qt_ver == 6
        run: |
          cmake -S . -B ${{ env.BUILD_DIR }} -DCMAKE_INSTALL_PREFIX=${{ env.INSTALL_DIR }} -DCMAKE_BUILD_TYPE=${{ inputs.build_type }} -DENABLE_LTO=ON -DLauncher_ENABLE_JAVA_DOWNLOADER=ON -DLauncher_BUILD_PLATFORM=official -DCMAKE_C_COMPILER_LAUNCHER=${{ env.CCACHE_VAR }} -DCMAKE_CXX_COMPILER_LAUNCHER=${{ env.CCACHE_VAR }} -DLauncher_QT_VERSION_MAJOR=${{ matrix.qt_ver }} -DCMAKE_OSX_ARCHITECTURES="x86_64;arm64" -G Ninja

      - name: Configure CMake (macOS-Legacy)
        if: runner.os == 'macOS' && matrix.qt_ver == 5
        run: |
          cmake -S . -B ${{ env.BUILD_DIR }} -DCMAKE_INSTALL_PREFIX=${{ env.INSTALL_DIR }} -DCMAKE_BUILD_TYPE=${{ inputs.build_type }} -DENABLE_LTO=ON -DLauncher_ENABLE_JAVA_DOWNLOADER=ON -DLauncher_BUILD_PLATFORM=official -DCMAKE_C_COMPILER_LAUNCHER=${{ env.CCACHE_VAR }} -DCMAKE_CXX_COMPILER_LAUNCHER=${{ env.CCACHE_VAR }} -DLauncher_QT_VERSION_MAJOR=${{ matrix.qt_ver }} -DMACOSX_SPARKLE_UPDATE_PUBLIC_KEY="" -DMACOSX_SPARKLE_UPDATE_FEED_URL="" -DCMAKE_OSX_ARCHITECTURES="x86_64" -G Ninja

      - name: Configure CMake (Windows MinGW-w64)
        if: runner.os == 'Windows' && matrix.msystem != ''
        shell: msys2 {0}
        run: |
          cmake -S . -B ${{ env.BUILD_DIR }} -DCMAKE_INSTALL_PREFIX=${{ env.INSTALL_DIR }} -DCMAKE_BUILD_TYPE=${{ inputs.build_type }} -DENABLE_LTO=ON -DLauncher_ENABLE_JAVA_DOWNLOADER=ON -DLauncher_BUILD_PLATFORM=official -DCMAKE_C_COMPILER_LAUNCHER=${{ env.CCACHE_VAR }} -DCMAKE_CXX_COMPILER_LAUNCHER=${{ env.CCACHE_VAR }} -DLauncher_QT_VERSION_MAJOR=6 -DCMAKE_OBJDUMP=/mingw64/bin/objdump.exe -DLauncher_BUILD_ARTIFACT=${{ matrix.name }}-Qt${{ matrix.qt_ver }} -G Ninja

      - name: Configure CMake (Windows MSVC)
        if: runner.os == 'Windows' && matrix.msystem == ''
        run: |
          cmake -S . -B ${{ env.BUILD_DIR }} -DCMAKE_INSTALL_PREFIX=${{ env.INSTALL_DIR }} -DCMAKE_BUILD_TYPE=${{ inputs.build_type }} -DENABLE_LTO=ON -DLauncher_ENABLE_JAVA_DOWNLOADER=ON -DLauncher_BUILD_PLATFORM=official -DLauncher_QT_VERSION_MAJOR=${{ matrix.qt_ver }} -DCMAKE_MSVC_RUNTIME_LIBRARY="MultiThreadedDLL" -A${{ matrix.architecture}} -DLauncher_FORCE_BUNDLED_LIBS=ON  -DLauncher_BUILD_ARTIFACT=${{ matrix.name }}-Qt${{ matrix.qt_ver }}
          # https://github.com/ccache/ccache/wiki/MS-Visual-Studio (I coudn't figure out the compiler prefix)
          if ("${{ env.CCACHE_VAR }}")
          {
            Copy-Item C:/ProgramData/chocolatey/lib/ccache/tools/ccache-4.7.1-windows-x86_64/ccache.exe -Destination C:/ProgramData/chocolatey/lib/ccache/tools/ccache-4.7.1-windows-x86_64/cl.exe
            echo "CLToolExe=cl.exe" >> $env:GITHUB_ENV
            echo "CLToolPath=C:/ProgramData/chocolatey/lib/ccache/tools/ccache-4.7.1-windows-x86_64/" >> $env:GITHUB_ENV
            echo "TrackFileAccess=false" >> $env:GITHUB_ENV
          }
          # Needed for ccache, but also speeds up compile
          echo "UseMultiToolTask=true" >> $env:GITHUB_ENV

