release.yml

name: Release

on:
  push:
    tags:
      - "[0-9]+.[0-9]+.[0-9]+*"

env:
  # As defined by the Taskfile's PROJECT_NAME variable
  PROJECT_NAME: arduino-create-agent
  TARGET: "/CreateAgent/Stable/"
  OLD_TARGET: "/CreateBridge/" # compatibility with older releases (we can't change config.ini)
  VERSION_TARGET: "arduino-create-static/agent-metadata/"
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  AWS_REGION: "us-east-1" # or https://github.com/aws/aws-cli/issues/5623
  KEYCHAIN: "sign.keychain"
  KEYCHAIN_PASSWORD: keychainpassword # Arbitrary password for a keychain that exists only for the duration of the job, so not secret
  GON_CONFIG_PATH: gon.config.hcl
  INSTALLER_CERT_MAC_PATH: "/tmp/ArduinoCerts2020.p12"
  AC_USERNAME: ${{ secrets.AC_USERNAME }} # used by gon
  AC_PASSWORD: ${{ secrets.AC_PASSWORD }} # used by gon
  # See: https://github.com/actions/setup-go/tree/v3#readme
  GO_VERSION: "1.19"

jobs:
  # The build job is responsible for: configuring the environment, testing and compiling process
  build:
    outputs:
      prerelease: ${{ steps.prerelease.outputs.IS_PRE }}
    strategy:
      matrix:
        os: [ubuntu-20.04, windows-2019, macos-12]
        arch: [-amd64]
        include:
        - os: windows-2019
          arch: -386
          ext: ".exe"
        - os: windows-2019
          ext: ".exe"

    defaults:
      run:
        shell: bash

    runs-on: ${{ matrix.os }}

    steps:
      - name: Set env vars
        run: |
          echo "TAG_VERSION=${GITHUB_REF##*/}" >> $GITHUB_ENV
          echo $(go env GOPATH)/bin >> $GITHUB_PATH

      - name: Identify Prerelease
        # This is a workaround while waiting for create-release action to implement auto pre-release based on tag
        id: prerelease
        run: |
          curl -L -s https://github.com/fsaintjacques/semver-tool/archive/3.1.0.zip -o /tmp/3.1.0.zip 
          unzip -p /tmp/3.1.0.zip semver-tool-3.1.0/src/semver >/tmp/semver && chmod +x /tmp/semver
          if [[ $(/tmp/semver get prerel ${GITHUB_REF/refs\/tags\//}) ]]; then echo "IS_PRE=true" >> $GITHUB_OUTPUT; fi

      - name: Disable EOL conversions
        run: git config --global core.autocrlf false

      - name: Checkout
        uses: actions/checkout@v3

      - name: Install Go
        uses: actions/setup-go@v3
        with:
          go-version: ${{ env.GO_VERSION }}

        # dependencies used for compiling the GUI
      - name: Install Dependencies (Linux)
        run: sudo apt update && sudo apt install -y --no-install-recommends build-essential libgtk-3-dev libwebkit2gtk-4.0-dev libappindicator3-dev
        if: matrix.os == 'ubuntu-20.04'

      - name: Install Go deps
        run: go install github.com/sanbornm/go-selfupdate/...@latest

      - name: Install Taskfile
        uses: arduino/setup-task@v1
        with:
          version: '3.x'
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Build the Agent for linux
        run: task go:build
        if: matrix.os == 'ubuntu-20.04'

        # build the agent without GUI support (no tray icon)
      - name: Build the Agent-cli
        run: task go:build-cli
        if: matrix.os == 'ubuntu-20.04'

        # the manifest is required by windows GUI apps, otherwise the binary will crash with: "Unable to create main window: TTM_ADDTOOL failed" (for reference https://github.com/lxn/walk/issues/28)
        # rsrc will produce a *.syso file that should get automatically recognized by go build command and linked into an executable.
      - name: Download tool to embed manifest in win binary
        run: go install github.com/akavel/rsrc@latest
        if: matrix.os == 'windows-2019'

        # building the agent for win requires a different task because of an extra flag
      - name: Build the Agent for win32
        env:
          GOARCH: 386  # 32bit architecture (for support)
        run: task go:build-win
        if: matrix.os == 'windows-2019' && matrix.arch == '-386'

      - name: Build the Agent for win64
        run: task go:build-win # GOARCH=amd64 by default on the runners
        if: matrix.os == 'windows-2019' && matrix.arch == '-amd64'

