.gitlab-ci.yml

# Clone git repository recursively
variables:
  GIT_SUBMODULE_STRATEGY: recursive
  NODE_VERSION: '20.11.1'
  PROTOC_VERSION: '23.4'
  RUST_VERSION: '1.82.0' # Should be kept in sync with src/launcher/rust-toolchain.toml
  FF_DISABLE_UMASK_FOR_DOCKER_EXECUTOR: 'true'

default:
  image: docker.io/node:${NODE_VERSION}-bookworm
  hooks:
    pre_get_sources_script:
      # FF_DISABLE_UMASK_FOR_DOCKER_EXECUTOR disables the umask here,
      # but executes a chown to the job's container user - if it is not root.
      # In case the last runner's job was not root, it leaves files that are owned by
      # some other user - breaking npm's chown. See:
      # - https://gitlab.com/gitlab-org/gitlab-runner/-/issues/1736
      # - https://gitlab.com/gitlab-org/gitlab/-/issues/368133
      - |
        if [ "$(uname)" = "Linux" ] && [ -d "${CI_PROJECT_DIR}" ]; then
          echo "Reset permissions of path ${CI_PROJECT_DIR} to root:root"
          chown -R root:root "${CI_PROJECT_DIR}"
        fi

# Workflow: Run for tags and commits to branches
workflow:
  rules:
    - if: $CI_COMMIT_TAG
    - if: $CI_COMMIT_BRANCH

# CI stages
stages:
  - build
  - test
  - package

# Caching config for npm based jobs
.cache: &cache
  cache:
    key:
      files:
        - package-lock.json
    paths:
      - .npm/
      - node_modules/

# Generic "before script" steps that show versions
.before_script_show_versions: &before_script_show_versions
  - node --version
  - npm --version

# Generic "before script" that installs Cargo binaries on Linux x64
.before_script_install_cargo: &before_script_install_cargo
  - |
    mkdir /rust
    pushd /rust
    export RUST_ARCHIVE=rust-${RUST_VERSION}-x86_64-unknown-linux-gnu.tar.gz
    export RUST_DOWNLOAD_URL=https://static.rust-lang.org/dist/$RUST_ARCHIVE
    curl --proto '=https' --tlsv1.2 -fsOSL $RUST_DOWNLOAD_URL
    curl --proto '=https' --tlsv1.2 -s $RUST_DOWNLOAD_URL.sha256 | sha256sum -c -
    tar -C /rust -xzf $RUST_ARCHIVE --strip-components=1
    rm $RUST_ARCHIVE
    ./install.sh
    popd

# Generic "before script" for Windows to set up nvm
.before_script_windows: &before_script_windows
  - echo "Original `$Path is $env:Path"
  - echo "Original `$LIB is $env:LIB"
  # Update env variables
  - $env:Path += ";C:\\ProgramData\\nvm"
  - $env:Path += ";C:\\Users\\Developer\\.cargo\\bin"
  - $env:NVM_HOME = "C:\\ProgramData\\nvm"
  - $env:NVM_SYMLINK = "C:\\Program Files\\nodejs"
  # Ensure the proper node version is available
  - echo "Installing and using node version "(cat .nvmrc)
  - nvm version
  # Note: With nvm-windows <=1.1.9 there's a bug if the .nvmrc file does not contain
  # an exact version: https://github.com/coreybutler/nvm-windows/pull/709
  # Version 1.1.10 fixes it. Remove this note once that version is available on Chocolatey.
  - nvm install (cat .nvmrc)
  - nvm use (cat .nvmrc)
  # Set up visual studio env
  - "& 'C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\BuildTools\\Common7\\Tools\\Launch-VsDevShell.ps1'"
  # Print path again
  - echo "Updated `$Path is $env:Path"
  - echo "Updated `$LIB is $env:LIB"
  # Show versions
  - node --version
  - npm --version
  - curl.exe --version
  - cargo +stable --version

# Download Lab Grotesque fonts (for POSIX systems)
.before_script_download_fonts: &before_script_download_fonts
  - |
    if [ -n "$FONT_URL_LAB_GROTESQUE" ]; then
      mkdir -p src/public/res/fonts/lab-grotesque/
      pushd src/public/res/fonts/lab-grotesque/
      curl --proto '=https' --tlsv1.2 -o lab-grotesque.tar.gz "$FONT_URL_LAB_GROTESQUE"
      tar xfv lab-grotesque.tar.gz
      rm lab-grotesque.tar.gz
      echo "Downloaded Lab Grotesque font"
      popd
    else
      echo "\$FONT_URL_LAB_GROTESQUE not defined, not including Lab Grotesque font"
    fi

