release.yml

name: Release

on:
  release:
    types: [published]

permissions:
  contents: write

env:
  PERRY_LICENSE_KEY: ${{ secrets.PERRY_LICENSE_KEY }}
  PERRY_API_TOKEN: ${{ secrets.PERRY_API_TOKEN }}

jobs:
  # ─────────────────────────────────────────────
  # iOS → TestFlight
  # ─────────────────────────────────────────────
  build-ios:
    name: iOS (TestFlight)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install dependencies
        run: npm ci

      - name: Install perry
        run: |
          mkdir -p /tmp/perry-install
          PERRY_TAG=$(for t in $(gh release list --repo PerryTS/perry --exclude-drafts --limit 15 --json tagName --jq '.[].tagName'); do gh release view "$t" --repo PerryTS/perry --json assets --jq '.assets[].name' 2>/dev/null | grep -q 'perry-linux-x86_64.tar.gz' && { echo "$t"; break; }; done)
          echo "Installing perry $PERRY_TAG"
          gh release download "$PERRY_TAG" --repo PerryTS/perry --pattern 'perry-linux-x86_64.tar.gz' --dir /tmp/perry-install
          tar xzf /tmp/perry-install/perry-linux-x86_64.tar.gz -C /tmp/perry-install
          sudo mv /tmp/perry-install/perry /usr/local/bin/
          rm -rf /tmp/perry-install
          perry --version
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Configure perry
        run: |
          mkdir -p ~/.perry
          printf 'license_key = "%s"\nserver = "https://hub.perryts.com"\napi_token = "%s"\n' \
            "$PERRY_LICENSE_KEY" "$PERRY_API_TOKEN" > ~/.perry/config.toml

      - name: Set version and build number
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          sed -i "s/^version = .*/version = \"$VERSION\"/" perry.toml
          sed -i "s/^build_number = .*/build_number = ${{ github.run_number }}/" perry.toml

      - name: Decode signing credentials
        run: |
          echo "${{ secrets.APPLE_IOS_P12 }}" | base64 -d > /tmp/ios_distribution.p12
          echo "${{ secrets.APPLE_IOS_PROVISIONING_PROFILE }}" | base64 -d > /tmp/ios.mobileprovision
          echo "${{ secrets.APPLE_P8_KEY }}" | base64 -d > /tmp/appstore_connect.p8

      - name: Inject credential paths into perry.toml
        run: |
          sed -i '/^\[ios\]/,/^\[/{s|^certificate = .*|certificate = "/tmp/ios_distribution.p12"|}' perry.toml
          sed -i '/^\[ios\]/,/^\[/{s|^provisioning_profile = .*|provisioning_profile = "/tmp/ios.mobileprovision"|}' perry.toml

      - name: Publish iOS to TestFlight
        run: |
          perry publish ios \
            --certificate /tmp/ios_distribution.p12 \
            --provisioning-profile /tmp/ios.mobileprovision \
            --apple-p8-key /tmp/appstore_connect.p8 \
            --apple-key-id "$PERRY_APPLE_KEY_ID" \
            --apple-issuer-id "$PERRY_APPLE_ISSUER_ID" \
            --apple-team-id "$PERRY_APPLE_TEAM_ID"
        env:
          PERRY_APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
          PERRY_APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          PERRY_APPLE_KEY_ID: ${{ secrets.APPLE_KEY_ID }}
          PERRY_APPLE_ISSUER_ID: ${{ secrets.APPLE_ISSUER_ID }}

  # ─────────────────────────────────────────────
  # tvOS → TestFlight
  # ─────────────────────────────────────────────
  build-tvos:
    name: tvOS (TestFlight)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install dependencies
        run: npm ci

