release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:

permissions:
  contents: write

env:
  # Keep OS signing opt-in until paid certificates are available. Tauri
  # updater signing remains independent and is still required for update files.
  WINDOWS_OS_SIGNING_ENABLED: ${{ vars.VISUALLLM_WINDOWS_OS_SIGNING_ENABLED || 'false' }}
  MACOS_OS_SIGNING_ENABLED: ${{ vars.VISUALLLM_MACOS_OS_SIGNING_ENABLED || 'false' }}

jobs:
  # Shared setup to avoid duplication
  setup:
    name: Setup & cache
    runs-on: ubuntu-latest
    outputs:
      node-version: ${{ steps.node.outputs.node-version }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        id: node
        with:
          node-version: 22
          cache: npm
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri
      - run: npm ci

  signing_config:
    name: Resolve OS-signing configuration
    # Windows/macOS are deferred from v0.6.0. Re-enable with the future
    # platform release once native builds and certificates are in scope.
    if: ${{ false }}
    runs-on: ubuntu-latest
    outputs:
      windows: ${{ steps.resolve.outputs.windows }}
      macos: ${{ steps.resolve.outputs.macos }}
    steps:
      - id: resolve
        name: Enable signing only when configured and provisioned
        env:
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          set -euo pipefail
          windows=false
          macos=false
          if [[ "$WINDOWS_OS_SIGNING_ENABLED" == "true" && -n "$WINDOWS_CERTIFICATE" && -n "$WINDOWS_CERTIFICATE_PASSWORD" && -n "$TAURI_SIGNING_PRIVATE_KEY" && -n "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" ]]; then
            windows=true
          elif [[ "$WINDOWS_OS_SIGNING_ENABLED" == "true" ]]; then
            echo "Windows signing is a future-release path; it is not part of v0.6.0."
          fi
          if [[ "$MACOS_OS_SIGNING_ENABLED" == "true" && -n "$MACOS_CERTIFICATE" && -n "$MACOS_CERTIFICATE_PASSWORD" && -n "$TAURI_SIGNING_PRIVATE_KEY" && -n "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" ]]; then
            macos=true
          elif [[ "$MACOS_OS_SIGNING_ENABLED" == "true" ]]; then
            echo "macOS signing is a future-release path; it is not part of v0.6.0."
          fi
          echo "windows=$windows" >> "$GITHUB_OUTPUT"
          echo "macos=$macos" >> "$GITHUB_OUTPUT"

  linux:
    name: Linux release
    needs: setup
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Install Tauri CLI
        run: npm install -g @tauri-apps/cli

      - name: Verify tag matches source version
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          node tools/check-version.js
          TAG="${GITHUB_REF#refs/tags/}"
          VER="$(python3 -c "import json;print(json.load(open('src-tauri/tauri.conf.json'))['version'])")"
          if [ "${TAG#v}" != "$VER" ]; then
            echo "Tag $TAG does not match source version $VER in src-tauri/tauri.conf.json."
            echo "Bump Cargo.toml/tauri.conf.json/package.json to $VER and re-tag."
            exit 1
          fi
          echo "Tag $TAG matches source version $VER"

      - name: Install Linux build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libxdo-dev \
            libayatana-appindicator3-dev \
            libdbus-1-dev \
            librsvg2-dev

      - run: npm run smoke
      - run: npm test

      - name: Build (signed for auto-update)
        run: npm run build
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}

      - name: Create stable Linux artifact aliases
        working-directory: src-tauri/target/release/bundle
        run: |
          set -euo pipefail
          deb=$(find deb -maxdepth 1 -type f -name '*.deb' -print -quit)
          appimage=$(find appimage -maxdepth 1 -type f -name '*.AppImage' -print -quit)
          [[ -n "$deb" && -n "$appimage" ]] || { echo 'Linux bundle missing'; exit 1; }
          cp "$deb" deb/VisualLLM-linux-x86_64.deb
          cp "$appimage" appimage/VisualLLM-linux-x86_64.AppImage
          for source in "$appimage" "$appimage.tar.gz"; do
            if [[ -f "$source" ]]; then
              target="$(dirname "$source")/VisualLLM-linux-x86_64$(basename "$source" | sed "s/.*\(\.AppImage.*\)$/\1/")"
              cp "$source" "$target"
              [[ ! -f "$source.sig" ]] || cp "$source.sig" "$target.sig"
            fi
          done