dist:
  stage: build
  needs: []
  <<: *cache
  before_script:
    - *before_script_show_versions
  script:
    - set -euo pipefail
    - bash tools/run-with-retry.sh --retries 3 --delay 15 -- npm ci --cache .npm
    # Note: Launcher binary is tested using a separate job, so we skip it here
    - SKIP_LAUNCHER_BINARY=true npm run "dist:consumer-sandbox"

flatpak-source-generator:
  stage: build
  needs: []
  before_script:
    # Base dependencies
    - apt-get update && apt-get install -y python3-aiohttp python3-toml
  script:
    - set -euo pipefail
    # Install build script deps
    - bash tools/run-with-retry.sh --retries 3 --delay 15 -- npm ci
    # Run flatpak source generators
    - npm run package -- flatpak work-sandbox --generate-deps-only
  cache:
    # npm cache
    - key:
        files:
          - package-lock.json
      paths:
        - .npm/
        - node_modules/

launcher:
  stage: build
  needs: []
  image: rust:${RUST_VERSION}
  script:
    - set -euo pipefail
    - cd src/launcher/ && cargo check
  variables:
    RUSTFLAGS: '-D warnings'
    THREEMA_BUILD_FLAVOR: consumer-sandbox

source-dist:
  stage: build
  needs: []
  before_script:
    - apt-get update && apt-get install -y p7zip
  script:
    - bash packaging/generate-source-dist.sh
  artifacts:
    paths:
      - build/out/
    expire_in: 2d

lint:
  stage: test
  needs: []
  <<: *cache
  before_script:
    - *before_script_show_versions
  script:
    - set -euo pipefail
    - bash tools/run-with-retry.sh --retries 3 --delay 15 -- npm ci --cache .npm
    - npm run "lint:$TARGET"
  parallel:
    matrix:
      - TARGET:
          - tsc:parallel
          - eslint
          - prettier
          - svelte

audit:
  stage: test
  needs: []
  <<: *cache
  before_script:
    - *before_script_show_versions
  script:
    - set -euo pipefail
    - bash tools/run-with-retry.sh --retries 3 --delay 15 -- npm ci --cache .npm
    - npm audit --audit-level moderate
  allow_failure: true

test:karma:
  image: $CI_REGISTRY/operations/dockerfiles/node-browsers:${NODE_VERSION}
  stage: test
  needs: []
  cache:
    key:
      files:
        - package-lock.json
      prefix: node-browsers
    paths:
      - .npm/
      - node_modules/
  before_script:
    - *before_script_show_versions
  script:
    - set -euo pipefail
    # Install deps
    - bash tools/run-with-retry.sh --retries 3 --delay 15 -- npm ci --cache .npm
    # Run tests
    - npm run "test:karma" -- --browsers FirefoxHeadless,ChromiumHeadlessNoSandbox
    # Generate JUnit test report
    - npm run "test:karma" -- --browsers ChromiumHeadlessNoSandbox --reporters junit
  artifacts:
    when: always
    reports:
      junit:
        - junit/karma.xml

test:mocha:linux:
  stage: test
  needs: []
  <<: *cache
  before_script:
    - *before_script_show_versions
  script:
    - set -euo pipefail
    - bash tools/run-with-retry.sh --retries 3 --delay 15 -- npm ci --cache .npm
    # Run tests (with increased timeout of 10s, to avoid test failures when load on CI runner is high)
    - npm run "test:mocha" -- --timeout 10000
    # Generate JUnit test report
    - npm run "test:mocha" -- --timeout 10000 --reporter mocha-junit-reporter --reporter-options mochaFile=./junit/mocha.xml
  artifacts:
    when: always
    reports:
      junit:
        - junit/mocha.xml

test:playwright:linux:
  stage: test
  needs: []
  <<: *cache
  before_script:
    - apt-get update && apt-get install -y xvfb libxshmfence1 libnss3 libatk1.0-0 libatk-bridge2.0-0 libdrm2 libgtk-3-0 libgbm1 libasound2
  script:
    - set -euo pipefail
    - bash tools/run-with-retry.sh --retries 3 --delay 15 -- npm ci --cache .npm
    - SKIP_LAUNCHER_BINARY=true npm run dist:test:consumer-sandbox
    - xvfb-run npm run test:playwright:consumer-sandbox
  artifacts:
    expire_in: 1d
    paths:
      - build/playwright/

test:mocha:windows:
  stage: test
  # Build on Windows (powershell)
  tags:
    - windows
  needs: []
  before_script:
    - *before_script_windows
  script:
    # Install dependencies
    - npm ci --cache .npm
    # Run tests (with increased timeout of 10s, to avoid test failures when load on CI runner is high)
    - npm run "test:mocha" -- --timeout 10000