      - name: Install perry
        run: |
          mkdir -p /tmp/perry-install
          PERRY_TAG=$(for t in $(gh release list --repo PerryTS/perry --exclude-drafts --limit 15 --json tagName --jq '.[].tagName'); do gh release view "$t" --repo PerryTS/perry --json assets --jq '.assets[].name' 2>/dev/null | grep -q 'perry-linux-x86_64.tar.gz' && { echo "$t"; break; }; done)
          echo "Installing perry $PERRY_TAG"
          gh release download "$PERRY_TAG" --repo PerryTS/perry --pattern 'perry-linux-x86_64.tar.gz' --dir /tmp/perry-install
          tar xzf /tmp/perry-install/perry-linux-x86_64.tar.gz -C /tmp/perry-install
          sudo mv /tmp/perry-install/perry /usr/local/bin/
          rm -rf /tmp/perry-install
          perry --version
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Configure perry
        run: |
          mkdir -p ~/.perry
          printf 'license_key = "%s"\nserver = "https://hub.perryts.com"\napi_token = "%s"\n' \
            "$PERRY_LICENSE_KEY" "$PERRY_API_TOKEN" > ~/.perry/config.toml

      - name: Set version and build number
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          sed -i "s/^version = .*/version = \"$VERSION\"/" perry.toml
          sed -i "s/^build_number = .*/build_number = ${{ github.run_number }}/" perry.toml

      - name: Decode signing credentials
        run: |
          echo "${{ secrets.APPLE_IOS_P12 }}" | base64 -d > /tmp/tvos_distribution.p12
          echo "${{ secrets.APPLE_TVOS_PROVISIONING_PROFILE }}" | base64 -d > /tmp/tvos.mobileprovision
          echo "${{ secrets.APPLE_P8_KEY }}" | base64 -d > /tmp/appstore_connect.p8

      - name: Inject credential paths into perry.toml
        run: |
          sed -i '/^\[tvos\]/,/^\[/{s|^certificate = .*|certificate = "/tmp/tvos_distribution.p12"|}' perry.toml
          sed -i '/^\[tvos\]/,/^\[/{s|^provisioning_profile = .*|provisioning_profile = "/tmp/tvos.mobileprovision"|}' perry.toml

      - name: Publish tvOS to TestFlight
        run: |
          perry publish tvos \
            --certificate /tmp/tvos_distribution.p12 \
            --provisioning-profile /tmp/tvos.mobileprovision \
            --apple-p8-key /tmp/appstore_connect.p8 \
            --apple-key-id "$PERRY_APPLE_KEY_ID" \
            --apple-issuer-id "$PERRY_APPLE_ISSUER_ID" \
            --apple-team-id "$PERRY_APPLE_TEAM_ID"
        env:
          PERRY_APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
          PERRY_APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          PERRY_APPLE_KEY_ID: ${{ secrets.APPLE_KEY_ID }}
          PERRY_APPLE_ISSUER_ID: ${{ secrets.APPLE_ISSUER_ID }}

  # ─────────────────────────────────────────────
  # watchOS → TestFlight (standalone)
  # ─────────────────────────────────────────────
  build-watchos:
    name: watchOS (TestFlight)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install dependencies
        run: npm ci

      - name: Install perry
        run: |
          mkdir -p /tmp/perry-install
          PERRY_TAG=$(for t in $(gh release list --repo PerryTS/perry --exclude-drafts --limit 15 --json tagName --jq '.[].tagName'); do gh release view "$t" --repo PerryTS/perry --json assets --jq '.assets[].name' 2>/dev/null | grep -q 'perry-linux-x86_64.tar.gz' && { echo "$t"; break; }; done)
          echo "Installing perry $PERRY_TAG"
          gh release download "$PERRY_TAG" --repo PerryTS/perry --pattern 'perry-linux-x86_64.tar.gz' --dir /tmp/perry-install
          tar xzf /tmp/perry-install/perry-linux-x86_64.tar.gz -C /tmp/perry-install
          sudo mv /tmp/perry-install/perry /usr/local/bin/
          rm -rf /tmp/perry-install
          perry --version
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Configure perry
        run: |
          mkdir -p ~/.perry
          printf 'license_key = "%s"\nserver = "https://hub.perryts.com"\napi_token = "%s"\n' \
            "$PERRY_LICENSE_KEY" "$PERRY_API_TOKEN" > ~/.perry/config.toml

      - name: Set version and build number
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          sed -i "s/^version = .*/version = \"$VERSION\"/" perry.toml
          sed -i "s/^build_number = .*/build_number = ${{ github.run_number }}/" perry.toml

