feeddeck/.github/workflows/continuous-delivery.yaml

---
name: Continuous Delivery

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  release:
    types:
      - published

jobs:
  # The "Docker" job builds the Docker image and pushes it to the GitHub
  # Container Registry. The job only runs when a commit is pushed to the main
  # branch or a new tag is created.
  docker:
    name: Docker
    runs-on: ubuntu-latest
    if:
      github.ref == 'refs/heads/main' || (github.event_name == 'release' &&
      github.event.action == 'published')
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Docker Metadata
        id: metadata
        uses: docker/metadata-action@v6
        with:
          images: |
            ghcr.io/${{ github.repository }}
          tags: |
            type=ref,event=branch
            type=semver,pattern={{raw}}

      - name: Setup QEMU
        uses: docker/setup-qemu-action@v4

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
          registry: ghcr.io

      - name: Build and Push Docker Image
        id: docker_build
        uses: docker/build-push-action@v7
        with:
          push: true
          context: ./supabase/functions
          file: ./supabase/functions/_cmd/Dockerfile
          platforms: linux/amd64,linux/arm64/v8
          tags: ${{ steps.metadata.outputs.tags }}
          labels: ${{ steps.metadata.outputs.labels }}

  # The "Supabase" job runs the database migrations and deploys all Supabase
  # functions. The job only runs when a commit is pushed to the main branch or
  # a new tag is created.
  supabase:
    name: Supabase
    runs-on: ubuntu-latest
    if:
      github.ref == 'refs/heads/main' || (github.event_name == 'release' &&
      github.event.action == 'published')
    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Setup Supabase
        uses: supabase/setup-cli@v2

      - name: Push Database Migration and Deploy Functions
        if: github.ref == 'refs/heads/main'
        env:
          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
          SUPABASE_DB_PASSWORD: ${{ secrets.SUPABASE_STAGE_DB_PASSWORD }}
          PROJECT_ID: ${{ secrets.SUPABASE_STAGE_PROJECT_ID }}
        run: |
          supabase link --project-ref $PROJECT_ID

          supabase db push

          supabase functions deploy add-or-update-source-v1 --project-ref $PROJECT_ID
          # supabase functions deploy add-source-v1 --project-ref $PROJECT_ID
          supabase functions deploy delete-user-v1 --project-ref $PROJECT_ID
          supabase functions deploy generate-magic-link-v1 --project-ref $PROJECT_ID
          supabase functions deploy image-proxy-v1 --no-verify-jwt --project-ref $PROJECT_ID
          # supabase functions deploy profile-v1 --project-ref $PROJECT_ID
          supabase functions deploy profile-v2 --project-ref $PROJECT_ID
          supabase functions deploy revenuecat-webhooks-v1 --no-verify-jwt --project-ref $PROJECT_ID
          supabase functions deploy stripe-create-billing-portal-link-v1 --project-ref $PROJECT_ID
          supabase functions deploy stripe-create-checkout-session-v1 --project-ref $PROJECT_ID
          supabase functions deploy stripe-webhooks-v1 --no-verify-jwt --project-ref $PROJECT_ID

      - name: Push Database Migration and Deploy Functions
        if:
          ${{ github.event_name == 'release' && github.event.action ==
          'published' }}
        env:
          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
          SUPABASE_DB_PASSWORD: ${{ secrets.SUPABASE_PROD_DB_PASSWORD }}
          PROJECT_ID: ${{ secrets.SUPABASE_PROD_PROJECT_ID }}
        run: |
          supabase link --project-ref $PROJECT_ID

          supabase db push

          supabase functions deploy add-or-update-source-v1 --project-ref $PROJECT_ID
          supabase functions deploy add-source-v1 --project-ref $PROJECT_ID
          supabase functions deploy delete-user-v1 --project-ref $PROJECT_ID
          supabase functions deploy generate-magic-link-v1 --project-ref $PROJECT_ID
          supabase functions deploy image-proxy-v1 --no-verify-jwt --project-ref $PROJECT_ID
          supabase functions deploy profile-v1 --project-ref $PROJECT_ID
          supabase functions deploy profile-v2 --project-ref $PROJECT_ID
          supabase functions deploy revenuecat-webhooks-v1 --no-verify-jwt --project-ref $PROJECT_ID
          supabase functions deploy stripe-create-billing-portal-link-v1 --project-ref $PROJECT_ID
          supabase functions deploy stripe-create-checkout-session-v1 --project-ref $PROJECT_ID
          supabase functions deploy stripe-webhooks-v1 --no-verify-jwt --project-ref $PROJECT_ID