# TODO(DESK-321): Fix! Right now this segfaults.
# Additionally, the kill-on-error functionality was removed, so in
# order to get the smoke test to run:
#
# - Call `electron.app.exit(EXIT_CODE_UNCAUGHT_ERROR)` from within `handleCriticalError`
#   if a certain env var is set
# - Set that env var in CI
#test:smoketest:
#  stage: test
#  needs: []
#  <<: *cache
#  before_script:
#    - apt-get update && apt-get install -y xvfb libxshmfence1 libnss3 libatk1.0-0 libatk-bridge2.0-0 libdrm2 libgtk-3-0 libgbm1 libasound2
#  script:
#    - npm ci --cache .npm
#    - npm run rebuild
#    # Start electron application and wait for up to 45s
#    - (xvfb-run npm run dev:consumer-sandbox -- --no-sandbox && echo "success" > "result.txt") || echo "error" > result.txt &
#    - for i in $(seq 45); do if [[ -f result.txt ]]; then break; else sleep 1; fi; done
#    # Make sure application is stopped
#    - if [[ -f "electron.pid" ]]; then kill -INT $(cat electron.pid); fi
#    # Check result
#    - 'echo "Result: $(<result.txt)"'
#    - if [[ "$(<result.txt)" != "success" ]]; then exit 1; fi

package-lock-in-sync:
  stage: test
  needs: []
  <<: *cache
  before_script:
    - node --version
    - npm --version
  script:
    - set -euo pipefail
    # Install npm dependencies
    # Note: Use "npm install", not "npm ci"!
    - bash tools/run-with-retry.sh --retries 3 --delay 15 -- npm install --cache .npm
    # Ensure that there are no local changes to package-lock.json
    - |
      DIFF="$(git diff)"
      if [[ -n "$DIFF" ]]; then
        echo -e "\e[31mFound local changes after running 'npm install'. Lockfile out of sync?\e[0m"
        echo -e "\n$ git diff:\n$DIFF"
        exit 1
      else
        echo -e "\e[32mNo changes detected after running 'npm install'\e[0m"
      fi

i18n-translations-in-sync:
  stage: test
  needs: []
  <<: *cache
  before_script:
    - node --version
    - npm --version
  script:
    - set -euo pipefail
    # Install npm dependencies
    - bash tools/run-with-retry.sh --retries 3 --delay 15 -- npm ci --cache .npm
    # Parse i18n translations found in code into translation files
    - npm run i18n:parse
    # Ensure that there are no local changes to the translation files
    - |
      DIFF="$(git diff)"
      if [[ -n "$DIFF" ]]; then
        echo -e "\e[31mFound local changes after running 'npm run i18n:parse'. Translations out of sync?\e[0m"
        echo -e "\n$ git diff:\n$DIFF"
        exit 1
      else
        echo -e "\e[32mNo changes detected after running 'npm run i18n:parse'\e[0m"
      fi

validate-metainfo:
  stage: test
  needs: []
  before_script:
    - apt-get update && apt-get install -y appstream-util
  script:
    - set -euo pipefail
    - |
      G_DEBUG=fatal-criticals
      SUCCESS_VALIDATE=1
      appstream-util validate packaging/metadata/ch.threema.threema-desktop.metainfo.xml || SUCCESS_VALIDATE=0
      if [[ "$SUCCESS_VALIDATE" -ne 1 ]]; then
        # If regular validation failed, validate with "validate-relax". If that
        # succeeds, mark the build as "successful with warnings" (though the
        # custom exit code).
        echo "Validation with 'validate' failed. Retrying with 'validate-relax'."
        appstream-util validate-relax packaging/metadata/ch.threema.threema-desktop.metainfo.xml
        exit 123
      fi
  allow_failure:
    exit_codes:
      - 123