      - name: Decode signing credentials
        run: |
          echo "${{ secrets.APPLE_IOS_P12 }}" | base64 -d > /tmp/watchos_distribution.p12
          echo "${{ secrets.APPLE_WATCHOS_PROVISIONING_PROFILE }}" | base64 -d > /tmp/watchos.mobileprovision
          echo "${{ secrets.APPLE_P8_KEY }}" | base64 -d > /tmp/appstore_connect.p8

      - name: Inject credential paths into perry.toml
        run: |
          sed -i '/^\[watchos\]/,/^\[/{s|^certificate = .*|certificate = "/tmp/watchos_distribution.p12"|}' perry.toml
          sed -i '/^\[watchos\]/,/^\[/{s|^provisioning_profile = .*|provisioning_profile = "/tmp/watchos.mobileprovision"|}' perry.toml

      - name: Publish watchOS to TestFlight
        run: |
          perry publish watchos \
            --certificate /tmp/watchos_distribution.p12 \
            --provisioning-profile /tmp/watchos.mobileprovision \
            --apple-p8-key /tmp/appstore_connect.p8 \
            --apple-key-id "$PERRY_APPLE_KEY_ID" \
            --apple-issuer-id "$PERRY_APPLE_ISSUER_ID" \
            --apple-team-id "$PERRY_APPLE_TEAM_ID"
        env:
          PERRY_APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
          PERRY_APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          PERRY_APPLE_KEY_ID: ${{ secrets.APPLE_KEY_ID }}
          PERRY_APPLE_ISSUER_ID: ${{ secrets.APPLE_ISSUER_ID }}

  # ─────────────────────────────────────────────
  # macOS → App Store
  # ─────────────────────────────────────────────
  build-macos:
    name: macOS (App Store + DMG)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install dependencies
        run: npm ci

      - name: Install perry
        run: |
          mkdir -p /tmp/perry-install
          PERRY_TAG=$(for t in $(gh release list --repo PerryTS/perry --exclude-drafts --limit 15 --json tagName --jq '.[].tagName'); do gh release view "$t" --repo PerryTS/perry --json assets --jq '.assets[].name' 2>/dev/null | grep -q 'perry-linux-x86_64.tar.gz' && { echo "$t"; break; }; done)
          echo "Installing perry $PERRY_TAG"
          gh release download "$PERRY_TAG" --repo PerryTS/perry --pattern 'perry-linux-x86_64.tar.gz' --dir /tmp/perry-install
          tar xzf /tmp/perry-install/perry-linux-x86_64.tar.gz -C /tmp/perry-install
          sudo mv /tmp/perry-install/perry /usr/local/bin/
          rm -rf /tmp/perry-install
          perry --version
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Configure perry
        run: |
          mkdir -p ~/.perry
          printf 'license_key = "%s"\nserver = "https://hub.perryts.com"\napi_token = "%s"\n' \
            "$PERRY_LICENSE_KEY" "$PERRY_API_TOKEN" > ~/.perry/config.toml

      - name: Set version and build number
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          sed -i "s/^version = .*/version = \"$VERSION\"/" perry.toml
          sed -i "s/^build_number = .*/build_number = ${{ github.run_number }}/" perry.toml

      - name: Decode signing credentials
        run: |
          echo "${{ secrets.APPLE_APPSTORE_P12 }}" | base64 -d > /tmp/macos_appstore.p12
          echo "${{ secrets.APPLE_INSTALLER_P12 }}" | base64 -d > /tmp/macos_installer.p12
          echo "${{ secrets.APPLE_DEVID_P12 }}" | base64 -d > /tmp/macos_devid.p12
          echo "${{ secrets.APPLE_P8_KEY }}" | base64 -d > /tmp/appstore_connect.p8
          echo "${{ secrets.APPLE_MACOS_PROVISIONING_PROFILE }}" | base64 -d > /tmp/macos.provisionprofile