      - name: Generate checksums
        working-directory: src-tauri/target/release/bundle
        run: |
          sha256sum deb/*.deb appimage/*.AppImage > SHA256SUMS
          cat SHA256SUMS

      - name: Upload Linux artifacts
        uses: actions/upload-artifact@v4
        with:
          name: visualllm-linux
          path: |
            src-tauri/target/release/bundle/deb/*.deb
            src-tauri/target/release/bundle/deb/*.deb.sig
            src-tauri/target/release/bundle/appimage/*.AppImage
            src-tauri/target/release/bundle/appimage/*.AppImage.sig
            src-tauri/target/release/bundle/appimage/*.AppImage.tar.gz
            src-tauri/target/release/bundle/appimage/*.AppImage.tar.gz.sig
            src-tauri/target/release/bundle/SHA256SUMS

  windows:
    name: Windows release
    if: ${{ false }}
    needs: setup
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Install WebView2 bootstrapper (for portable .exe)
        run: |
          # WebView2 is usually present on Windows 10/11, but we ensure the bootstrapper is available
          # The MSI installer will handle WebView2 installation automatically

      - name: Install Tauri CLI
        run: npm install -g @tauri-apps/cli

      - run: npm run smoke

      - name: Build (signed for auto-update)
        run: npm run build
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}

      - name: Create stable Windows artifact aliases
        working-directory: src-tauri/target/release/bundle
        shell: pwsh
        run: |
          $msi = @(Get-ChildItem msi -File -Filter *.msi | Select-Object -First 1)
          $nsis = @(Get-ChildItem nsis -File -Filter *.exe | Select-Object -First 1)
          if ($msi.Count -eq 0 -or $nsis.Count -eq 0) { throw 'Windows bundle missing' }
          Copy-Item $msi[0].FullName msi/VisualLLM-windows-x86_64.msi
          Copy-Item $nsis[0].FullName nsis/VisualLLM-windows-x86_64-setup.exe
          foreach ($item in @($msi[0], $nsis[0])) {
            $alias = if ($item.Extension -eq '.msi') { 'msi/VisualLLM-windows-x86_64.msi' } else { 'nsis/VisualLLM-windows-x86_64-setup.exe' }
            if (Test-Path "$($item.FullName).sig") { Copy-Item "$($item.FullName).sig" "$alias.sig" }
          }
          $msiZip = @(Get-ChildItem msi -File -Filter *.zip | Select-Object -First 1)
          $nsisZip = @(Get-ChildItem nsis -File -Filter *.zip | Select-Object -First 1)
          if ($msiZip.Count -gt 0) {
            Copy-Item $msiZip[0].FullName msi/VisualLLM-windows-x86_64.msi.zip
            if (Test-Path "$($msiZip[0].FullName).sig") { Copy-Item "$($msiZip[0].FullName).sig" msi/VisualLLM-windows-x86_64.msi.zip.sig }
          }
          if ($nsisZip.Count -gt 0) {
            Copy-Item $nsisZip[0].FullName nsis/VisualLLM-windows-x86_64.nsis.zip
            if (Test-Path "$($nsisZip[0].FullName).sig") { Copy-Item "$($nsisZip[0].FullName).sig" nsis/VisualLLM-windows-x86_64.nsis.zip.sig }
          }

      - name: Generate checksums
        working-directory: src-tauri/target/release/bundle
        run: |
          Get-ChildItem msi/*.msi, nsis/*.exe | ForEach-Object {
            $hash = (Get-FileHash -Algorithm SHA256 $_.FullName).Hash.ToLower()
            "$hash  $($_.Name)"
          } | Out-File SHA256SUMS -Encoding ascii
          Get-Content SHA256SUMS

      - name: Upload Windows artifacts
        uses: actions/upload-artifact@v4
        with:
          name: visualllm-windows
          path: |
            src-tauri/target/release/bundle/msi/*.msi
            src-tauri/target/release/bundle/msi/*.msi.sig
            src-tauri/target/release/bundle/nsis/*.exe
            src-tauri/target/release/bundle/nsis/*.exe.sig
            src-tauri/target/release/bundle/msi/*.zip
            src-tauri/target/release/bundle/msi/*.zip.sig
            src-tauri/target/release/bundle/nsis/*.zip
            src-tauri/target/release/bundle/nsis/*.zip.sig
            src-tauri/target/release/bundle/SHA256SUMS

  macos:
    name: macOS release
    if: ${{ false }}
    needs: setup
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Install Tauri CLI
        run: npm install -g @tauri-apps/cli