      - name: Configure CMake (Linux)
        if: runner.os == 'Linux'
        run: |
          cmake -S . -B ${{ env.BUILD_DIR }} -DCMAKE_INSTALL_PREFIX=/usr -DCMAKE_BUILD_TYPE=${{ inputs.build_type }} -DENABLE_LTO=ON -DLauncher_ENABLE_JAVA_DOWNLOADER=ON -DLauncher_BUILD_PLATFORM=official -DCMAKE_C_COMPILER_LAUNCHER=${{ env.CCACHE_VAR }} -DCMAKE_CXX_COMPILER_LAUNCHER=${{ env.CCACHE_VAR }} -DLauncher_QT_VERSION_MAJOR=${{ matrix.qt_ver }} -DLauncher_BUILD_ARTIFACT=Linux-Qt${{ matrix.qt_ver }} -G Ninja

      ##
      # BUILD
      ##

      - name: Build
        if: runner.os != 'Windows'
        run: |
          cmake --build ${{ env.BUILD_DIR }}

      - name: Build (Windows MinGW-w64)
        if: runner.os == 'Windows' && matrix.msystem != ''
        shell: msys2 {0}
        run: |
          cmake --build ${{ env.BUILD_DIR }}

      - name: Build (Windows MSVC)
        if: runner.os == 'Windows' && matrix.msystem == ''
        run: |
          cmake --build ${{ env.BUILD_DIR }} --config ${{ inputs.build_type }}

      ##
      # TEST
      ##

      - name: Test
        if: runner.os != 'Windows'
        run: |
          ctest -E "^example64|example$" --test-dir build --output-on-failure

      - name: Test (Windows MinGW-w64)
        if: runner.os == 'Windows' && matrix.msystem != ''
        shell: msys2 {0}
        run: |
          ctest -E "^example64|example$" --test-dir build --output-on-failure

      - name: Test (Windows MSVC)
        if: runner.os == 'Windows' && matrix.msystem == '' && matrix.architecture != 'arm64'
        run: |
          ctest -E "^example64|example$" --test-dir build --output-on-failure -C ${{ inputs.build_type }}

      ##
      # PACKAGE BUILDS
      ##

      - name: Fetch codesign certificate (macOS)
        if: runner.os == 'macOS'
        run: |
          echo '${{ secrets.APPLE_CODESIGN_CERT }}' | base64 --decode > codesign.p12
          if [ -n '${{ secrets.APPLE_CODESIGN_ID }}' ]; then
            security create-keychain -p '${{ secrets.APPLE_CODESIGN_PASSWORD }}' build.keychain
            security default-keychain -s build.keychain
            security unlock-keychain -p '${{ secrets.APPLE_CODESIGN_PASSWORD }}' build.keychain
            security import codesign.p12 -k build.keychain -P '${{ secrets.APPLE_CODESIGN_PASSWORD }}' -T /usr/bin/codesign
            security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k '${{ secrets.APPLE_CODESIGN_PASSWORD }}' build.keychain
          else
            echo ":warning: Using ad-hoc code signing for macOS, as certificate was not present." >> $GITHUB_STEP_SUMMARY
          fi

      - name: Package (macOS)
        if: runner.os == 'macOS'
        run: |
          cmake --install ${{ env.BUILD_DIR }}

          cd ${{ env.INSTALL_DIR }}
          chmod +x "ShatteredPrism.app/Contents/MacOS/ShatteredPrism"

          if [ -n '${{ secrets.APPLE_CODESIGN_ID }}' ]; then
            APPLE_CODESIGN_ID='${{ secrets.APPLE_CODESIGN_ID }}'
          else
            APPLE_CODESIGN_ID='-'
          fi

          sudo codesign --sign "$APPLE_CODESIGN_ID" --deep --force --entitlements "../program_info/App.entitlements" --options runtime "ShatteredPrism.app/Contents/MacOS/ShatteredPrism"
          mv "ShatteredPrism.app" "Shattered Prism.app"