  # The "Web" job builds the Flutter web app and publishes it to Cloudflare
  # Pages. The job only runs on pull requests or when a commit is pushed to the
  # main branch or a new tag is created.
  #
  # When the job runs on a pull request it only builds the app but doesn't
  # upload the build to Cloudflare.
  web:
    name: Web
    runs-on: ubuntu-latest
    if:
      github.event_name == 'pull_request' || github.ref == 'refs/heads/main' ||
      (github.event_name == 'release' && github.event.action == 'published')
    permissions:
      contents: read
    defaults:
      run:
        working-directory: "app"

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Install Packages
        run: |
          # Required for Flutter
          sudo apt-get update -y
          sudo apt-get install -y ninja-build libgtk-3-dev

      - name: Set Environment Variables
        id: tag
        run: |
          if [[ $GITHUB_REF == refs/tags/* ]]; then
            echo CLOUDFLARE_PROJECT_NAME=${{ secrets.CLOUDFLARE_PROJECT_NAME_PROD }} >> $GITHUB_ENV

            echo SUPABASE_URL=${{ secrets.SUPABASE_PROD_URL }} >> $GITHUB_ENV
            echo SUPABASE_ANON_KEY=${{ secrets.SUPABASE_PROD_ANON_KEY }} >> $GITHUB_ENV
            echo SUPABASE_SITE_URL=${{ secrets.SUPABASE_PROD_SITE_URL }} >> $GITHUB_ENV
            echo GOOGLE_CLIENT_ID=${{ secrets.SUPABASE_PROD_GOOGLE_CLIENT_ID }} >> $GITHUB_ENV
          else
            echo CLOUDFLARE_PROJECT_NAME=${{ secrets.CLOUDFLARE_PROJECT_NAME_STAGE }} >> $GITHUB_ENV

            echo SUPABASE_URL=${{ secrets.SUPABASE_STAGE_URL }} >> $GITHUB_ENV
            echo SUPABASE_ANON_KEY=${{ secrets.SUPABASE_STAGE_ANON_KEY }} >> $GITHUB_ENV
            echo SUPABASE_SITE_URL=${{ secrets.SUPABASE_STAGE_SITE_URL }} >> $GITHUB_ENV
            echo GOOGLE_CLIENT_ID=${{ secrets.SUPABASE_STAGE_GOOGLE_CLIENT_ID }} >> $GITHUB_ENV
          fi

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: "3.32.7"
          channel: "stable"
          cache: true
          cache-key: "flutter-:os:-:channel:-:version:-:arch:-:hash:"
          cache-path:
            "${{ runner.tool_cache }}/flutter/:channel:-:version:-:arch:"

      - name: Install Dependencies
        run: |
          flutter pub get

      - name: Build
        run: |
          flutter config --enable-web
          flutter build web --release --dart-define SUPABASE_URL=${{ env.SUPABASE_URL }} --dart-define SUPABASE_ANON_KEY=${{ env.SUPABASE_ANON_KEY }} --dart-define SUPABASE_SITE_URL=${{ env.SUPABASE_SITE_URL }} --dart-define GOOGLE_CLIENT_ID=${{ env.GOOGLE_CLIENT_ID }}

      - name: Publish to Cloudflare Pages
        uses: cloudflare/pages-action@v1
        if:
          github.ref == 'refs/heads/main' || (github.event_name == 'release' &&
          github.event.action == 'published')
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          projectName: ${{ env.CLOUDFLARE_PROJECT_NAME }}
          directory: ./app/build/web
          branch: main

  # The "macOS" job builds the Flutter macOS app and uploads it to the GitHub
  # release or the pull request. The job only runs for pull requests and when a
  # new release is published.
  macos:
    name: macOS
    runs-on: macos-14
    if:
      github.event_name == 'pull_request' || (github.event_name == 'release' &&
      github.event.action == 'published')
    permissions:
      contents: write
    defaults:
      run:
        working-directory: "app"

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: "3.32.7"
          channel: "stable"
          cache: true
          cache-key: "flutter-:os:-:channel:-:version:-:arch:-:hash:"
          cache-path:
            "${{ runner.tool_cache }}/flutter/:channel:-:version:-:arch:"