      - run: npm run smoke

      - name: Build (signed for auto-update)
        run: npm run build
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}

      - name: Create stable macOS artifact alias
        working-directory: src-tauri/target/release/bundle
        run: |
          set -euo pipefail
          dmg=$(find dmg -maxdepth 1 -type f -name '*.dmg' -print -quit)
          [[ -n "$dmg" ]] || { echo 'macOS bundle missing'; exit 1; }
          cp "$dmg" dmg/VisualLLM-macos-arm64.dmg
          [[ ! -f "$dmg.sig" ]] || cp "$dmg.sig" dmg/VisualLLM-macos-arm64.dmg.sig

      - name: Generate checksums
        working-directory: src-tauri/target/release/bundle
        run: |
          shasum -a 256 dmg/*.dmg > SHA256SUMS
          cat SHA256SUMS

      - name: Upload macOS artifacts
        uses: actions/upload-artifact@v4
        with:
          name: visualllm-macos
          path: |
            src-tauri/target/release/bundle/dmg/*.dmg
            src-tauri/target/release/bundle/dmg/*.dmg.sig
            src-tauri/target/release/bundle/macos/*
            src-tauri/target/release/bundle/macos/*.tar.gz
            src-tauri/target/release/bundle/macos/*.tar.gz.sig
            src-tauri/target/release/bundle/SHA256SUMS

  macos_sign:
    name: Sign macOS artifacts
    if: ${{ false }}
    needs: [macos, signing_config]
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
      - name: Download macOS artifacts
        uses: actions/download-artifact@v4
        with:
          name: visualllm-macos
          path: artifacts
      - name: Import macOS certificate
        uses: apple-actions/import-codesign-certs@v2
        with:
          p12-file-base64: ${{ secrets.MACOS_CERTIFICATE }}
          p12-password: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
      - name: Sign DMG
        run: |
          while IFS= read -r -d '' dmg; do
            codesign --sign "Developer ID Application: VisualLLM" \
              --timestamp \
              --options runtime \
              "$dmg"
          done < <(find artifacts -type f -name '*.dmg' -print0)
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npm ci
      - name: Re-sign final macOS updater payloads
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        run: |
          set -euo pipefail
          found=false
          while IFS= read -r -d '' payload; do
            found=true
            rm -f "$payload.sig"
            npx tauri signer sign "$payload"
          done < <(find artifacts -type f \( -name '*.app.tar.gz' -o -name '*.tar.gz' \) -print0)
          [[ "$found" == true ]] || { echo 'No macOS updater payload found'; exit 1; }
      - name: Upload signed artifacts
        uses: actions/upload-artifact@v4
        with:
          name: visualllm-macos-signed
          path: artifacts

  windows_sign:
    name: Sign Windows artifacts
    if: ${{ false }}
    needs: [windows, signing_config]
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
      - name: Download Windows artifacts
        uses: actions/download-artifact@v4
        with:
          name: visualllm-windows
          path: artifacts
      - name: Install Windows certificate
        run: |
          $cert = "${{ secrets.WINDOWS_CERTIFICATE }}"
          $cert | ConvertFrom-Base64 | Set-Content -Path certificate.pfx -Encoding Byte
      - name: Sign MSI and NSIS
        run: |
          $certPass = "${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}"
          Get-ChildItem -Path artifacts -Recurse -Include *.msi,*.exe | ForEach-Object {
            signtool sign /f certificate.pfx /p $certPass /tr http://timestamp.digicert.com /td sha256 /fd sha256 $_.FullName
          }
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npm ci
      - name: Re-sign final Windows updater payloads
        env:
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
        shell: pwsh
        run: |
          $payloads = @(Get-ChildItem -Path artifacts -Recurse -Include *.zip)
          if ($payloads.Count -eq 0) { throw 'No Windows updater payload found' }
          foreach ($payload in $payloads) {
            Remove-Item "$($payload.FullName).sig" -ErrorAction SilentlyContinue
            npx tauri signer sign $payload.FullName
            if ($LASTEXITCODE -ne 0) { throw "Updater signing failed for $($payload.Name)" }
          }
      - name: Upload signed artifacts
        uses: actions/upload-artifact@v4
        with:
          name: visualllm-windows-signed
          path: artifacts

  release:
    name: Create GitHub Release
    needs: [linux]
    if: >-
      startsWith(github.ref, 'refs/tags/') && needs.linux.result == 'success'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download Linux artifacts
        uses: actions/download-artifact@v4
        with:
          name: visualllm-linux
          path: artifacts/linux