      - name: Notarize (macOS)
        if: runner.os == 'macOS'
        run: |
          cd ${{ env.INSTALL_DIR }}

          if [ -n '${{ secrets.APPLE_NOTARIZE_PASSWORD }}' ]; then
            ditto -c -k --sequesterRsrc --keepParent "Shattered Prism.app" ../ShatteredPrism.zip
            xcrun notarytool submit ../ShatteredPrism.zip \
              --wait --progress \
              --apple-id '${{ secrets.APPLE_NOTARIZE_APPLE_ID }}' \
              --team-id '${{ secrets.APPLE_NOTARIZE_TEAM_ID }}' \
              --password '${{ secrets.APPLE_NOTARIZE_PASSWORD }}'

            xcrun stapler staple "Shattered Prism.app"
          else
            echo ":warning: Skipping notarization as credentials are not present." >> $GITHUB_STEP_SUMMARY
          fi
          ditto -c -k --sequesterRsrc --keepParent "Shattered Prism.app" ../ShatteredPrism.zip

      - name: Make Sparkle signature (macOS)
        if: matrix.name == 'macOS'
        run: |
          if [ '${{ secrets.SPARKLE_ED25519_KEY }}' != '' ]; then
            echo '${{ secrets.SPARKLE_ED25519_KEY }}' > ed25519-priv.pem
            signature=$(/opt/homebrew/opt/openssl@3/bin/openssl pkeyutl -sign -rawin -in ${{ github.workspace }}/ShatteredPrism.zip -inkey ed25519-priv.pem | openssl base64 | tr -d \\n)
            rm ed25519-priv.pem
            cat >> $GITHUB_STEP_SUMMARY << EOF
          ### Artifact Information :information_source:
          - :memo: Sparkle Signature (ed25519): \`$signature\`
          EOF
          else
            cat >> $GITHUB_STEP_SUMMARY << EOF
          ### Artifact Information :information_source:
          - :warning: Sparkle Signature (ed25519): No private key available (likely a pull request or fork)
          EOF
          fi

      - name: Package (Windows MinGW-w64)
        if: runner.os == 'Windows' && matrix.msystem != ''
        shell: msys2 {0}
        run: |
          cmake --install ${{ env.BUILD_DIR }}
          touch ${{ env.INSTALL_DIR }}/manifest.txt
          for l in $(find ${{ env.INSTALL_DIR }} -type f); do l=$(cygpath -u $l); l=${l#$(pwd)/}; l=${l#${{ env.INSTALL_DIR }}/}; l=${l#./}; echo $l; done >> ${{ env.INSTALL_DIR }}/manifest.txt

      - name: Package (Windows MSVC)
        if: runner.os == 'Windows' && matrix.msystem == ''
        run: |
          cmake --install ${{ env.BUILD_DIR }} --config ${{ inputs.build_type }}

          cd ${{ github.workspace }}

          Get-ChildItem ${{ env.INSTALL_DIR }} -Recurse | ForEach FullName | Resolve-Path -Relative | %{ $_.TrimStart('.\') } | %{ $_.TrimStart('${{ env.INSTALL_DIR }}') } | %{ $_.TrimStart('\') } | Out-File -FilePath ${{ env.INSTALL_DIR }}/manifest.txt

      - name: Fetch codesign certificate (Windows)
        if: runner.os == 'Windows'
        shell: bash # yes, we are not using MSYS2 or PowerShell here
        run: |
          echo '${{ secrets.WINDOWS_CODESIGN_CERT }}' | base64 --decode > codesign.pfx

      - name: Sign executable (Windows)
        if: runner.os == 'Windows'
        run: |
          if (Get-Content ./codesign.pfx){
            cd ${{ env.INSTALL_DIR }}
            # We ship the exact same executable for portable and non-portable editions, so signing just once is fine
           SignTool sign /fd sha256 /td sha256 /f ../codesign.pfx /p '${{ secrets.WINDOWS_CODESIGN_PASSWORD }}' /tr http://timestamp.digicert.com ShatteredPrism.exe ShatteredPrism_updater.exe ShatteredPrism_filelink.exe
          } else {
            ":warning: Skipped code signing for Windows, as certificate was not present." >> $env:GITHUB_STEP_SUMMARY
          }