package:source:
  stage: package
  rules:
    - if: $CI_COMMIT_BRANCH == 'develop'
    - if: $CI_COMMIT_TAG =~ /^v[0-9a-z\.-]*$/
  <<: *cache
  before_script:
    - apt-get update && apt-get install -y p7zip
  script:
    - set -euo pipefail
    # Handle ref
    - |
      echo "\$CI_COMMIT_REF_NAME=$CI_COMMIT_REF_NAME"
      if [[ "$CI_COMMIT_REF_NAME" = "develop" ]]; then
        export BUILD_TYPE=nightly
      elif [[ "$CI_COMMIT_REF_NAME" = v* ]]; then
        export BUILD_TYPE=release
      else
        echo "Error: Invalid ref"
        exit 1
      fi
      echo "Build type is $BUILD_TYPE"
    # Install deps
    - bash tools/run-with-retry.sh --retries 3 --delay 15 -- npm ci --cache .npm
    # Bundle source
    - npm run package source "$CI_COMMIT_REF_NAME"
    # Upload source bundle
    - |
      if [ "$BUILD_TYPE" = "release" ]; then
        pushd build/out/
        for FILENAME in *-source.*; do
          # Ensure that file wasn't already uploaded
          FTP_STATUS=$(curl -o /dev/null -s -w "%{http_code}" -I "${FTP_PROTO}://${FTP_HOST}${FTP_PATH}/releases/$FILENAME" --user "$FTP_USER:$FTP_RELEASE_PASS" || true)
          if [ "$FTP_STATUS" = "350" ]; then echo "File already exists"; exit 42; fi
          # Upload
          curl -T "$FILENAME" "${FTP_PROTO}://${FTP_HOST}${FTP_PATH}/releases/$FILENAME" --user "$FTP_USER:$FTP_RELEASE_PASS"
        done
        popd
      fi
  variables:
    FTP_HOST: $FTP_RELEASE_HOST
    FTP_PROTO: $FTP_RELEASE_PROTO
    FTP_PATH: /
    FTP_USER: threema-desktop
    # Set FTP_RELEASE_PASS masked variable in CI!
  artifacts:
    paths:
      - build/out/
    expire_in: 2d

.flatpak: &flatpak
  stage: package
  # Build using a privileged runner, required for Flatpak
  # https://github.com/flatpak/flatpak/issues/3027
  tags:
    - docker-privileged
  before_script:
    - set -euo pipefail
    # Base dependencies
    - apt-get update
    - apt-get install -y flatpak jq lftp elfutils libyaml-dev libglib2.0-dev libcurl4-gnutls-dev libxml2-dev libxslt1-dev python3-aiohttp python3-toml
    # Set up git
    - git config --global init.defaultBranch main # Avoid warning on stdout
    - git config --global advice.detachedHead false # Don't show detached head warnings
    # Build current version of flatpak-builder
    - apt-get install -y meson cmake debugedit appstream appstream-compose libjson-glib-dev libelf-dev libostree-dev
    - |
      pushd /opt/
      wget https://github.com/flatpak/flatpak-builder/releases/download/1.4.3/flatpak-builder-1.4.3.tar.xz
      tar xf flatpak-builder-1.4.3.tar.xz
      cd flatpak-builder-1.4.3
      meson setup --prefix=/usr --buildtype=release -Ddocs=disabled _build
      meson install -C _build
      popd
    # Add flathub remote
    - flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
    # Import PGP key
    - KEYFILE_ENV_VAR="GPG_KEY_${GPG_ID}"; gpg --import ${!KEYFILE_ENV_VAR}
    # Run SSH agent
    - eval $(ssh-agent -s)
    # Add SSH deploy key
    - chmod 400 $SSH_DEPLOY_KEY && ssh-add $SSH_DEPLOY_KEY
    # Fetch fonts
    - *before_script_download_fonts
  script:
    - set -euo pipefail
    # Handle ref
    - |
      echo "\$CI_COMMIT_REF_NAME=$CI_COMMIT_REF_NAME"
      if [[ "$CI_COMMIT_REF_NAME" = "develop" ]]; then
        export BUILD_TYPE=nightly
      elif [[ "$CI_COMMIT_REF_NAME" = v* ]]; then
        export BUILD_TYPE=release
      elif [[ "$PUBLISH" = "false" ]]; then
        export BUILD_TYPE=nightly
      else
        echo "Error: Invalid ref"
        exit 1
      fi
      echo "Build type is $BUILD_TYPE"
    # Install build script deps
    - bash tools/run-with-retry.sh --retries 3 --delay 15 -- npm ci
    # Determine some build type dependent parameters
    - |
      case "$BUILD_TYPE" in
        nightly)
          BRANCH=master
          REPO="$REPO-nightly"
          REMOTE="$REMOTE-nightly"
          ;;
        release)
          BRANCH=master
          ;;
        *)
          echo "Invalid build type: $BUILD_TYPE"
          exit 1
      esac
    # Patch metadata for nightlies
    - |
      if [ "$BUILD_TYPE" = "nightly" ]; then
        VERSION=$(jq -r '.version' package.json)
        GIT_REVISION=$(git rev-parse --short HEAD)
        DATE=$(date +%Y-%m-%d)
        # Metainfo file
        sed -i "s/\(^.*version=\"$VERSION\".*\)/<release version=\"${VERSION}-nightly-${GIT_REVISION}\" date=\"$DATE\" \/>\n\1/" packaging/metadata/ch.threema.threema-desktop.metainfo.xml
      fi
    # Build flatpak
    - |
      export THREEMADESKTOP_FLATPAK_BRANCH=$BRANCH
      export THREEMADESKTOP_FLATPAK_GPG_KEY=$GPG_ID
      npm run package flatpak "$FLAVORS"
    # Create .flatpakref files
    - |
      IFS=',' read -ra flavors <<< "$FLAVORS"
      for flavor in "${flavors[@]}"; do
        case "$flavor" in
          consumer-live)
            APPID="ch.threema.threema-desktop"
            TITLE="Threema Beta"
            ;;
          work-sandbox)
            APPID="ch.threema.threema-blue-desktop"
            TITLE="Threema Blue Beta"
            ;;
          work-live)
            APPID="ch.threema.threema-work-desktop"
            TITLE="Threema Work Beta"
            ;;
          work-onprem)
            APPID="ch.threema.threema-onprem-desktop"
            TITLE="Threema OnPrem Beta"
            ;;
          *)
            echo "Invalid build flavor: $flavor"
            exit 1
        esac