      - name: Show downloaded files
        run: |
          find artifacts -type f \( -name "*.deb" -o -name "*.AppImage" -o -name "*.msi" -o -name "*.exe" -o -name "*.dmg" -o -name "*.sig" -o -name "*.tar.gz" -o -name "SHA256SUMS*" \) | sort
          ls -la artifacts/

      - name: Generate latest.json
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          python3 - "$TAG" <<'PY'
          import glob, json, os, sys, datetime

          tag = sys.argv[1]
          version = tag.lstrip("v")
          base = f"https://github.com/CreativeSystemDesign/visualllm/releases/download/{tag}"

          platforms = {}
          platform_names = {}
          for sig in sorted(glob.glob("artifacts/**/*.sig", recursive=True)):
              name = os.path.basename(sig)[:-4]
              with open(sig) as f:
                  signature = f.read().strip()
              if name.endswith(".AppImage.tar.gz"):
                  key = "linux-x86_64-appimage"
              elif name.endswith(".AppImage"):
                  key = "linux-x86_64-appimage"
              elif name.endswith(".deb"):
                  key = "linux-x86_64-deb"
              else:
                  continue
              # Prefer a stable alias, then prefer an updater archive over a
              # raw installer signature when both are present.
              candidate_score = (name.startswith("VisualLLM-"), name.endswith((".tar.gz", ".zip")))
              prior_name = platform_names.get(key)
              if prior_name:
                  prior_score = (prior_name.startswith("VisualLLM-"), prior_name.endswith((".tar.gz", ".zip")))
                  if candidate_score <= prior_score:
                      continue
              platform_names[key] = name
              platforms[key] = {
                  "signature": signature,
                  "url": f"{base}/{name}",
              }

          manifest = {
              "version": version,
              "notes": f"VisualLLM {version}",
              "pub_date": datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
              "platforms": platforms,
          }
          with open("artifacts/latest.json", "w") as f:
              json.dump(manifest, f, indent=2)
          PY
          cat artifacts/latest.json

      - name: Verify release artifacts and updater manifest
        run: node tools/verify-release.js artifacts artifacts/latest.json

      - name: Publish GitHub release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          body: |
            ## VisualLLM ${{ github.ref_name }}

            Linux x86_64 is the supported v0.6.0 distribution. Windows and
            macOS packages are deferred and are not included in this release.

            Tauri updater signatures are separate from Windows Authenticode
            and Apple code signing. See the installation guidance and checksums
            below before downloading.
          files: |
            artifacts/**/*.deb
            artifacts/**/*.AppImage
            artifacts/**/*.sig
            artifacts/**/SHA256SUMS*
            artifacts/latest.json

  # Create tar.gz for Homebrew/AUR/Flatpak
  create-tarball:
    name: Create tarball
    needs: [linux, release]
    # Deferred: the old tarball was a Linux AppImage mislabeled for channels
    # that require a macOS cask or a native package.
    if: ${{ false }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Download Linux artifacts
        uses: actions/download-artifact@v4
        with:
          name: visualllm-linux
          path: artifacts
      - name: Create tar.gz from AppImage
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          mkdir -p visualllm-${TAG}
          # Use the AppImage as the distributable binary (it's in artifacts/appimage/)
          cp artifacts/appimage/*.AppImage visualllm-${TAG}/visualllm
          chmod +x visualllm-${TAG}/visualllm
          tar -czf visualllm-${TAG}.tar.gz visualllm-${TAG}
          sha256sum visualllm-${TAG}.tar.gz > SHA256SUMS-tarball.txt
          cat SHA256SUMS-tarball.txt
      - name: Upload tarball
        uses: actions/upload-artifact@v4
        with:
          name: visualllm-tarball
          path: |
            visualllm-*.tar.gz
            SHA256SUMS-tarball.txt

