deploy.yml

name: Nuxt CD
run-name: ${{ github.ref_name }}

permissions:
  contents: write
  packages: write
  attestations: write
  id-token: write

on:
  release:
    types:
      - published

concurrency:
  group: ${{ github.workflow }}-${{ github.ref_name }}
  cancel-in-progress: true

env:
  REPO: ${{ github.repository }}
  USERNAME: ${{ vars.USERNAME }}
  VERSION: ${{ github.ref_name }}
  DATABASE_URL: ${{ vars.DATABASE_URL }}

jobs:
  build-web:
    runs-on: ubuntu-latest

    outputs:
      image_name: ${{ steps.metadata.outputs.image_name }}
      image_title: ${{ steps.metadata.outputs.image_title }}
      buildtime: ${{ steps.metadata.outputs.buildtime }}
      version: ${{ steps.metadata.outputs.version }}

    steps:
      - name: 📥 Checkout Repo
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: 🐋 Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: 🐋 Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: 🐋 Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: |
            ghcr.io/${{ env.REPO }}
          # docker.io/${{ env.REPO }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=sha-,format=short

      - name: 🏷️ Set tags as environment variable
        id: metadata
        run: |
          echo "Setting metadata to env variables"
          echo "image_name=${{ fromJSON(steps.meta.outputs.json).tags[0] }}" >> $GITHUB_OUTPUT
          echo "image_title=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.title'] }}" >> $GITHUB_OUTPUT
          echo "buildtime=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}" >> $GITHUB_OUTPUT
          echo "version=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}" >> $GITHUB_OUTPUT

      - name: 🐋 Log in to Github Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ env.USERNAME }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # - name: Log in to DockerHub
      #   uses: docker/login-action@v4
      #   with:
      #     registry: docker.io
      #     username: ${{ env.USERNAME }}
      #     password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: ⚙️ Build and Upload to Registries
        id: push
        uses: docker/build-push-action@v7
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            VERSION=${{ steps.metadata.outputs.version }}
            BUILD_TIME=${{ steps.metadata.outputs.buildtime }}
            SITE_URL=${{ vars.SITE_URL }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: 📝 Generate artifact attestation
        uses: actions/attest-build-provenance@v4
        with:
          subject-name: ghcr.io/${{ env.REPO }}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: false

  # deploy-web:
  #   needs: build-web
  #   runs-on: ubuntu-latest

  #   steps:
  #     - name: 🔀 Deploy to VPS
  #       uses: appleboy/ssh-action@v1.1.0
  #       with:
  #         host: ${{ secrets.VPS_HOST }}
  #         username: ${{ secrets.VPS_USERNAME }}
  #         password: ${{ secrets.VPS_PASSWORD }}
  #         script: |
  #           cd ~/${{ env.REPO }}
  #           curl -O https://raw.githubusercontent.com/${{ env.REPO }}/refs/heads/main/docker-compose.prod.yml
  #           docker stack deploy --compose-file docker-compose.prod.yml nuxtemplate

  build-desktop:
    env:
      PLATFORM_ENV: native
      NUXT_PUBLIC_SITE_URL: ${{ vars.SITE_URL }}

    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: 'macos-latest' # for Arm based macs (M1 and above).
            args: '--target aarch64-apple-darwin'

          - platform: 'macos-latest' # for Intel based macs.
            args: '--target x86_64-apple-darwin'

          - platform: 'ubuntu-latest'
            args: ''

          - platform: 'windows-latest'
            args: ''

    runs-on: ${{ matrix.platform }}

    steps:
      - name: 📥 Checkout Repo
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Install OS Dependencies (Ubuntu only)
        if: matrix.platform == 'ubuntu-latest' # This must match the platform value defined above.
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      - name: 🛠️ Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          # Those targets are only used on macos runners so it's in an `if` to slightly speed up windows and linux builds.
          targets: ${{ matrix.platform == 'macos-latest' &&
            'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - name: 🛠️ Setup Vite-Plus
        uses: voidzero-dev/setup-vp@v1
        with:
          node-version: 'lts/*'
          cache: true

      - name: 🛠️ Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: 📦 Install Dependencies
        run: bun install --frozen-lockfile

      - name: ⚙️ Build and Upload Artifact
        uses: tauri-apps/tauri-action@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        with:
          args: ${{ matrix.args }}
          tagName: v__VERSION__
          releaseName: 'v__VERSION__'
          releaseDraft: false
          prerelease: false

  # deploy-desktop:
  #   needs: build-desktop
  #   runs-on: ubuntu-latest

  build-mobile:
    env:
      ANDROID_HOME:
      PLATFORM_ENV: native
      NUXT_PUBLIC_SITE_URL: ${{ vars.SITE_URL }}

    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: 'ubuntu-latest'
            os: 'android'
          # - platform: 'ubuntu-latest'
          #   name: 'ios'
          #   args: ''

    runs-on: ${{ matrix.platform }}

    steps:
      - name: 📥 Checkout Repo
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Install OS Dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf

      - name: Setup Java
        uses: actions/setup-java@v6
        with:
          distribution: 'temurin'
          java-version: '17'

      - name: Setup Android SDK
        uses: android-actions/setup-android@v4

      - name: Setup Android NDK
        run: |
          sdkmanager "ndk;29.0.13846066"
          echo "NDK_HOME=${{ env.ANDROID_HOME }}/ndk/29.0.13846066" >> $GITHUB_ENV

      - name: Setup Android Signing
        run: |
          cd src-tauri/gen/android
          echo "keyAlias=${{ secrets.ANDROID_KEY_ALIAS }}" > keystore.properties
          echo "password=${{ secrets.ANDROID_KEY_PASSWORD }}" >> keystore.properties
          base64 -d <<< "${{ secrets.ANDROID_KEY_BASE64 }}" > ./release-keystore.jks
          echo "storeFile=../release-keystore.jks" >> keystore.properties

      - name: 🛠️ Setup Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android

      - name: 🛠️ Setup Node
        uses: actions/setup-node@v7
        with:
          node-version: 'lts/*'

      - name: 🛠️ Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: 📦 Install Dependencies
        run: bun install --frozen-lockfile

      - name: ⚙️ Build Artifact
        run: bun run tauri:build:mobile

      - name: ⚙️ Upload Artifact
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: src-tauri/gen/android/app/build/outputs/apk/universal/release/app-universal-release.apk
          asset_name: nuxtemplate_${{ env.VERSION }}_arm64.apk
          tag: ${{ env.VERSION }}

      - name: ⚙️ Upload Artifact
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: src-tauri/gen/android/app/build/outputs/bundle/universalRelease/app-universal-release.aab
          asset_name: nuxtemplate_${{ env.VERSION }}_arm64.aab
          tag: ${{ env.VERSION }}

  # deploy-mobile:
  #   needs: build-mobile
  #   runs-on: ubuntu-latest