        FREF="packaging/flatpak/repo/${APPID}.flatpakref"
        cat <<__EOF__ > $FREF
      [Flatpak Ref]
      Version=1
      Name=$APPID
      Branch=$BRANCH
      Title=$TITLE
      Homepage=https://threema.ch/
      Url=$REPO_BASE_URL/$REPO/
      SuggestRemoteName=$REMOTE
      RuntimeRepo=https://dl.flathub.org/repo/flathub.flatpakrepo
      IsRuntime=false
      GPGKey=$(gpg --export $GPG_ID | base64 --wrap=0)
      __EOF__
        echo "$FREF:"
        cat $FREF
        echo "---"
      done
    # Copy screenshot(s)
    - cp packaging/flatpak/screenshot-* packaging/flatpak/repo/
    # Dump gpg public key
    - gpg --export --armor $GPG_ID > packaging/flatpak/repo/signkey.pub
    # Sync to server
    - |
      if [ "$PUBLISH" = "true" ]; then
        mkdir -p sync
        mv packaging/flatpak/repo sync/$REPO
        echo "Syncing $REPO to FTP server"
        lftp -e "mirror -R sync/$REPO /$REPO; exit" -u $FTP_USER,"$FTP_PASS" $FTP_HOST
      else
        echo "Skipping publication, \$PUBLISH=$PUBLISH"
      fi
  cache:
    # npm cache
    - key:
        files:
          - package-lock.json
      paths:
        - .npm/
        - node_modules/
    # flatpak-builder cache and ccache
    - key: $CI_COMMIT_REF_SLUG
      paths:
        - packaging/flatpak/.flatpak-builder/

# An optional, manually-triggered, build-but-not-publish flatpak job
package:flatpak-buildonly:
  <<: *flatpak
  needs: []
  rules:
    - if: $CI_COMMIT_BRANCH == 'develop'
      when: never
    - if: $CI_COMMIT_TAG =~ /^v[0-9a-z\.-]*$/
      when: never
    - when: manual
  allow_failure: true # Job is optional
  variables:
    REPO: repo
    REPO_BASE_URL: $FLATPAK_INTERNAL_REPO_BASE_URL
    REMOTE: threema-internal
    FLAVORS: consumer-live,work-sandbox,work-live,work-onprem
    GPG_ID: BF7BBB57363D6233178AC7CCE4D4F1B275BB5D72
    PUBLISH: 'false'

package:flatpak-internal-publish:
  <<: *flatpak
  rules:
    - if: $CI_COMMIT_BRANCH == 'develop'
    - if: $CI_COMMIT_TAG =~ /^v[0-9a-z\.-]*$/
  variables:
    REPO: repo
    REPO_BASE_URL: $FLATPAK_INTERNAL_REPO_BASE_URL
    REMOTE: threema-internal
    FLAVORS: consumer-live,work-sandbox,work-live,work-onprem
    GPG_ID: BF7BBB57363D6233178AC7CCE4D4F1B275BB5D72
    PUBLISH: 'true'
    FTP_HOST: $FLATPAK_INTERNAL_FTP_HOST
    FTP_USER: flatpak-internal
    FTP_PASS: $FLATPAK_INTERNAL_FTP_PASS

# Note: Public builds are also pushed to the internal fileserver, and are then
#       published using a separate script.
package:flatpak-public-publish:
  <<: *flatpak
  rules:
    - if: $CI_COMMIT_TAG =~ /^v[0-9a-z\.-]*$/
  variables:
    REPO_BASE_URL: $FLATPAK_PUBLIC_REPO_BASE_URL
    REPO: threema-desktop
    REMOTE: threema-desktop
    FLAVORS: consumer-live,work-live
    GPG_ID: 8BC90B39A3DEA043F88607CA74463EA2AF62F4C6
    PUBLISH: 'true'
    FTP_HOST: $FLATPAK_PUBLIC_FTP_HOST
    FTP_USER: flatpak-internal
    FTP_PASS: $FLATPAK_PUBLIC_FTP_PASS