  # ------------------------------------------------------------------
  # Post-release: package for additional distribution channels
  # ------------------------------------------------------------------
  homebrew:
    name: Homebrew tap
    needs: [linux, windows, macos, release, create-tarball]
    runs-on: ubuntu-latest
    # Deferred until a signed/notarized macOS DMG can back a proper cask.
    if: ${{ false }}
    permissions:
      contents: write
    env:
      HOMEBREW_NO_REQUIRE_TAP_TRUST: 1
    steps:
      - uses: actions/checkout@v4
      - name: Download tarball for sha256
        uses: actions/download-artifact@v4
        with:
          name: visualllm-tarball
          path: artifacts
      - name: Calculate sha256 for tar.gz
        id: sha256
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          TAR_GZ=$(find artifacts -name "*.tar.gz" | head -1)
          if [ -z "$TAR_GZ" ]; then
            echo "No tar.gz found"
            exit 1
          fi
          SHA256=$(sha256sum "$TAR_GZ" | cut -d' ' -f1)
          echo "sha256=$SHA256" >> $GITHUB_OUTPUT
          echo "Found tar.gz: $TAR_GZ"
          echo "SHA256: $SHA256"
      - name: Update Homebrew tap
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          SHA256="${{ steps.sha256.outputs.sha256 }}"
          # Clone the tap repo
          git clone https://x-access-token:${{ secrets.HOMEBREW_TAP_TOKEN }}@github.com/CreativeSystemDesign/homebrew-visualllm.git /tmp/homebrew-visualllm
          cd /tmp/homebrew-visualllm
          # Update the formula
          sed -i "s|url \".*\"|url \"https://github.com/CreativeSystemDesign/visualllm/releases/download/${TAG}/visualllm-${TAG}.tar.gz\"|" Formula/visualllm.rb
          sed -i "s|sha256 \".*\"|sha256 \"${SHA256}\"|" Formula/visualllm.rb
          # Commit and push
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git commit -am "Update visualllm to ${TAG}"
          git push

  # AUR package - DISABLED (AUR account setup pending)
  # aur:
  #   name: AUR package
  #   needs: [linux, windows, macos, release, create-tarball]
  #   runs-on: ubuntu-latest
  #   if: startsWith(github.ref, 'refs/tags/')
  #   permissions:
  #     contents: write
  #   steps:
  #     - uses: actions/checkout@v4
  #     - name: Download tarball for sha256
  #       uses: actions/download-artifact@v4
  #       with:
  #         name: visualllm-tarball
  #         path: artifacts
  #     - name: Calculate sha256 for tar.gz
  #       id: sha256
  #       run: |
  #         TAG="${GITHUB_REF#refs/tags/}"
  #         TAR_GZ=$(find artifacts -name "*.tar.gz" | head -1)
  #         if [ -z "$TAR_GZ" ]; then
  #           echo "No tar.gz found"
  #           exit 1
  #         fi
  #         SHA256=$(sha256sum "$TAR_GZ" | cut -d' ' -f1)
  #         echo "sha256=$SHA256" >> $GITHUB_OUTPUT
  #         echo "Found tar.gz: $TAR_GZ"
  #         echo "SHA256: $SHA256"
  #     - name: Generate PKGBUILD
  #       run: |
  #         TAG="${GITHUB_REF#refs/tags/}"
  #         VERSION="${TAG#v}"
  #         SHA256="${{ steps.sha256.outputs.sha256 }}"
  #         cat > PKGBUILD <<EOF
  #         # Maintainer: Shane Gross
  #         pkgname=visualllm
  #         pkgver=${VERSION}
  #         pkgrel=1
  #         pkgdesc="Visual fallback router for LLM endpoints"
  #         arch=(x86_64)
  #         url="https://github.com/CreativeSystemDesign/visualllm"
  #         license=(MIT)
  #         depends=(webkit2gtk libxdo libayatana-appindicator3 librsvg2)
  #         source=("https://github.com/CreativeSystemDesign/visualllm/releases/download/${TAG}/visualllm-\${pkgver}.tar.gz")
  #         sha256sums=('${SHA256}')
  #
  #         package() {
  #           install -Dm755 visualllm "\$pkgdir/usr/bin/visualllm"
  #         }
  #         EOF
  #         cat PKGBUILD
  #     - name: Push to AUR
  #       uses: KSXGitHub/aur-publish@v2
  #       with:
  #         pkgname: visualllm
  #         pkgbuild: ./PKGBUILD
  #         ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
  #         ssh_public_key: ${{ secrets.AUR_SSH_PUBLIC_KEY }}
  #         commit_message: "Update to ${{ github.ref_name }}"
  #         gpg_private_key: ${{ secrets.AUR_GPG_PRIVATE_KEY }}
  #         gpg_passphrase: ${{ secrets.AUR_GPG_PASSPHRASE }}