      - name: Build the Agent for macos
        env:
          MACOSX_DEPLOYMENT_TARGET: 10.11 # minimum supported version for mac
          CGO_CFLAGS: -mmacosx-version-min=10.11
          CGO_LDFLAGS: -mmacosx-version-min=10.11
        run: task go:build
        if: matrix.os == 'macos-12'

        # this will create `public/` dir with compressed full bin (<version>/<os>-<arch>.gz) and a json file
      - name: Create autoupdate files
        run: go-selfupdate ${{ env.PROJECT_NAME }}${{ matrix.ext }} ${TAG_VERSION}
        if: matrix.arch != '-386' && steps.prerelease.outputs.IS_PRE != 'true'

      - name: Create autoupdate files for win32
        run: go-selfupdate -platform windows${{ matrix.arch }} ${{ env.PROJECT_NAME }}${{ matrix.ext }} ${TAG_VERSION}
        if: matrix.arch == '-386' && matrix.os == 'windows-2019' && steps.prerelease.outputs.IS_PRE != 'true'

      - name: Upload autoupdate files to Arduino downloads servers
        run: |
          aws s3 sync public/ s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.TARGET }}
          aws s3 sync public/ s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.OLD_TARGET }}      
        if: steps.prerelease.outputs.IS_PRE != 'true'

      - name: Upload artifacts
        uses: actions/upload-artifact@v3
        with:
          name: ${{ env.PROJECT_NAME }}-${{ matrix.os }}${{ matrix.arch }}
          path: |
            ${{ env.PROJECT_NAME }}*
          if-no-files-found: error

  create-macos-bundle:
    needs: build

    runs-on: macos-12
    env:
      EXE_PATH: "skel/ArduinoCreateAgent.app/Contents/MacOS/"

    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          repository: 'bcmi-labs/arduino-create-agent-installer'  # the repo which contains the bundle structure and icons
          token: ${{ secrets.ARDUINO_CREATE_AGENT_CI_PAT }}

      - name: Download artifact
        uses: actions/download-artifact@v3
        with:
          name: ${{ env.PROJECT_NAME }}-macos-12-amd64
          path: ${{ env.EXE_PATH }}

      - name: Remove placeholder file
        run: rm -rf ${{ env.EXE_PATH }}.empty

        # zip artifacts do not mantain executable permission
      - name: Make executable
        run: chmod -v +x ${{ env.EXE_PATH }}${{ env.PROJECT_NAME }}

      - name: Rename executable to Arduino_Create_Agent
        run: mv -v ${{ env.EXE_PATH }}${{ env.PROJECT_NAME }} ${{ env.EXE_PATH }}Arduino_Create_Agent

      - name: get year
        run: echo "YEAR=$(date "+%Y")" >> $GITHUB_ENV

      - name: Generate Info.plist for MacOS
        run: |
          cat > skel/ArduinoCreateAgent.app/Contents/Info.plist <<EOF
          <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>CFBundlePackageType</key><string>APPL</string><key>CFBundleInfoDictionaryVersion</key><string>6.0</string>

              <key>CFBundleIconFile</key>           <string>AppIcon.icns</string>

              <key>CFBundleName</key>               <string>Arduino Create Agent</string>
              <key>CFBundleExecutable</key>         <string>Arduino_Create_Agent</string>
              <key>CFBundleIdentifier</key>         <string>create.arduino.cc</string>

              <key>CFBundleVersion</key>            <string>${GITHUB_REF##*/}</string>
              <key>NSHumanReadableCopyright</key>   <string>© Copyright ${{ env.YEAR }} Arduino LLC</string>
              <key>CFBundleShortVersionString</key> <string>${GITHUB_REF##*/}</string>
              <key>LSUIElement</key>                <true/>
              <!-- Needed for Apache Callback -->
              <key>NSPrincipalClass</key><string>NSApplication</string>
              <key>NSMainNibFile</key><string>MainMenu</string>

          </dict></plist>
          EOF

      - name: Tar bundle to keep permissions
        run: tar -cvf ArduinoCreateAgent.app.tar -C skel/ .