      - name: Package (Windows MinGW-w64, portable)
        if: runner.os == 'Windows' && matrix.msystem != ''
        shell: msys2 {0}
        run: |
          cp -r ${{ env.INSTALL_DIR }} ${{ env.INSTALL_PORTABLE_DIR }}  # cmake install on Windows is slow, let's just copy instead
          cmake --install ${{ env.BUILD_DIR }} --prefix ${{ env.INSTALL_PORTABLE_DIR }} --component portable
          for l in $(find ${{ env.INSTALL_PORTABLE_DIR }} -type f); do l=$(cygpath -u $l); l=${l#$(pwd)/}; l=${l#${{ env.INSTALL_PORTABLE_DIR }}/}; l=${l#./}; echo $l; done >> ${{ env.INSTALL_PORTABLE_DIR }}/manifest.txt

      - name: Package (Windows MSVC, portable)
        if: runner.os == 'Windows' && matrix.msystem == ''
        run: |
          cp -r ${{ env.INSTALL_DIR }} ${{ env.INSTALL_PORTABLE_DIR }}  # cmake install on Windows is slow, let's just copy instead
          cmake --install ${{ env.BUILD_DIR }} --prefix ${{ env.INSTALL_PORTABLE_DIR }} --component portable

          Get-ChildItem ${{ env.INSTALL_PORTABLE_DIR }} -Recurse | ForEach FullName | Resolve-Path -Relative | %{ $_.TrimStart('.\') } | %{ $_.TrimStart('${{ env.INSTALL_PORTABLE_DIR }}') } | %{ $_.TrimStart('\') } | Out-File -FilePath ${{ env.INSTALL_DIR }}/manifest.txt

      - name: Package (Windows, installer)
        if: runner.os == 'Windows'
        run: |
          if ('${{ matrix.nscurl_tag }}') {
            New-Item -Name NSISPlugins -ItemType Directory
            Invoke-Webrequest https://github.com/negrutiu/nsis-nscurl/releases/download/${{ matrix.nscurl_tag }}/NScurl.zip -OutFile NSISPlugins\NScurl.zip
            $nscurl_hash = Get-FileHash NSISPlugins\NScurl.zip -Algorithm Sha256 | Select-Object -ExpandProperty Hash
            if ( $nscurl_hash -ne "${{ matrix.nscurl_sha256 }}") {
              echo "::error:: NSCurl.zip sha256 mismatch"
              exit 1
            }
            Expand-Archive -Path NSISPlugins\NScurl.zip -DestinationPath NSISPlugins\NScurl
          }
          cd ${{ env.INSTALL_DIR }}
          makensis -NOCD "${{ github.workspace }}/${{ env.BUILD_DIR }}/program_info/win_install.nsi"

      - name: Sign installer (Windows)
        if: runner.os == 'Windows'
        run: |
          if (Get-Content ./codesign.pfx){
            SignTool sign /fd sha256 /td sha256 /f codesign.pfx /p '${{ secrets.WINDOWS_CODESIGN_PASSWORD }}' /tr http://timestamp.digicert.com ShatteredPrism-Setup.exe
          } else {
            ":warning: Skipped code signing for Windows, as certificate was not present." >> $env:GITHUB_STEP_SUMMARY
          }

      - name: Package AppImage (Linux)
        if: runner.os == 'Linux' && matrix.qt_ver != 5
        shell: bash
        env:
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
        run: |
          cmake --install ${{ env.BUILD_DIR }} --prefix ${{ env.INSTALL_APPIMAGE_DIR }}/usr

          mv ${{ env.INSTALL_APPIMAGE_DIR }}/usr/share/metainfo/org.lunaislazier.ShatteredPrism.metainfo.xml ${{ env.INSTALL_APPIMAGE_DIR }}/usr/share/metainfo/org.lunaislazier.ShatteredPrism.appdata.xml
          export "NO_APPSTREAM=1" # we have to skip appstream checking because appstream on ubuntu 20.04 is outdated

          export OUTPUT="ShatteredPrism-Linux-x86_64.AppImage"

          chmod +x linuxdeploy-*.AppImage

          mkdir -p ${{ env.INSTALL_APPIMAGE_DIR }}/usr/lib
          mkdir -p ${{ env.INSTALL_APPIMAGE_DIR }}/usr/plugins/iconengines

          cp -r ${{ runner.workspace }}/Qt/${{ matrix.qt_version }}/gcc_64/plugins/iconengines/* ${{ env.INSTALL_APPIMAGE_DIR }}/usr/plugins/iconengines

          cp /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 ${{ env.INSTALL_APPIMAGE_DIR }}/usr/lib/
          cp /usr/lib/x86_64-linux-gnu/libssl.so.1.1 ${{ env.INSTALL_APPIMAGE_DIR }}/usr/lib/
          cp /usr/lib/x86_64-linux-gnu/libOpenGL.so.0* ${{ env.INSTALL_APPIMAGE_DIR }}/usr/lib/