# An optional, manually-triggered, build-but-not-publish Linux binary job
package:linux-binary-buildonly:
  stage: package
  needs: []
  rules:
    - if: $CI_COMMIT_BRANCH == 'develop'
      when: never
    - if: $CI_COMMIT_TAG =~ /^v[0-9a-z\.-]*$/
      when: never
    - when: manual
  allow_failure: true # Job is optional
  parallel:
    matrix:
      - FLAVOR: [consumer-sandbox, consumer-live, work-sandbox, work-live, work-onprem]
  before_script:
    - *before_script_install_cargo
    - *before_script_download_fonts
  script:
    - set -euo pipefail
    # Install dependencies
    - bash tools/run-with-retry.sh --retries 3 --delay 15 -- npm ci --cache .npm
    # Build EXE binary
    - npm run package binary $FLAVOR
  artifacts:
    paths:
      - build/out/
    expire_in: 2d

.macos: &macos
  stage: package
  parallel:
    matrix:
      - OS: [macos]
        ARCH: [arm64, x64]
  tags:
    - ${OS}-${ARCH}
  before_script:
    # Handle ref
    - |
      echo "\$CI_COMMIT_REF_NAME=$CI_COMMIT_REF_NAME"
      if [[ "$CI_COMMIT_REF_NAME" = v* ]]; then
        export BUILD_TYPE=release
      else
        export BUILD_TYPE=nightly
      fi
      echo "Build type is $BUILD_TYPE"
    # Ensure the proper node version is available
    - nvm install $(cat .nvmrc)
    - nvm use
    # Ensure coreutils are installed
    - brew install coreutils
    # Fetch fonts
    - *before_script_download_fonts
  script:
    - set -euo pipefail
    # Install build script deps
    - bash tools/run-with-retry.sh --retries 3 --delay 15 -- npm ci
    # Patch version
    - |
      if [ "$BUILD_TYPE" = "nightly" ]; then
        sed -i '' \
          's/"version": "\([^"]*\)"/"version": "\1-dev-'$(date +"%Y%m%d")'-'$(git rev-parse --short HEAD)'"/' \
          package.json
      fi
    # Build DMGs (unsigned nightlies, signed releases)
    - |
      case "$PUBLISH" in
        false) buildTarget=dmg ;;
        true) buildTarget=dmgSigned ;;
        *) echo "Invalid PUBLISH env var: $PUBLISH"; exit 1
      esac
      npm run package $buildTarget "$FLAVORS"
    # Rename and upload DMGs
    - mkdir -p build/dmg/
    - |
      IFS=',' read -ra flavors <<< "$FLAVORS"
      for flavor in "${flavors[@]}"; do
        # Determine filename
        case "$flavor" in
          consumer-sandbox)
            FILENAME="threema-green-desktop"
            DMG="ThreemaGreen.dmg"
            ;;
          consumer-live)
            FILENAME="threema-desktop"
            DMG="Threema.dmg"
            ;;
          work-sandbox)
            FILENAME="threema-blue-desktop"
            DMG="ThreemaBlue.dmg"
            ;;
          work-live)
            FILENAME="threema-work-desktop"
            DMG="ThreemaWork.dmg"
            ;;
          work-onprem)
            FILENAME="threema-onprem-desktop"
            DMG="ThreemaOnPrem.dmg"
            ;;
          *)
            echo "Invalid build flavor: $flavor"
            exit 1
        esac
        case "$BUILD_TYPE" in
          nightly)
            FILENAME+="-nightly-$OS-$ARCH.dmg"
            ;;
          release)
            FILENAME+="-$CI_COMMIT_REF_NAME-$OS-$ARCH.dmg"
            ;;
          *)
            echo "Invalid build type: $BUILD_TYPE"
            exit 1
        esac

        # Copy files (used for artifacts)
        for ext in '' '.sha256' '.b2'; do
          echo "Processing $FILENAME$ext"
          cp "build/installers/mac/$DMG$ext" "build/dmg/$FILENAME$ext"
          if [ -n "$ext" ]; then
            cd build/dmg/
            # Patch checksum file
            sed -i '' "s/$DMG/$FILENAME/" "$FILENAME$ext"
            # Test checksum
            ${ext:1}sum -c $FILENAME$ext
            cd -
          fi
        done
        ls -lah build/dmg/