      - name: Upload artifacts
        uses: actions/upload-artifact@v3
        with:
          if-no-files-found: error
          name: ArduinoCreateAgent.app
          path: ArduinoCreateAgent.app.tar
          
  # The notarize-macos job will download the macos bundle from the previous job, sign, notarize and re-upload it, uploading it also on s3 download servers for the autoupdate.
  notarize-macos:
    name: Notarize bundle
    runs-on: macos-12
    env:
      GON_PATH: ${{ github.workspace }}/gon
    needs: [build, create-macos-bundle]

    steps:
      - name: Download artifact
        uses: actions/download-artifact@v3
        with:
          name: ArduinoCreateAgent.app

      - name: un-Tar bundle
        run: tar -xvf ArduinoCreateAgent.app.tar

      - name: Import Code-Signing Certificates
        run: |
          echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode > "${{ env.INSTALLER_CERT_MAC_PATH }}"
          security create-keychain -p "${{ env.KEYCHAIN_PASSWORD }}" "${{ env.KEYCHAIN }}"
          security default-keychain -s "${{ env.KEYCHAIN }}"
          security unlock-keychain -p "${{ env.KEYCHAIN_PASSWORD }}" "${{ env.KEYCHAIN }}"
          security import \
            "${{ env.INSTALLER_CERT_MAC_PATH }}" \
            -k "${{ env.KEYCHAIN }}" \
            -f pkcs12 \
            -A \
            -T "/usr/bin/codesign" \
            -P "${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}"
          security set-key-partition-list \
            -S apple-tool:,apple: \
            -s \
            -k "${{ env.KEYCHAIN_PASSWORD }}" \
            "${{ env.KEYCHAIN }}"

      - name: Install gon for code signing and app notarization
        uses: actions/checkout@v3
        with:
          repository: darkvertex/gon #this fork has support for --deep notarization
          path: ${{ env.GON_PATH }}
          ref: deep_sign_support

      - name: Build gon
        working-directory: ${{ env.GON_PATH }}/cmd/gon/
        run: |
          ls -lah
          go build
          mv gon /usr/local/bin

      - name: Write gon config to file
        # gon does not allow env variables in config file (https://github.com/mitchellh/gon/issues/20)
        run: |
          cat > "${{ env.GON_CONFIG_PATH }}" <<EOF
          # See: https://github.com/mitchellh/gon#configuration-file
          source = ["ArduinoCreateAgent.app"]
          bundle_id = "cc.arduino.${{ env.PROJECT_NAME }}"

          sign {
            application_identity = "Developer ID Application: ARDUINO SA (7KT7ZWMCJT)"
            deep = true
          }

          # Ask Gon for zip output to force notarization process to take place.
          # The CI will upload the zip output
          zip {
            output_path = "ArduinoCreateAgent.app_notarized.zip"
          }
          EOF

      - name: Sign and notarize binary
        run: gon -log-level=debug -log-json "${{ env.GON_CONFIG_PATH }}"
        
      - name: Upload autoupdate bundle to Arduino downloads servers
        run: aws s3 cp ArduinoCreateAgent.app_notarized.zip s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.TARGET }}${GITHUB_REF/refs\/tags\//}/ # the version should be created in th the build job
        if: ${{ needs.build.outputs.prerelease }} != 'true'

      - name: Upload artifact
        uses: actions/upload-artifact@v3
        with:
          name: ArduinoCreateAgent.app_notarized
          path: ArduinoCreateAgent.app_notarized.zip
          if-no-files-found: error

  # This job is responsible for generating the installers (using installbuilder)
  package:
    needs: notarize-macos
    runs-on: ubuntu-20.04

    env:
      # vars used by installbuilder
      INSTALLBUILDER_PATH: "/opt/installbuilder-22.10.0/bin/builder"
      INSTALLER_VARS: "project.outputDirectory=$PWD project.version=${GITHUB_REF##*/} workspace=$PWD realname=Arduino_Create_Agent"
      # vars passed to installbuilder to install https certs automatically
      CERT_INSTALL: "ask_certificates_install=CI"  # win(edge),mac(safari)
      NO_CERT_INSTALL: "ask_certificates_install=CS"  # linux
      CHOICE_CERT_INSTALL: "ask_certificates_install=CC"  # win,mac:(ff,chrome)
      CREATE_OSX_BUNDLED_MG: 0  # tell installbuilder to not create the DMG, gon will take care of that later
      # installbuilder will read this vars automatically (defined in installer.xml):
      INSTALLER_CERT_WINDOWS_PASSWORD: ${{ secrets.INSTALLER_CERT_WINDOWS_PASSWORD }}
      INSTALLER_CERT_WINDOWS_PFX: "/tmp/ArduinoCerts2020.pfx"
      INSTALLER_CERT_MAC_PASSWORD: ${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}
      INSTALLER_CERT_MAC_P12: "/tmp/ArduinoCerts2020.p12"