      - name: Install Dependencies
        run: |
          flutter pub get

      - name: Build
        run: |
          flutter config --enable-macos-desktop
          flutter config --enable-swift-package-manager
          FLUTTER_XCODE_CODE_SIGN_IDENTITY="" FLUTTER_XCODE_CODE_SIGNING_REQUIRED=NO flutter build macos --release --dart-define SUPABASE_URL=${{ secrets.SUPABASE_PROD_URL }} --dart-define SUPABASE_ANON_KEY=${{ secrets.SUPABASE_PROD_ANON_KEY }} --dart-define SUPABASE_SITE_URL=${{ secrets.SUPABASE_PROD_SITE_URL }} --dart-define GOOGLE_CLIENT_ID=${{ secrets.SUPABASE_PROD_GOOGLE_CLIENT_ID }}

      - name: Package
        run: |
          ditto -c -k --keepParent "build/macos/Build/Products/Release/FeedDeck.app" "build/macos/Build/Products/Release/feeddeck-macos-universal.zip"

      - name: Upload Artifacts (PR)
        if: ${{ github.event_name == 'pull_request' }}
        uses: actions/upload-artifact@v7
        with:
          name: feeddeck-macos-universal.zip
          path: app/build/macos/Build/Products/Release/feeddeck-macos-universal.zip
          if-no-files-found: error

      - name: Upload Artifacts (Release)
        uses: shogo82148/actions-upload-release-asset@v1
        if:
          ${{ github.event_name == 'release' && github.event.action ==
          'published' }}
        with:
          upload_url: ${{ github.event.release.upload_url }}
          asset_path: app/build/macos/Build/Products/Release/feeddeck-macos-universal.zip

  # The "Linux (x86_64)" job builds the Flutter Linux app and uploads it to the
  # GitHub release or the pull request. The job only runs for pull requests and
  # when a new release is published.
  linux-x86_64:
    name: Linux (x86_64)
    runs-on: ubuntu-latest
    if:
      github.event_name == 'pull_request' || (github.event_name == 'release' &&
      github.event.action == 'published')
    permissions:
      contents: write
    defaults:
      run:
        working-directory: "app"

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Install Packages
        run: |
          # Required for Flutter
          sudo apt-get update -y
          sudo apt-get install -y ninja-build libgtk-3-dev
          # Required for Package "media_kit" which is used via
          # "just_audio_media_kit" for Linux and Windows:
          # See: https://pub.dev/packages/media_kit and https://pub.dev/packages/just_audio_media_kit
          sudo apt-get install -y libmpv-dev mpv

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: "3.32.7"
          channel: "stable"
          cache: true
          cache-key: "flutter-:os:-:channel:-:version:-:arch:-:hash:"
          cache-path:
            "${{ runner.tool_cache }}/flutter/:channel:-:version:-:arch:"

      - name: Install Dependencies
        run: |
          flutter pub get

      - name: Build
        run: |
          flutter config --enable-linux-desktop
          flutter build linux --release --dart-define SUPABASE_URL=${{ secrets.SUPABASE_PROD_URL }} --dart-define SUPABASE_ANON_KEY=${{ secrets.SUPABASE_PROD_ANON_KEY }} --dart-define SUPABASE_SITE_URL=${{ secrets.SUPABASE_PROD_SITE_URL }} --dart-define GOOGLE_CLIENT_ID=${{ secrets.SUPABASE_PROD_GOOGLE_CLIENT_ID }}

      - name: Package
        run: |
          cp linux/flatpak/app.feeddeck.feeddeck.desktop build/linux/x64/release/bundle/
          cp linux/flatpak/app.feeddeck.feeddeck.metainfo.xml build/linux/x64/release/bundle/
          cp linux/flatpak/app.feeddeck.feeddeck.svg build/linux/x64/release/bundle/
          cd build
          cp -r linux/x64/release/bundle/ feeddeck-linux-x86_64
          tar -czf feeddeck-linux-x86_64.tar.gz feeddeck-linux-x86_64

      - name: Upload Artifacts (PR)
        if: ${{ github.event_name == 'pull_request' }}
        uses: actions/upload-artifact@v7
        with:
          name: feeddeck-linux-x86_64.tar.gz
          path: app/build/feeddeck-linux-x86_64.tar.gz
          if-no-files-found: error

      - name: Upload Artifacts (Release)
        uses: shogo82148/actions-upload-release-asset@v1
        if:
          ${{ github.event_name == 'release' && github.event.action ==
          'published' }}
        with:
          upload_url: ${{ github.event.release.upload_url }}
          asset_path: app/build/feeddeck-linux-x86_64.tar.gz