          LD_LIBRARY_PATH="${LD_LIBRARY_PATH}:${{ env.INSTALL_APPIMAGE_DIR }}/usr/lib"
          export LD_LIBRARY_PATH

          chmod +x AppImageUpdate-x86_64.AppImage
          cp AppImageUpdate-x86_64.AppImage ${{ env.INSTALL_APPIMAGE_DIR }}/usr/bin

          export UPDATE_INFORMATION="gh-releases-zsync|${{ github.repository_owner }}|${{ github.event.repository.name }}|latest|ShatteredPrism-Linux-x86_64.AppImage.zsync" 

          if [ '${{ secrets.GPG_PRIVATE_KEY_ID }}' != '' ]; then
            export SIGN=1
            export SIGN_KEY=${{ secrets.GPG_PRIVATE_KEY_ID }}
            mkdir -p ~/.gnupg/
            echo "$GPG_PRIVATE_KEY" > ~/.gnupg/private.key
            gpg --import ~/.gnupg/private.key
          else
            echo ":warning: Skipped code signing for Linux AppImage, as gpg key was not present." >> $GITHUB_STEP_SUMMARY
          fi

          ./linuxdeploy-x86_64.AppImage --appdir ${{ env.INSTALL_APPIMAGE_DIR }} --output appimage --plugin qt -i ${{ env.INSTALL_APPIMAGE_DIR }}/usr/share/icons/hicolor/scalable/apps/org.lunaislazier.ShatteredPrism.svg

          mv "ShatteredPrism-Linux-x86_64.AppImage" "ShatteredPrism-Linux-${{ env.VERSION }}-${{ inputs.build_type }}-x86_64.AppImage"

      - name: Package (Linux, portable)
        if: runner.os == 'Linux'
        run: |
          cmake -S . -B ${{ env.BUILD_DIR }} -DCMAKE_INSTALL_PREFIX=${{ env.INSTALL_PORTABLE_DIR }} -DCMAKE_BUILD_TYPE=${{ inputs.build_type }} -DENABLE_LTO=ON -DLauncher_BUILD_PLATFORM=official -DCMAKE_C_COMPILER_LAUNCHER=${{ env.CCACHE_VAR }} -DCMAKE_CXX_COMPILER_LAUNCHER=${{ env.CCACHE_VAR }} -DLauncher_QT_VERSION_MAJOR=${{ matrix.qt_ver }} -DLauncher_BUILD_ARTIFACT=Linux-Qt${{ matrix.qt_ver }} -DINSTALL_BUNDLE=full -G Ninja
          cmake --install ${{ env.BUILD_DIR }}
          cmake --install ${{ env.BUILD_DIR }} --component portable

          mkdir  ${{ env.INSTALL_PORTABLE_DIR }}/lib
          cp /lib/x86_64-linux-gnu/libbz2.so.1.0 ${{ env.INSTALL_PORTABLE_DIR }}/lib
          cp /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0 ${{ env.INSTALL_PORTABLE_DIR }}/lib
          cp /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 ${{ env.INSTALL_PORTABLE_DIR }}/lib
          cp /usr/lib/x86_64-linux-gnu/libssl.so.1.1 ${{ env.INSTALL_PORTABLE_DIR }}/lib
          cp /usr/lib/x86_64-linux-gnu/libffi.so.7 ${{ env.INSTALL_PORTABLE_DIR }}/lib
          mv ${{ env.INSTALL_PORTABLE_DIR }}/bin/*.so* ${{ env.INSTALL_PORTABLE_DIR }}/lib

          for l in $(find ${{ env.INSTALL_PORTABLE_DIR }} -type f); do l=${l#$(pwd)/}; l=${l#${{ env.INSTALL_PORTABLE_DIR }}/}; l=${l#./}; echo $l; done > ${{ env.INSTALL_PORTABLE_DIR }}/manifest.txt
          cd ${{ env.INSTALL_PORTABLE_DIR }}
          tar -czf ../ShatteredPrism-portable.tar.gz *

      ##
      # UPLOAD BUILDS
      ##

      - name: Upload binary tarball (macOS)
        if: runner.os == 'macOS'
        uses: actions/upload-artifact@v4
        with:
          name: ShatteredPrism-${{ matrix.name }}-${{ env.VERSION }}-${{ inputs.build_type }}
          path: ShatteredPrism.zip