    strategy:
      fail-fast: false  # if one os is failing continue nonetheless
      matrix:  # used to generate installers for different OS and not for runs-on
        os: [ubuntu-20.04, windows-2019, macos-12]
        arch: [-amd64]
        include:
          - os: ubuntu-20.04
            install-builder-name: linux
            executable-path: artifacts/linux-amd64/
            artifact-name: arduino-create-agent-ubuntu-20.04-amd64
          - os: windows-2019
            arch: -386
            browser: edge
            install-builder-name: windows
            executable-path: artifacts/windows/
            extension: .exe
            installer-extension: .exe
            artifact-name: arduino-create-agent-windows-2019-386
          - os: windows-2019
            browser: edge
            install-builder-name: windows
            executable-path: artifacts/windows/
            extension: .exe
            installer-extension: .exe
            artifact-name: arduino-create-agent-windows-2019-amd64
          - os: macos-12
            browser: safari
            install-builder-name: osx
            executable-path: artifacts/macos/ArduinoCreateAgent.app
            installer-extension: .app
            artifact-name: ArduinoCreateAgent.app_notarized # this artifact contains the Contents directory

    container:
      image: floydpink/ubuntu-install-builder:22.10.0

    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          repository: 'bcmi-labs/arduino-create-agent-installer'  # the repo which contains install.xml
          token: ${{ secrets.ARDUINO_CREATE_AGENT_CI_PAT }}

      - name: Download artifact
        uses: actions/download-artifact@v3
        with:
          name: ${{ matrix.artifact-name }}
          path: ${{ matrix.executable-path }}  # path expected by installbuilder

      - name: unzip mac notarized bundle
        working-directory: ${{ matrix.executable-path }}
        run: |
          apt install unzip
          unzip ${{ matrix.artifact-name }}.zip
          rm ${{ matrix.artifact-name }}.zip
        if:  matrix.os == 'macos-12'

        # zip artifacts do not mantain executable permission
      - name: Make executable
        run: chmod -v +x ${{ matrix.executable-path }}${{ env.PROJECT_NAME }}*
        if: matrix.os == 'ubuntu-20.04'

      - name: Rename executable to Arduino_Create_Agent
        run: mv -v ${{ matrix.executable-path }}${{ env.PROJECT_NAME }}${{ matrix.extension }} ${{ matrix.executable-path }}Arduino_Create_Agent${{ matrix.extension }}
        if:  matrix.os != 'macos-12'

      - name: Rename executable to Arduino_Create_Agent_cli
        run: mv -v ${{ matrix.executable-path }}${{ env.PROJECT_NAME }}_cli${{ matrix.extension }} ${{ matrix.executable-path }}Arduino_Create_Agent_cli${{ matrix.extension }}
        if: matrix.os == 'ubuntu-20.04'

      - name: Save InstallBuilder license to file
        run: echo "${{ secrets.INSTALLER_LICENSE }}" > /tmp/license.xml

      - name: Save Win signing certificate to file
        run: echo "${{ secrets.INSTALLER_CERT_WINDOWS_PFX }}" | base64 --decode > ${{ env.INSTALLER_CERT_WINDOWS_PFX}}
        if: matrix.os == 'windows-2019'

      - name: Save macos signing certificate to file
        run: echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode  > ${{ env.INSTALLER_CERT_MAC_P12 }}
        if: matrix.os == 'macos-12'

        # win(edge),mac(safari) -> CERT_INSTALL and win,mac:(ff,chrome) -> CHOICE_CERT_INSTALL
        # installbuilder reads the env vars with certs paths and use it to sign the installer.
      - name: Launch Bitrock installbuilder-20 with CERT_INSTALL && CHOICE_CERT_INSTALL
        run: |
          ${{ env.INSTALLBUILDER_PATH }} build installer.xml ${{ matrix.install-builder-name }} --verbose --license /tmp/license.xml  --setvars ${{ env.INSTALLER_VARS }} ${{ env.CERT_INSTALL }}
          mv -v ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CI${{matrix.installer-extension}} ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}${{ matrix.arch }}-installer-${{matrix.browser}}${{matrix.installer-extension}}
          ${{ env.INSTALLBUILDER_PATH }} build installer.xml ${{ matrix.install-builder-name }} --verbose --license /tmp/license.xml  --setvars ${{ env.INSTALLER_VARS }} ${{ env.CHOICE_CERT_INSTALL }}
          cp -vr ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CC${{matrix.installer-extension}} ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}${{ matrix.arch }}-installer-chrome${{matrix.installer-extension}}
          mv -v ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-CC${{matrix.installer-extension}} ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}${{ matrix.arch }}-installer-firefox${{matrix.installer-extension}}
          rm -r ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}-installer-C*
        if: matrix.os == 'windows-2019' || matrix.os == 'macos-12'