        # Upload
        if [ "$PUBLISH" = "true" ]; then
          case "$BUILD_TYPE" in
            nightly)
              # Upload, overwrite if it exists
              curl -T "build/dmg/$FILENAME" "${FTP_PROTO}://${FTP_HOST}${FTP_PATH}/nightly/$FILENAME" --user "$FTP_USER:$FTP_RELEASE_PASS"
              ;;
            release)
              # Ensure that build wasn't already uploaded
              FTP_STATUS=$(curl -o /dev/null -s -w "%{http_code}" -I "${FTP_PROTO}://${FTP_HOST}${FTP_PATH}/releases/$FILENAME" --user "$FTP_USER:$FTP_RELEASE_PASS" || true)
              if [ "$FTP_STATUS" = "350" ]; then echo "File already exists"; exit 42; fi
              # Upload DMG and checksums
              for ext in '' '.sha256' '.b2'; do
                curl -T "build/dmg/$FILENAME$ext" "${FTP_PROTO}://${FTP_HOST}${FTP_PATH}/releases/$FILENAME$ext" --user "$FTP_USER:$FTP_RELEASE_PASS"
              done
              ;;
            *)
              echo "Invalid build type: $BUILD_TYPE"
              exit 1
          esac
        else
          echo "Skipping publication, \$PUBLISH=$PUBLISH"
        fi
      done
  artifacts:
    paths:
      - build/dmg/
    expire_in: 2d
  cache:
    # npm cache
    - key:
        files:
          - package-lock.json
      paths:
        - .npm/
        - node_modules/

# An optional, manually-triggered, build-but-not-publish macos package job
package:macos-buildonly:
  <<: *macos
  needs: []
  rules:
    - if: $CI_COMMIT_BRANCH == 'develop'
      when: never
    - if: $CI_COMMIT_TAG =~ /^v[0-9a-z\.-]*$/
      when: never
    - when: manual
  allow_failure: true # Job is optional
  variables:
    PUBLISH: 'false'
    FLAVORS: consumer-sandbox,consumer-live,work-sandbox,work-live,work-onprem

# Build and publish macOS packages
package:macos-publish:
  <<: *macos
  rules:
    - if: $CI_COMMIT_BRANCH == 'develop'
    - if: $CI_COMMIT_TAG =~ /^v[0-9a-z\.-]*$/
  variables:
    PUBLISH: 'true'
    FLAVORS: consumer-sandbox,consumer-live,work-sandbox,work-live,work-onprem
    FTP_HOST: $FTP_RELEASE_HOST
    FTP_PROTO: $FTP_RELEASE_PROTO
    FTP_PATH: /
    FTP_USER: threema-desktop
    # Set FTP_RELEASE_PASS masked variable in CI!

.windows: &windows
  stage: package
  # Build on Windows (powershell)
  tags:
    - windows
  before_script:
    # Handle ref
    - |
      echo "`$CI_COMMIT_REF_NAME=$env:CI_COMMIT_REF_NAME"
      if ($env:CI_COMMIT_REF_NAME -eq "develop") {
        $BUILD_TYPE = "nightly"
      } elseif ($env:CI_COMMIT_REF_NAME -like "v*") {
        $BUILD_TYPE = "release"
      } elseif ($env:PUBLISH -eq "false") {
        $BUILD_TYPE = "nightly"
      } else {
        throw "Error: Invalid ref"
      }
      echo "Build type is $BUILD_TYPE"
    - *before_script_windows
  script:
    # Fetch fonts
    - |
      if (Test-Path env:FONT_URL_LAB_GROTESQUE) {
        New-Item -ItemType Directory -Force -Path "src\public\res\fonts\lab-grotesque\"
        Push-Location "src\public\res\fonts\lab-grotesque\"
        Invoke-WebRequest -Uri $env:FONT_URL_LAB_GROTESQUE -OutFile "lab-grotesque.tar.gz"
        tar -xvf lab-grotesque.tar.gz
        Remove-Item lab-grotesque.tar.gz
        echo "Downloaded Lab Grotesque font"
        Pop-Location
      } else {
        echo "\$FONT_URL_LAB_GROTESQUE not defined, not including Lab Grotesque font"
      }

    # Install dependencies
    - npm ci --cache .npm

    # Build MSIX package
    - npm run package msixSigned consumer-live,work-sandbox,work-live,work-onprem

    # Upload
    - dir build\out\
    - |
      if ($env:PUBLISH -eq "true") {
        foreach ($flavor in "consumer-live","work-sandbox","work-live","work-onprem") {
          switch ($flavor) {
            "consumer-live" {
              $name = "threema"
            }
            "work-sandbox" {
              $name = "threema-blue"
            }
            "work-live" {
              $name = "threema-work"
            }
            "work-onprem" {
              $name = "threema-onprem"
            }
          }
          $sourceFileExe = "build/out/${name}-desktop-bin-win32-${env:ARCH}.zip"
          $sourceFileMsix = "build/out/${name}-desktop-windows-${env:ARCH}.msix"
          switch ($BUILD_TYPE) {
            "nightly" {
              $filenameExe = "$name-desktop-nightly-windows-${env:ARCH}.zip"
              $filenameMsix = "$name-desktop-nightly-windows-${env:ARCH}.msix"