  flatpak:
    name: Flatpak package
    needs: [linux, windows, macos, release, create-tarball]
    runs-on: ubuntu-latest
    # Deferred until the manifest, runtime, metadata, and publication path are
    # independently verified.
    if: ${{ false }}
    steps:
      - uses: actions/checkout@v4
      - name: Download tarball for sha256
        uses: actions/download-artifact@v4
        with:
          name: visualllm-tarball
          path: artifacts
      - name: Calculate sha256 for tar.gz
        id: sha256
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          TAR_GZ=$(find artifacts -name "*.tar.gz" | head -1)
          if [ -z "$TAR_GZ" ]; then
            echo "No tar.gz found"
            exit 1
          fi
          SHA256=$(sha256sum "$TAR_GZ" | cut -d' ' -f1)
          echo "sha256=$SHA256" >> $GITHUB_OUTPUT
          echo "Found tar.gz: $TAR_GZ"
          echo "SHA256: $SHA256"
      - name: Install Flatpak tools
        run: |
          sudo apt-get update
          sudo apt-get install -y flatpak flatpak-builder
          flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
      - name: Build Flatpak
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          SHA256="${{ steps.sha256.outputs.sha256 }}"
          mkdir -p flatpak-build
          cat > flatpak-build/com.visualllm.VisualLLM.json <<EOF
          {
            "app-id": "com.visualllm.VisualLLM",
            "runtime": "org.freedesktop.Platform",
            "runtime-version": "24.08",
            "sdk": "org.freedesktop.Sdk",
            "command": "visualllm",
            "finish-args": [
              "--socket=wayland",
              "--socket=fallback-x11",
              "--socket=pulseaudio",
              "--share=network",
              "--device=dri"
            ],
            "modules": [
              {
                "name": "visualllm",
                "buildsystem": "simple",
                "build-commands": [
                  "install -Dm755 visualllm /app/bin/visualllm",
                  "install -Dm644 io.github.creativesystemdesign.visualllm.desktop /app/share/applications/io.github.creativesystemdesign.visualllm.desktop",
                  "install -Dm644 icon.png /app/share/icons/hicolor/512x512/apps/io.github.creativesystemdesign.visualllm.png",
                  "install -Dm644 io.github.creativesystemdesign.visualllm.metainfo.xml /app/share/metainfo/io.github.creativesystemdesign.visualllm.metainfo.xml"
                ],
                "sources": [
                  {
                    "type": "archive",
                    "url": "https://github.com/CreativeSystemDesign/visualllm/releases/download/${TAG}/visualllm-${TAG}.tar.gz",
                    "sha256": "${SHA256}"
                  }
                ]
              }
            ]
          }
          EOF
          cat > flatpak-build/io.github.creativesystemdesign.visualllm.desktop <<EOF
          [Desktop Entry]
          Name=VisualLLM
          Exec=visualllm
          Icon=io.github.creativesystemdesign.visualllm
          Type=Application
          Categories=Utility;Development;
          Comment=Design reliable OpenAI-compatible endpoints by arranging AI models visually
          StartupNotify=true
          Terminal=false
          EOF
          wget -O flatpak-build/icon.png "https://raw.githubusercontent.com/CreativeSystemDesign/visualllm/main/src-tauri/icons/icon.png"
          wget -O flatpak-build/io.github.creativesystemdesign.visualllm.metainfo.xml "https://raw.githubusercontent.com/CreativeSystemDesign/visualllm/main/flatpak-visualllm/io.github.creativesystemdesign.visualllm.metainfo.xml"
          flatpak-builder --force-clean --repo=repo flatpak-build/io.github.creativesystemdesign.visualllm.json
          flatpak build-bundle repo visualllm-${TAG}.flatpak io.github.creativesystemdesign.visualllm
      - name: Upload Flatpak artifact
        uses: actions/upload-artifact@v4
        with:
          name: visualllm-flatpak
          path: visualllm-*.flatpak
      - name: Submit to Flathub
        if: env.FLATHUB_SUBMIT_TOKEN != ''
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
          flatpak build-bundle repo visualllm-${TAG}.flatpak io.github.creativesystemdesign.visualllm
          # Submit to Flathub using the submit API
          curl -X POST "https://flathub.org/api/v1/apps/io.github.creativesystemdesign.visualllm/submit" \
            -H "Authorization: Bearer ${FLATHUB_SUBMIT_TOKEN}" \
            -F "file=@visualllm-${TAG}.flatpak" \
            -F "notes=Release ${{ github.ref_name }}"