        # linux
      - name: Launch Bitrock installbuilder-20 with NO_CERT_INSTALL
        run: |
          ${{ env.INSTALLBUILDER_PATH }} build installer.xml linux-x64 --verbose --license /tmp/license.xml  --setvars ${{ env.INSTALLER_VARS }} ${{ env.NO_CERT_INSTALL }}
          cp -v ArduinoCreateAgent-${GITHUB_REF##*/}-linux-x64-installer-CS.run ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}${{ matrix.arch }}-installer-chrome.run
          mv -v ArduinoCreateAgent-${GITHUB_REF##*/}-linux-x64-installer-CS.run ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}${{ matrix.arch }}-installer-firefox.run
          cp -v ArduinoCreateAgent-${GITHUB_REF##*/}-linux-x64-installer-CS.tar.gz ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}${{ matrix.arch }}-installer-chrome.tar.gz
          mv -v ArduinoCreateAgent-${GITHUB_REF##*/}-linux-x64-installer-CS.tar.gz ArduinoCreateAgent-${GITHUB_REF##*/}-${{ matrix.install-builder-name }}${{ matrix.arch }}-installer-firefox.tar.gz
        if: matrix.os == 'ubuntu-20.04'

      - name: Upload artifacts
        uses: actions/upload-artifact@v3
        with:
          name: ArduinoCreateAgent-${{ matrix.install-builder-name }}${{ matrix.arch }}
          path: ArduinoCreateAgent*
          if-no-files-found: error

  # This job will sign and notarize mac installers
  code-sign-mac-installers:
    needs: package
    strategy:
      matrix:
        browser: [safari, firefox, chrome]
        arch: [-amd64]

    runs-on: macos-12
    steps:
      - name: Download artifact
        uses: actions/download-artifact@v3
        with:
          name: ArduinoCreateAgent-osx${{ matrix.arch }}
          path: ArduinoCreateAgent-osx

        # zip artifacts do not mantain executable permission
      - name: Make executable
        run: chmod -v +x ArduinoCreateAgent-osx/ArduinoCreateAgent-${GITHUB_REF##*/}-osx${{ matrix.arch }}-installer-${{ matrix.browser }}.app/Contents/MacOS/*

      - name: Import Code-Signing Certificates
        run: |
          echo "${{ secrets.INSTALLER_CERT_MAC_P12 }}" | base64 --decode > "${{ env.INSTALLER_CERT_MAC_PATH }}"
          security create-keychain -p "${{ env.KEYCHAIN_PASSWORD }}" "${{ env.KEYCHAIN }}"
          security default-keychain -s "${{ env.KEYCHAIN }}"
          security unlock-keychain -p "${{ env.KEYCHAIN_PASSWORD }}" "${{ env.KEYCHAIN }}"
          security import \
            "${{ env.INSTALLER_CERT_MAC_PATH }}" \
            -k "${{ env.KEYCHAIN }}" \
            -f pkcs12 \
            -A \
            -T "/usr/bin/codesign" \
            -P "${{ secrets.INSTALLER_CERT_MAC_PASSWORD }}"
          security set-key-partition-list \
            -S apple-tool:,apple: \
            -s \
            -k "${{ env.KEYCHAIN_PASSWORD }}" \
            "${{ env.KEYCHAIN }}"

      - name: Install gon for code signing and app notarization
        run: |
          wget -q https://github.com/mitchellh/gon/releases/download/v0.2.5/gon_macos.zip
          unzip gon_macos.zip -d /usr/local/bin

      - name: Write gon config to file
        # gon does not allow env variables in config file (https://github.com/mitchellh/gon/issues/20)
        run: |
          cat > gon.config_installer.hcl <<EOF
          source = ["ArduinoCreateAgent-osx/ArduinoCreateAgent-${GITHUB_REF##*/}-osx${{ matrix.arch }}-installer-${{ matrix.browser }}.app"]
          bundle_id = "cc.arduino.${{ env.PROJECT_NAME }}-installer"

          sign {
            application_identity = "Developer ID Application: ARDUINO SA (7KT7ZWMCJT)"
          }

          dmg {
            output_path = "ArduinoCreateAgent-${GITHUB_REF##*/}-osx${{ matrix.arch }}-installer-${{ matrix.browser }}.dmg"
            volume_name = "ArduinoCreateAgent"
          }
          EOF

