sync.yml

name: Sync Upstream & Patch

on:
  schedule:
    - cron: "0 8 * * *" # Daily 08:00 UTC
  workflow_dispatch:
    inputs:
      force:
        description: "Force sync even without version change"
        type: boolean
        default: false

env:
  NODE_VERSION: "24"

jobs:
  check:
    runs-on: ubuntu-latest
    outputs:
      has_update: ${{ steps.detect.outputs.has_update }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Check upstream versions
        id: detect
        run: |
          set +e
          node scripts/check-update.js --json --force 2>&1
          exit_code=$?
          set -e

          if [ "${{ inputs.force }}" = "true" ]; then
            echo "has_update=true" >> "$GITHUB_OUTPUT"
          elif [ $exit_code -eq 0 ]; then
            echo "has_update=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_update=false" >> "$GITHUB_OUTPUT"
            echo "No upstream update detected."
          fi

  # ──────────────────────────────────────────────
  # Each platform: sync + patch + build in one job
  # (src/ is gitignored, so it must be generated per-runner)
  # ──────────────────────────────────────────────
  build-mac:
    needs: check
    if: needs.check.outputs.has_update == 'true'
    runs-on: macos-latest
    strategy:
      fail-fast: false
      matrix:
        arch: [x64, arm64]
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Install dependencies
        run: |
          npm ci

      - name: Install tools
        run: |
          brew install --quiet sevenzip

      - name: Sync upstream (macOS only)
        run: node scripts/sync-upstream.js --force --skip-win

      - name: Patch
        run: node scripts/patch-all.js mac-${{ matrix.arch }}

      - name: Build
        run: npm run build:mac-${{ matrix.arch }}

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: Codex-macOS-${{ matrix.arch }}
          path: out/*.dmg
          if-no-files-found: error

  build-windows:
    needs: check
    if: needs.check.outputs.has_update == 'true'
    runs-on: windows-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Install dependencies
        run: |
          npm ci

      - name: Install tools
        run: |
          choco install 7zip -y

      - name: Add 7zz alias
        run: |
          Copy-Item "C:\Program Files\7-Zip\7z.exe" "C:\Program Files\7-Zip\7zz.exe"
          echo "C:\Program Files\7-Zip" | Out-File -Append -Encoding utf8 $env:GITHUB_PATH

      - name: Sync upstream (Windows only)
        run: node scripts/sync-upstream.js --force --skip-mac

      - name: Patch
        run: node scripts/patch-all.js win

      - name: Build
        run: npm run build:win-x64

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: Codex-Windows-x64
          path: out/*.zip
          if-no-files-found: error

  build-linux:
    needs: check
    if: needs.check.outputs.has_update == 'true'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        arch: [x64, arm64]
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y rpm fakeroot dpkg 7zip

      - name: Install dependencies
        run: |
          npm ci

      - name: Sync upstream (macOS ZIP for unix, skip Windows)
        run: node scripts/sync-upstream.js --force --skip-win

      - name: Patch
        run: node scripts/patch-all.js mac-${{ matrix.arch }}

      - name: Build
        run: npm run build:linux-${{ matrix.arch }}

      - name: Upload artifacts
        uses: actions/upload-artifact@v7
        with:
          name: Codex-Linux-${{ matrix.arch }}
          path: |
            out/make/deb/**/*.deb
            out/make/rpm/**/*.rpm
            out/make/zip/**/*.zip
          if-no-files-found: error

  # ──────────────────────────────────────────────
  # Bump version + tag + release
  # ──────────────────────────────────────────────
  release:
    needs: [build-mac, build-windows, build-linux]
    if: always() && needs.check.result == 'success'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          token: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install dependencies
        run: npm ci

      - name: Get upstream version and tag
        id: version
        run: |
          RESULT=$(node scripts/check-update.js --json --force)
          MAC_ARM64=$(echo "$RESULT" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const j=JSON.parse(d);console.log(j.platforms?.['macOS-arm64']?.version||'')}catch{console.log('')}})")
          MAC_X64=$(echo "$RESULT" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const j=JSON.parse(d);console.log(j.platforms?.['macOS-x64']?.version||'')}catch{console.log('')}})")
          WIN_VER=$(echo "$RESULT" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const j=JSON.parse(d);console.log(j.platforms?.Windows?.version||'')}catch{console.log('')}})")

          VERSION="${MAC_ARM64:-${MAC_X64:-$WIN_VER}}"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "mac_arm64=$MAC_ARM64" >> "$GITHUB_OUTPUT"
          echo "mac_x64=$MAC_X64" >> "$GITHUB_OUTPUT"
          echo "win_version=$WIN_VER" >> "$GITHUB_OUTPUT"

          if [ -z "$VERSION" ]; then echo "No version detected"; exit 0; fi

          node -e "
            const fs=require('fs'), p=JSON.parse(fs.readFileSync('package.json','utf8'));
            p.version='$VERSION';
            fs.writeFileSync('package.json', JSON.stringify(p,null,2)+'\n');
          "

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          git add package.json
          git diff --cached --quiet && echo "No version change" && exit 0

          git commit -m "Bump version to ${VERSION}"
          git tag -a "v${VERSION}" -m "Codex ${VERSION}"
          git push origin HEAD --tags

      - name: Download all artifacts
        uses: actions/download-artifact@v7
        with:
          path: artifacts

      - name: Display structure
        run: ls -lhR artifacts/

      - name: Create Release
        if: steps.version.outputs.version != ''
        uses: softprops/action-gh-release@v3
        with:
          tag_name: v${{ steps.version.outputs.version }}
          name: Codex ${{ steps.version.outputs.version }}
          body: |
            ## Upstream Versions
            | Platform | Version |
            |----------|---------|
            | macOS arm64 | `${{ steps.version.outputs.mac_arm64 || 'N/A' }}` |
            | macOS x64 | `${{ steps.version.outputs.mac_x64 || 'N/A' }}` |
            | Windows x64 | `${{ steps.version.outputs.win_version || 'N/A' }}` |
            | Linux | uses macOS ASAR |
          files: |
            artifacts/**/*.dmg
            artifacts/**/*.zip
            artifacts/**/*.deb
            artifacts/**/*.rpm
            artifacts/**/*.exe
          draft: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}