      - name: Inject credential paths into perry.toml
        run: |
          sed -i '/^\[macos\]/,/^\[/{s|^certificate = .*|certificate = "/tmp/macos_appstore.p12"|}' perry.toml
          sed -i '/^\[macos\]/,/^\[/{s|^installer_certificate = .*|installer_certificate = "/tmp/macos_installer.p12"|}' perry.toml
          sed -i '/^\[macos\]/,/^\[/{s|^notarize_certificate = .*|notarize_certificate = "/tmp/macos_devid.p12"|}' perry.toml
          sed -i '/^\[macos\]/,/^\[/{s|^provisioning_profile = .*|provisioning_profile = "/tmp/macos.provisionprofile"|}' perry.toml

      - name: Publish macOS (App Store + notarized DMG)
        run: |
          # perry.toml has distribute = "both": uploads the .pkg to App Store
          # Connect AND builds a Developer ID-signed, notarized .dmg, which is
          # downloaded to dist/.
          perry publish macos \
            --certificate /tmp/macos_appstore.p12 \
            --provisioning-profile /tmp/macos.provisionprofile \
            --apple-p8-key /tmp/appstore_connect.p8 \
            --apple-key-id "$PERRY_APPLE_KEY_ID" \
            --apple-issuer-id "$PERRY_APPLE_ISSUER_ID" \
            --apple-team-id "$PERRY_APPLE_TEAM_ID"
        env:
          PERRY_APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERT_PASSWORD }}
          PERRY_APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          PERRY_APPLE_KEY_ID: ${{ secrets.APPLE_KEY_ID }}
          PERRY_APPLE_ISSUER_ID: ${{ secrets.APPLE_ISSUER_ID }}

      - name: Attach notarized DMG to GitHub release
        run: |
          DMG=$(ls dist/*.dmg 2>/dev/null | head -1)
          if [ -z "$DMG" ]; then
            echo "::error::No notarized DMG found in dist/ — expected from distribute = \"both\""
            ls -la dist/ 2>/dev/null || true
            exit 1
          fi
          VERSION="${GITHUB_REF_NAME#v}"
          CLEAN="BloomJump-${VERSION}-macOS.dmg"
          cp "$DMG" "$CLEAN"
          echo "Uploading $CLEAN to release $GITHUB_REF_NAME"
          gh release upload "$GITHUB_REF_NAME" "$CLEAN" --clobber --repo "$GITHUB_REPOSITORY"
        env:
          GH_TOKEN: ${{ github.token }}

  # ─────────────────────────────────────────────
  # Android → Play Store
  # ─────────────────────────────────────────────
  build-android:
    name: Android (Play Store)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install dependencies
        run: npm ci

      - name: Install perry
        run: |
          mkdir -p /tmp/perry-install
          PERRY_TAG=$(for t in $(gh release list --repo PerryTS/perry --exclude-drafts --limit 15 --json tagName --jq '.[].tagName'); do gh release view "$t" --repo PerryTS/perry --json assets --jq '.assets[].name' 2>/dev/null | grep -q 'perry-linux-x86_64.tar.gz' && { echo "$t"; break; }; done)
          echo "Installing perry $PERRY_TAG"
          gh release download "$PERRY_TAG" --repo PerryTS/perry --pattern 'perry-linux-x86_64.tar.gz' --dir /tmp/perry-install
          tar xzf /tmp/perry-install/perry-linux-x86_64.tar.gz -C /tmp/perry-install
          sudo mv /tmp/perry-install/perry /usr/local/bin/
          rm -rf /tmp/perry-install
          perry --version
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Configure perry
        run: |
          mkdir -p ~/.perry
          printf 'license_key = "%s"\nserver = "https://hub.perryts.com"\napi_token = "%s"\n' \
            "$PERRY_LICENSE_KEY" "$PERRY_API_TOKEN" > ~/.perry/config.toml

      - name: Set version and build number
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          sed -i "s/^version = .*/version = \"$VERSION\"/" perry.toml
          sed -i "s/^build_number = .*/build_number = ${{ github.run_number }}/" perry.toml

      - name: Decode signing credentials
        run: |
          echo "${{ secrets.ANDROID_KEYSTORE }}" | base64 -d > /tmp/release.keystore
          echo "${{ secrets.GOOGLE_PLAY_KEY_JSON }}" | base64 -d > /tmp/googleplay.json