      - name: Upload binary zip (Windows)
        if: runner.os == 'Windows'
        uses: actions/upload-artifact@v4
        with:
          name: ShatteredPrism-${{ matrix.name }}-${{ env.VERSION }}-${{ inputs.build_type }}
          path: ${{ env.INSTALL_DIR }}/**

      - name: Upload binary zip (Windows, portable)
        if: runner.os == 'Windows'
        uses: actions/upload-artifact@v4
        with:
          name: ShatteredPrism-${{ matrix.name }}-Portable-${{ env.VERSION }}-${{ inputs.build_type }}
          path: ${{ env.INSTALL_PORTABLE_DIR }}/**

      - name: Upload installer (Windows)
        if: runner.os == 'Windows'
        uses: actions/upload-artifact@v4
        with:
          name: ShatteredPrism-${{ matrix.name }}-Setup-${{ env.VERSION }}-${{ inputs.build_type }}
          path: ShatteredPrism-Setup.exe

      - name: Upload binary tarball (Linux, portable, Qt 5)
        if: runner.os == 'Linux' && matrix.qt_ver != 6
        uses: actions/upload-artifact@v4
        with:
          name: ShatteredPrism-${{ runner.os }}-Qt5-Portable-${{ env.VERSION }}-${{ inputs.build_type }}
          path: ShatteredPrism-portable.tar.gz

      - name: Upload binary tarball (Linux, portable, Qt 6)
        if: runner.os == 'Linux' && matrix.qt_ver != 5
        uses: actions/upload-artifact@v4
        with:
          name: ShatteredPrism-${{ runner.os }}-Qt6-Portable-${{ env.VERSION }}-${{ inputs.build_type }}
          path: ShatteredPrism-portable.tar.gz

      - name: Upload AppImage (Linux)
        if: runner.os == 'Linux' && matrix.qt_ver != 5
        uses: actions/upload-artifact@v4
        with:
          name: ShatteredPrism-${{ runner.os }}-${{ env.VERSION }}-${{ inputs.build_type }}-x86_64.AppImage
          path: ShatteredPrism-${{ runner.os }}-${{ env.VERSION }}-${{ inputs.build_type }}-x86_64.AppImage

      - name: Upload AppImage Zsync (Linux)
        if: runner.os == 'Linux' && matrix.qt_ver != 5
        uses: actions/upload-artifact@v4
        with:
          name: ShatteredPrism-${{ runner.os }}-${{ env.VERSION }}-${{ inputs.build_type }}-x86_64.AppImage.zsync
          path: ShatteredPrism-Linux-x86_64.AppImage.zsync

      - name: ccache stats (Windows MinGW-w64)
        if: runner.os == 'Windows' && matrix.msystem != ''
        shell: msys2 {0}
        run: |
          ccache -s

  flatpak:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/flathub-infra/flatpak-github-actions:kde-6.8
      options: --privileged
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        if: inputs.build_type == 'Debug'
        with:
          submodules: true

      - name: Set short version
        shell: bash
        run: echo "VERSION=${GITHUB_SHA::7}" >> $GITHUB_ENV

      - name: Build Flatpak (Linux)
        if: inputs.build_type == 'Debug'
        uses: flatpak/flatpak-github-actions/flatpak-builder@v6
        with:
          bundle: ShatteredPrism-${{ runner.os }}-${{ env.VERSION }}-Flatpak.flatpak
          manifest-path: flatpak/org.lunaislazier.ShatteredPrism.yml

  nix:
    name: Nix (${{ matrix.system }})

    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-22.04
            system: x86_64-linux

          - os: macos-13
            system: x86_64-darwin

          - os: macos-14
            system: aarch64-darwin

    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Nix
        uses: cachix/install-nix-action@v30

        # For PRs
      - name: Setup Nix Magic Cache
        uses: DeterminateSystems/magic-nix-cache-action@v8

        # For in-tree builds
      - name: Setup Cachix
        uses: cachix/cachix-action@v15
        with:
          name: unmojang
          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}

      - name: Run flake checks
        run: |
          nix flake check --print-build-logs --show-trace

      - name: Build debug package
        if: ${{ inputs.build_type == 'Debug' }}
        run: |
          nix build --print-build-logs .#shatteredprism-debug

      - name: Build release package
        if: ${{ inputs.build_type != 'Debug' }}
        run: |
          nix build --print-build-logs .#shatteredprism