build_rust.yaml

name: Rust

on:
  push:
    tags:
      - 'v*'
    branches:
      - master
  pull_request:
    branches:
      - master
  release:
    types: 
      - created
  workflow_dispatch:

jobs:
  build:
    name: Build for multiple platforms
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        include:
         - os: ubuntu-latest
           package_name: linux-x64
         - os: windows-latest
           package_name: windows-x64
         - os: macos-latest
           package_name: macos-aarch64
         - os: macos-12
           package_name: macos-x64

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Rust
        uses: actions-rs/toolchain@v1
        with:
          toolchain: stable
          override: true

      - name: Install OpenSSL (Windows)
        if: runner.os == 'Windows'
        shell: powershell
        run: |
          echo "VCPKG_ROOT=$env:VCPKG_INSTALLATION_ROOT" | Out-File -FilePath $env:GITHUB_ENV -Append
          vcpkg install openssl:x64-windows-static-md

      - name: Install OpenSSL (Macos)
        if: matrix.os == 'macos-latest' 
        run: brew install openssl

      - name: Cache cargo registry
        uses: actions/cache@v4
        with:
          path: ~/.cargo/registry
          key: ${{ runner.os }}-cargo-registry
          restore-keys: |
            ${{ runner.os }}-cargo-registry

      - name: Cache cargo index
        uses: actions/cache@v4
        with:
          path: ~/.cargo/git
          key: ${{ runner.os }}-cargo-index
          restore-keys: |
            ${{ runner.os }}-cargo-index

      - name: Build
        run: cargo build --release

      # - name: Run tests
      #   run: cargo test --release

      - name: Create release directory
        run: mkdir -p release
      
      - name: Create release system directory
        run: mkdir -p release/${{ matrix.package_name }}

      - name: Copy binary to release directory Windows
        if: matrix.os == 'windows-latest'
        run: cp target/release/idf-im-cli.exe release/${{ matrix.package_name }}/eim.exe

      - name: Copy binary to release directory POSIX
        if: matrix.os != 'windows-latest'
        run: |
          cp target/release/idf-im-cli release/${{ matrix.package_name }}/eim
          chmod +x release/${{ matrix.package_name }}/eim
      
      - name: Codesign macOS eim executables
        if: startsWith(matrix.os, 'macos')
        env: 
          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
          MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
        run: |
          echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
          /usr/bin/security create-keychain -p espressif build.keychain
          /usr/bin/security default-keychain -s build.keychain
          /usr/bin/security unlock-keychain -p espressif build.keychain
          /usr/bin/security import certificate.p12 -k build.keychain -P $MACOS_CERTIFICATE_PWD -T /usr/bin/codesign
          /usr/bin/security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k espressif build.keychain

          /usr/bin/codesign --entitlements eim.entitlement --options runtime --force -s "ESPRESSIF SYSTEMS (SHANGHAI) CO., LTD. (QWXF6GB4AV)" release/${{ matrix.package_name }}/eim -v
          /usr/bin/codesign -v -vvv --deep release/${{ matrix.package_name }}/eim
    
      - name: Zip eim executable for notarization
        if: startsWith(matrix.os, 'macos')
        run: |
          cd release/${{ matrix.package_name }}
          zip -r eim.zip eim      
          
      - name: Notarization of macOS eim executables
        # && github.ref == 'refs/heads/master'
        if: startsWith(matrix.os, 'macos') 
        env: 
          NOTARIZATION_USERNAME: ${{ secrets.NOTARIZATION_USERNAME }}
          NOTARIZATION_PASSWORD: ${{ secrets.NOTARIZATION_PASSWORD }}
          NOTARIZATION_TEAM_ID: ${{ secrets.NOTARIZATION_TEAM_ID }}
        run: |
            echo "Create notary keychain"
            /usr/bin/security create-keychain -p espressif notary.keychain
            /usr/bin/security default-keychain -s notary.keychain
            /usr/bin/security unlock-keychain -p espressif notary.keychain
      
            echo "Create keychain profile"
            xcrun notarytool store-credentials "eim-notarytool-profile" --apple-id $NOTARIZATION_USERNAME --team-id $NOTARIZATION_TEAM_ID --password $NOTARIZATION_PASSWORD
            xcrun notarytool submit release/${{ matrix.package_name }}/eim.zip --keychain-profile "eim-notarytool-profile" --wait
          
            echo "Unzipping the executable"
            unzip -o release/${{ matrix.package_name }}/eim.zip -d release/${{ matrix.package_name }}
         
            # echo "Attach staple for eim executable"
            # xcrun stapler staple release/${{ matrix.package_name }}/eim

      - name: Zip artifacts (Windows)
        if: matrix.os == 'windows-latest'
        run: |
          cd release/${{ matrix.package_name }}
          7z a -tzip eim.zip eim.exe

      - name: Zip artifacts (POSIX)
        if: matrix.os != 'windows-latest'
        run: |
          cd release/${{ matrix.package_name }}
          zip -r eim.zip eim
              
      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: eim-${{ github.run_id }}-${{ matrix.package_name }}
          path: release/${{ matrix.package_name }}/eim.zip

      - name: Upload artifact for tag
        if: startsWith(github.ref, 'refs/tags/')
        uses: actions/upload-artifact@v4
        with:
          name: eim-${{ github.ref_name }}-${{ matrix.package_name }}
          path: release/${{ matrix.package_name }}/eim.zip

      - name: Upload Release Asset
        if: github.event_name == 'release' && github.event.action == 'created'
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ github.event.release.upload_url }}
          asset_path: release/${{ matrix.package_name }}/eim.zip
          asset_name: eim-${{ github.ref_name }}-${{ matrix.package_name }}.zip
          asset_content_type: application/zip
      
      - name: Create aarch64-linux build
        if: matrix.os == 'ubuntu-latest'
        run: |
          rustup target add aarch64-unknown-linux-gnu
          cargo install cross
          cross build --target aarch64-unknown-linux-gnu --release
          mkdir -p release/aarch64-unknown-linux-gnu
          cp target/aarch64-unknown-linux-gnu/release/idf-im-cli release/aarch64-unknown-linux-gnu/eim
          chmod +x release/aarch64-unknown-linux-gnu/eim
          cd release/aarch64-unknown-linux-gnu
          zip -r eim.zip eim
      
      - name: Upload build artifacts for aarch64-linux
        uses: actions/upload-artifact@v4
        if: matrix.os == 'ubuntu-latest'
        with:
          name: eim-${{ github.run_id }}-linux-arm64
          path: release/aarch64-unknown-linux-gnu/eim.zip
      
      - name: Upload artifact for tag on aarch64-linux
        if: startsWith(github.ref, 'refs/tags/') && runner.os == 'Linux'
        uses: actions/upload-artifact@v4
        with:
          name: eim-${{ github.ref_name }}-linux-arm64
          path: release/aarch64-unknown-linux-gnu/eim.zip

      - name: Upload Release Asset on aarch64-linux
        if: github.event_name == 'release' && github.event.action == 'created' && runner.os == 'Linux'
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ github.event.release.upload_url }}
          asset_path: release/aarch64-unknown-linux-gnu/eim.zip
          asset_name: eim-${{ github.ref_name }}-linux-arm64.zip
          asset_content_type: application/zip