  # The "Linux (arm64)" job builds the Flutter Linux app and uploads it to the
  # GitHub release or the pull request. The job only runs for pull requests and
  # when a new release is published.
  #
  # NOTE: Normally this job should run for every pull request and when a new
  # release is published, but since we have to pay for the
  # "ubicloud-standard-2-arm" runner, we only run the job when a new release is
  # published.
  linux-arm64:
    name: Linux (arm64)
    runs-on: ubicloud-standard-2-arm
    if: github.event_name == 'release' && github.event.action == 'published'
    # if: github.event_name == 'pull_request' || (github.event_name == 'release' && github.event.action == 'published')
    permissions:
      contents: write
    defaults:
      run:
        working-directory: "app"

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Install Packages
        run: |
          # Required for Flutter
          sudo apt-get update -y
          sudo apt-get install -y ninja-build libgtk-3-dev
          # Required for Package "media_kit" which is used via
          # "just_audio_media_kit" for Linux and Windows:
          # See: https://pub.dev/packages/media_kit and https://pub.dev/packages/just_audio_media_kit
          sudo apt-get install -y libmpv-dev mpv

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: "3.32.7"
          channel: "master"
          cache: true
          cache-key: "flutter-:os:-:channel:-:version:-:arch:-:hash:"
          cache-path:
            "${{ runner.tool_cache }}/flutter/:channel:-:version:-:arch:"

      - name: Install Dependencies
        run: |
          flutter pub get

      - name: Build
        run: |
          flutter config --enable-linux-desktop
          flutter build linux --release --dart-define SUPABASE_URL=${{ secrets.SUPABASE_PROD_URL }} --dart-define SUPABASE_ANON_KEY=${{ secrets.SUPABASE_PROD_ANON_KEY }} --dart-define SUPABASE_SITE_URL=${{ secrets.SUPABASE_PROD_SITE_URL }} --dart-define GOOGLE_CLIENT_ID=${{ secrets.SUPABASE_PROD_GOOGLE_CLIENT_ID }}

      - name: Package
        run: |
          cp linux/flatpak/app.feeddeck.feeddeck.desktop build/linux/arm64/release/bundle/
          cp linux/flatpak/app.feeddeck.feeddeck.metainfo.xml build/linux/arm64/release/bundle/
          cp linux/flatpak/app.feeddeck.feeddeck.svg build/linux/arm64/release/bundle/
          cd build
          cp -r linux/arm64/release/bundle/ feeddeck-linux-arm64
          tar -czf feeddeck-linux-arm64.tar.gz feeddeck-linux-arm64

      - name: Upload Artifacts (PR)
        if: ${{ github.event_name == 'pull_request' }}
        uses: actions/upload-artifact@v7
        with:
          name: feeddeck-linux-arm64.tar.gz
          path: app/build/feeddeck-linux-arm64.tar.gz
          if-no-files-found: error

      - name: Upload Artifacts (Release)
        uses: shogo82148/actions-upload-release-asset@v1
        if:
          ${{ github.event_name == 'release' && github.event.action ==
          'published' }}
        with:
          upload_url: ${{ github.event.release.upload_url }}
          asset_path: app/build/feeddeck-linux-arm64.tar.gz

  # The "Windows" job builds the Flutter Windows app and uploads it to the
  # GitHub release or the pull request. The job only runs for pull requests and
  # when a new release is published.
  windows:
    name: Windows
    runs-on: windows-latest
    if:
      github.event_name == 'pull_request' || (github.event_name == 'release' &&
      github.event.action == 'published')
    permissions:
      contents: write
    defaults:
      run:
        working-directory: "app"

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: "3.32.7"
          channel: "stable"
          cache: true
          cache-key: "flutter-:os:-:channel:-:version:-:arch:-:hash:"
          cache-path:
            "${{ runner.tool_cache }}/flutter/:channel:-:version:-:arch:"

      - name: Install Dependencies
        run: |
          flutter pub get

      - name: Build
        run: |
          flutter config --enable-windows-desktop
          flutter build windows --release --dart-define SUPABASE_URL=${{ secrets.SUPABASE_PROD_URL }} --dart-define SUPABASE_ANON_KEY=${{ secrets.SUPABASE_PROD_ANON_KEY }} --dart-define SUPABASE_SITE_URL=${{ secrets.SUPABASE_PROD_SITE_URL }} --dart-define GOOGLE_CLIENT_ID=${{ secrets.SUPABASE_PROD_GOOGLE_CLIENT_ID }}
      - name: Create Archive
        run: |
          Compress-Archive -Path build/windows/x64/runner/Release/* -Destination feeddeck-windows-x86_64.zip