              # Upload, overwrite if it exists
              echo "Uploading $filenameExe"
              curl.exe -T "$sourceFileExe" "${env:FTP_PROTO}://${env:FTP_HOST}${env:FTP_PATH}/nightly/$filenameExe" --user "${env:FTP_USER}:${env:FTP_RELEASE_PASS}"
              echo "Uploading $filenameMsix"
              curl.exe -T "$sourceFileMsix" "${env:FTP_PROTO}://${env:FTP_HOST}${env:FTP_PATH}/nightly/$filenameMsix" --user "${env:FTP_USER}:${env:FTP_RELEASE_PASS}"
            }
            "release" {
              $filenameExe = "$name-desktop-$CI_COMMIT_REF_NAME-windows-${env:ARCH}.zip"
              $filenameMsix = "$name-desktop-$CI_COMMIT_REF_NAME-windows-${env:ARCH}.msix"

              # Ensure that build wasn't already uploaded
              $ftp_status = (curl.exe -o NUL -s -w "%{http_code}" -I "${env:FTP_PROTO}://${env:FTP_HOST}${env:FTP_PATH}/releases/$filenameExe" --user "${env:FTP_USER}:${env:FTP_RELEASE_PASS}")
              If ($ftp_status -eq 350) {
                throw "File $filenameExe already exists on FTP server"
              }
              $ftp_status = (curl.exe -o NUL -s -w "%{http_code}" -I "${env:FTP_PROTO}://${env:FTP_HOST}${env:FTP_PATH}/releases/$filenameMsix" --user "${env:FTP_USER}:${env:FTP_RELEASE_PASS}")
              If ($ftp_status -eq 350) {
                throw "File $filenameMsix already exists on FTP server"
              }

              # Upload ZIP, MSIX and checksums
              Foreach ($ext in '','.sha256') {
                echo "Uploading $filenameExe$ext"
                curl.exe -T "$sourceFileExe$ext" "${env:FTP_PROTO}://${env:FTP_HOST}${env:FTP_PATH}/releases/$filenameExe$ext" --user "${env:FTP_USER}:${env:FTP_RELEASE_PASS}"
              }
              Foreach ($ext in '','.sha256') {
                echo "Uploading $filenameMsix$ext"
                curl.exe -T "$sourceFileMsix$ext" "${env:FTP_PROTO}://${env:FTP_HOST}${env:FTP_PATH}/releases/$filenameMsix$ext" --user "${env:FTP_USER}:${env:FTP_RELEASE_PASS}"
              }
            }
            default {
              throw "Error: Invalid build type: $BUILD_TYPE"
            }
          }
        }
      } else {
        echo "Skipping publication, \$PUBLISH=$env:PUBLISH"
      }
  artifacts:
    paths:
      - build\out\
    expire_in: 2d

package:windows-buildonly:
  <<: *windows
  needs: []
  rules:
    - if: $CI_COMMIT_BRANCH == 'develop'
      when: never
    - if: $CI_COMMIT_TAG =~ /^v[0-9a-z\.-]*$/
      when: never
    - when: manual
  allow_failure: true # Job is optional
  variables:
    ARCH: 'x64'
    PUBLISH: 'false'

package:windows-publish:
  <<: *windows
  rules:
    - if: $CI_COMMIT_BRANCH == 'develop'
    - if: $CI_COMMIT_TAG =~ /^v[0-9a-z\.-]*$/
  variables:
    ARCH: 'x64'
    PUBLISH: 'true'
    FTP_HOST: $FTP_RELEASE_HOST
    FTP_PROTO: $FTP_RELEASE_PROTO
    FTP_PATH: /
    FTP_USER: threema-desktop
    # Set FTP_RELEASE_PASS masked variable in CI!

pages:
  stage: build
  rules:
    - if: $CI_COMMIT_BRANCH == 'develop'
  needs: []
  image: nixery.dev/shell/git/busybox/mdbook/plantuml/mdbook-plantuml
  before_script:
    - mdbook --version
  script:
    - set -euo pipefail
    - cd docs
    - echo 'plantuml-cmd="/sbin/plantuml"' >> book.toml
    - mdbook build
    - mv book ../public
  artifacts:
    paths:
      - public
    expire_in: 3 days