      - name: Code sign and notarize app
        run: |
          echo "gon will notarize executable in ArduinoCreateAgent-osx/ArduinoCreateAgent-${GITHUB_REF##*/}-osx${{ matrix.arch }}-installer-${{ matrix.browser }}.app"
          gon -log-level=debug -log-json gon.config_installer.hcl
        timeout-minutes: 30

      #  tar dmg file to keep executable permission
      - name: Tar files to keep permissions
        run: tar -cvf ArduinoCreateAgent-${GITHUB_REF##*/}-osx${{ matrix.arch }}-installer-${{ matrix.browser }}.tar ArduinoCreateAgent-${GITHUB_REF##*/}-osx${{ matrix.arch }}-installer-${{ matrix.browser }}.dmg

      - name: Upload artifacts
        uses: actions/upload-artifact@v3
        with:
          name: ArduinoCreateAgent-osx${{ matrix.arch }}
          path: ArduinoCreateAgent*.tar
          if-no-files-found: error

  create-release:
    runs-on: ubuntu-20.04
    needs: [build, code-sign-mac-installers]

    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0 # fetch all history for the create changelog step to work properly

      - name: Download artifact
        uses: actions/download-artifact@v3 # download all the artifacts

      #  mandatory step because upload-release-action does not support multiple folders
      - name: prepare artifacts for the release
        run: |
          mkdir release
          chmod -v +x ArduinoCreateAgent-linux-amd64/*.run
          mv -v ArduinoCreateAgent-linux-amd64/* release/
          cat ArduinoCreateAgent-osx-amd64/*.tar | tar -xvf - -i -C release/
          rm -v release/._ArduinoCreateAgent*.dmg
          mv -v ArduinoCreateAgent-windows*/* release/

      - name: VirusTotal Scan
        id: virustotal_step
        uses: crazy-max/ghaction-virustotal@v3
        with:
          vt_api_key: ${{ secrets.VIRUSTOTAL_API_KEY }}
          update_release_body: false # `true` won't work because trigger type is not release
          files: |
            release/*.exe
            ${{ env.PROJECT_NAME }}-windows-2019-386/${{ env.PROJECT_NAME }}.exe
            ${{ env.PROJECT_NAME }}-windows-2019-amd64/${{ env.PROJECT_NAME }}.exe

      - name: Create changelog
        uses: arduino/create-changelog@v1
        with:
          tag-regex: '^[0-9]+\.[0-9]+\.[0-9]+.*$'
          filter-regex: '^\[(skip|changelog)[ ,-](skip|changelog)\].*'
          case-insensitive-regex: true
          changelog-file-path: "CHANGELOG.md"

      - name: Organize release body message #use sed to clean and format the output markdown style
        id: release_body
        run: |
          echo "RBODY<<EOF" >> $GITHUB_OUTPUT
          echo "$(cat CHANGELOG.md)" >> $GITHUB_OUTPUT
          echo "<details close>" >> $GITHUB_OUTPUT
          echo "<summary>VirusTotal analysis 🛡</summary>" >> $GITHUB_OUTPUT
          echo "" >> $GITHUB_OUTPUT
          echo "$(echo ${{ steps.virustotal_step.outputs.analysis}} | sed 's/release\///g' | sed 's/,/\n/g' | sed 's/^/- [/' | sed 's/=/](/' | sed 's/$/)/')" >> $GITHUB_OUTPUT
          echo "</details>" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Create Github Release
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ github.ref }}
          release_name: ${{ github.ref }}
          body: ${{ steps.release_body.outputs.RBODY}}
          draft: false
          prerelease: ${{ needs.build.outputs.prerelease }}

      - name: Upload release files on Github
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          tag: ${{ github.ref }}
          file_glob: true  # If set to true, the file argument can be a glob pattern
          file: release/*

      - name: Upload release files on Arduino downloads servers
        run: aws s3 sync release/ s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.TARGET }}
        if: ${{ needs.build.outputs.prerelease }} != 'true'

      - name: Update version file (used by frontend to trigger autoupdate and create filename)
        run: |
          echo {\"Version\": \"${GITHUB_REF##*/}\"} > /tmp/agent-version.json
          aws s3 cp /tmp/agent-version.json s3://${{ env.VERSION_TARGET }}
        if: ${{ needs.build.outputs.prerelease }} != 'true'