      - name: Package
        run: |
          flutter pub run msix:create --output-path build --output-name feeddeck
          cd build
          7z a -tzip feeddeck-windows-x86_64-msix.zip feeddeck.msix

      - name: Upload Artifacts (PR)
        if: ${{ github.event_name == 'pull_request' }}
        uses: actions/upload-artifact@v7
        with:
          name: feeddeck-windows-x86_64.zip
          path: app/feeddeck-windows-x86_64.zip
          if-no-files-found: error

      - name: Upload Artifacts (Release)
        uses: shogo82148/actions-upload-release-asset@v1
        if:
          ${{ github.event_name == 'release' && github.event.action ==
          'published' }}
        with:
          upload_url: ${{ github.event.release.upload_url }}
          asset_path: app/feeddeck-windows-x86_64.zip

      - name: Upload Artifacts (PR)
        if: ${{ github.event_name == 'pull_request' }}
        uses: actions/upload-artifact@v7
        with:
          name: feeddeck-windows-x86_64-msix.zip
          path: app/build/feeddeck-windows-x86_64-msix.zip
          if-no-files-found: error

      - name: Upload Artifacts (Release)
        uses: shogo82148/actions-upload-release-asset@v1
        if:
          ${{ github.event_name == 'release' && github.event.action ==
          'published' }}
        with:
          upload_url: ${{ github.event.release.upload_url }}
          asset_path: app/build/feeddeck-windows-x86_64-msix.zip

  # The "iOS" job builds the Flutter iOS app on every pull request. This is only
  # used to test that the build of the iOS app works. The artifact of the build
  # isn't uploaded / used.
  ios:
    name: iOS
    runs-on: macos-14
    if:
      github.event_name == 'pull_request' || (github.event_name == 'release' &&
      github.event.action == 'published')
    defaults:
      run:
        working-directory: "app"

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: "3.32.7"
          channel: "stable"
          cache: true
          cache-key: "flutter-:os:-:channel:-:version:-:arch:-:hash:"
          cache-path:
            "${{ runner.tool_cache }}/flutter/:channel:-:version:-:arch:"

      - name: Install Dependencies
        run: |
          flutter pub get

      - name: Build
        run: |
          flutter config --enable-ios
          flutter config --enable-swift-package-manager
          flutter build ipa --no-codesign --release --dart-define SUPABASE_URL=${{ secrets.SUPABASE_PROD_URL }} --dart-define SUPABASE_ANON_KEY=${{ secrets.SUPABASE_PROD_ANON_KEY }} --dart-define SUPABASE_SITE_URL=${{ secrets.SUPABASE_PROD_SITE_URL }} --dart-define GOOGLE_CLIENT_ID=${{ secrets.SUPABASE_PROD_GOOGLE_CLIENT_ID }}

  # The "Android" job builds the Flutter Android app on every pull request. This
  # is only used to test that the build of the Android app works. The artifact
  # of the build isn't uploaded / used.
  android:
    name: Android
    runs-on: ubuntu-latest
    if:
      github.event_name == 'pull_request' || (github.event_name == 'release' &&
      github.event.action == 'published')
    defaults:
      run:
        working-directory: "app"

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Java
        run: echo "JAVA_HOME=$JAVA_HOME_17_X64" >> $GITHUB_ENV

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: "3.32.7"
          channel: "stable"
          cache: true
          cache-key: "flutter-:os:-:channel:-:version:-:arch:-:hash:"
          cache-path:
            "${{ runner.tool_cache }}/flutter/:channel:-:version:-:arch:"

      - name: Install Dependencies
        run: |
          flutter pub get

      - name: Build
        run: |
          flutter config --enable-android
          flutter build appbundle --release --dart-define SUPABASE_URL=${{ secrets.SUPABASE_PROD_URL }} --dart-define SUPABASE_ANON_KEY=${{ secrets.SUPABASE_PROD_ANON_KEY }} --dart-define SUPABASE_SITE_URL=${{ secrets.SUPABASE_PROD_SITE_URL }} --dart-define GOOGLE_CLIENT_ID=${{ secrets.SUPABASE_PROD_GOOGLE_CLIENT_ID }}