name: Build and Release

on:
  workflow_dispatch:
  release:
    types: [ released,prereleased ]


jobs:
  build:
    needs: security
    permissions:
      contents: write
    strategy:
      matrix:
        goos: [ windows,  linux, darwin ]
        goarch: [ amd64, arm64 ]
    runs-on: ubuntu-latest
    env:
      CGO_ENABLED: 0
      GOOS: ${{ matrix.goos }}
      GOARCH: ${{ matrix.goarch }}
    steps:
      - name: Get version
        id: get_version
        run: |
          echo "VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
          echo "${GITHUB_REF}"
      - name: Checkout
        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
      - name: Setup Node.js environment
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
        with:
          node-version: 24
      - name: Install Dependencies
        run: npm install --global yarn@1.22.22
      - name: Setup Go environment
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
        with:
          go-version: '1.26.6'
      - name: Gen output name
        run: |
          echo "FILENAME=smail_${{ matrix.goos }}_${{ matrix.goarch }}" >> ${GITHUB_ENV}
          echo "ADMINFILENAME=smail-admin_${{ matrix.goos }}_${{ matrix.goarch }}" >> ${GITHUB_ENV}
          echo "WCFILENAME=wechat_push_${{ matrix.goos }}_${{ matrix.goarch }}" >> ${GITHUB_ENV}
          echo "SPAMBLOCKFILENAME=spam_block_${{ matrix.goos }}_${{ matrix.goarch }}" >> ${GITHUB_ENV}
          echo "TELEGRAMFILENAME=pmail_telegram_push_${{ matrix.goos }}_${{ matrix.goarch }}" >> ${GITHUB_ENV}
          echo "ZIPNAME=${{ matrix.goos }}_${{ matrix.goarch }}" >> ${GITHUB_ENV}
      - name: Rename Windows File
        if: matrix.goos == 'windows'
        run: |
          echo "FILENAME=smail_${{ matrix.goos }}_${{ matrix.goarch }}.exe" >> ${GITHUB_ENV}
          echo "ADMINFILENAME=smail-admin_${{ matrix.goos }}_${{ matrix.goarch }}.exe" >> ${GITHUB_ENV}
          echo "WCFILENAME=wechat_push_${{ matrix.goos }}_${{ matrix.goarch }}.exe" >> ${GITHUB_ENV}
          echo "SPAMBLOCKFILENAME=spam_block_${{ matrix.goos }}_${{ matrix.goarch }}.exe" >> ${GITHUB_ENV}
          echo "TELEGRAMFILENAME=pmail_telegram_push_${{ matrix.goos }}_${{ matrix.goarch }}.exe" >> ${GITHUB_ENV}
      - name: FE Build
        run: cd frontend && yarn install --frozen-lockfile && yarn build
      - name: BE Build
        run: |
          mkdir -p out/release/plugins
          cd backend
          BUILD_FLAGS="-s -w -X 'git.pcux.cn/xuans/Smail/internal/buildinfo.Version=${{ env.VERSION }}' -X 'git.pcux.cn/xuans/Smail/internal/buildinfo.GoVersion=$(go version)' -X 'git.pcux.cn/xuans/Smail/internal/buildinfo.GitHash=$(git show -s --format=%H)' -X 'git.pcux.cn/xuans/Smail/internal/buildinfo.BuildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ)'"
          go build -ldflags "$BUILD_FLAGS" -o ../out/release/${{ env.FILENAME }} ./cmd/smail
          go build -ldflags "$BUILD_FLAGS" -o ../out/release/${{ env.ADMINFILENAME }} ./cmd/smail-admin
          go build -ldflags "-s -w" -o ../out/release/plugins/${{ env.WCFILENAME }} hooks/wechat_push/wechat_push.go
          go build -ldflags "-s -w" -o ../out/release/plugins/${{ env.SPAMBLOCKFILENAME }} hooks/spam_block/spam_block.go
          cd ../plugins/pmail_telegram_push
          npm ci
          npm run build-only
          go build -ldflags "-s -w" -o ../../out/release/plugins/${{ env.TELEGRAMFILENAME }} .
          cd ../../out/release
          cat > release.json <<EOF
          {
            "version": "${{ env.VERSION }}",
            "gitHash": "$(git show -s --format=%H)",
            "protocolVersion": 1,
            "createdAt": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          }
          EOF
          cp ../../README.md README.md
          ls -alh
      - name: Zip
        run: |
          cd ./out/release
          zip -r ${{ env.ZIPNAME }}.zip ${{ env.FILENAME }} ${{ env.ADMINFILENAME }} plugins release.json README.md
          ls
      - name: Upload files to Artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: ${{ env.ZIPNAME }}
          path: out/release/${{ env.ZIPNAME }}.zip
      - name: Upload binaries to release
        uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: out/release/${{ env.ZIPNAME }}.zip
          tag: ${{ github.ref }}
          file_glob: true

  security:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
      - name: Setup Go environment
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
        with:
          go-version: '1.26.6'
      - name: Setup Node.js for test runner
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
        with:
          node-version: 24
      - name: Prepare frontend and Go embedded assets
        run: |
          npm install --global yarn@1.22.22
          cd frontend
          yarn install --frozen-lockfile
          yarn test
          yarn build
      - name: Verify Go dependencies
        run: cd backend && go mod verify
      - name: Run Go tests
        run: node test/run.mjs backend
      - name: Run Go static analysis
        run: cd backend && go vet ./...
      - name: Run Go race tests
        run: node test/run.mjs backend -race ./...
      - name: Run Go security analysis
        run: |
          go install github.com/securego/gosec/v2/cmd/gosec@v2.22.10
          cd backend && gosec ./...
      - name: Scan Go vulnerabilities
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@v1.7.0
          cd backend && govulncheck ./...
      - name: Verify frontend dependencies and lint
        run: |
          cd frontend
          yarn audit --groups dependencies
          yarn eslint . --ext .vue,.js,.jsx,.cjs,.mjs --ignore-path .gitignore