      - name: Inject credential paths into perry.toml
        run: |
          sed -i 's|^google_play_key = ".*"|google_play_key = "/tmp/googleplay.json"|' perry.toml
          sed -i 's|^keystore = ".*"|keystore = "/tmp/release.keystore"|' perry.toml

      - name: Publish Android to Play Store
        run: perry publish android
        env:
          PERRY_ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}

  # ─────────────────────────────────────────────
  # Windows → GitHub Release
  # ─────────────────────────────────────────────
  build-windows:
    name: Windows
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install dependencies
        run: npm ci

      - name: Install perry
        run: |
          mkdir -p /tmp/perry-install
          PERRY_TAG=$(for t in $(gh release list --repo PerryTS/perry --exclude-drafts --limit 15 --json tagName --jq '.[].tagName'); do gh release view "$t" --repo PerryTS/perry --json assets --jq '.assets[].name' 2>/dev/null | grep -q 'perry-linux-x86_64.tar.gz' && { echo "$t"; break; }; done)
          echo "Installing perry $PERRY_TAG"
          gh release download "$PERRY_TAG" --repo PerryTS/perry --pattern 'perry-linux-x86_64.tar.gz' --dir /tmp/perry-install
          tar xzf /tmp/perry-install/perry-linux-x86_64.tar.gz -C /tmp/perry-install
          sudo mv /tmp/perry-install/perry /usr/local/bin/
          rm -rf /tmp/perry-install
          perry --version
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Configure perry
        run: |
          mkdir -p ~/.perry
          printf 'license_key = "%s"\nserver = "https://hub.perryts.com"\napi_token = "%s"\n' \
            "$PERRY_LICENSE_KEY" "$PERRY_API_TOKEN" > ~/.perry/config.toml

      - name: Set version and build number
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          sed -i "s/^version = .*/version = \"$VERSION\"/" perry.toml
          sed -i "s/^build_number = .*/build_number = ${{ github.run_number }}/" perry.toml

      - name: Decode Windows signing credentials
        run: |
          if [ -n "$WINDOWS_KMS_CERT_B64" ] && [ -n "$WINDOWS_KMS_SA_B64" ] && [ -n "$WINDOWS_KMS_KEY" ]; then
            echo "$WINDOWS_KMS_CERT_B64" | base64 -d > /tmp/win_codesign.crt
            echo "$WINDOWS_KMS_SA_B64" | base64 -d > /tmp/win_kms_sa.json
            # Inject the KMS key resource name into [windows] (kept out of the repo)
            sed -i '/^\[windows\]/a gcloud_kms_key = "'"$WINDOWS_KMS_KEY"'"' perry.toml
            echo "Windows Google Cloud KMS code signing configured."
          else
            echo "::warning::Windows signing secrets (WINDOWS_KMS_CERT_B64 / WINDOWS_KMS_SA_B64 / WINDOWS_KMS_KEY) not set — the .exe will be UNSIGNED."
          fi
        env:
          WINDOWS_KMS_CERT_B64: ${{ secrets.WINDOWS_KMS_CERT_B64 }}
          WINDOWS_KMS_SA_B64: ${{ secrets.WINDOWS_KMS_SA_B64 }}
          WINDOWS_KMS_KEY: ${{ secrets.WINDOWS_KMS_KEY }}

      - name: Build for Windows
        run: perry publish windows

      - name: Upload to release
        run: |
          shopt -s nullglob
          files=(dist/*.exe dist/*windows*)
          if [ ${#files[@]} -eq 0 ]; then
            echo "::warning::No Windows artifacts found in dist/"
            ls -la dist/ || true
          else
            for f in "${files[@]}"; do
              gh release upload "$GITHUB_REF_NAME" "$f" --clobber
            done
          fi
        env:
          GH_TOKEN: ${{ github.token }}

  # ─────────────────────────────────────────────
  # Linux → GitHub Release
  # ─────────────────────────────────────────────
  build-linux:
    name: Linux
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install dependencies
        run: npm ci

      - name: Install perry
        run: |
          mkdir -p /tmp/perry-install
          PERRY_TAG=$(for t in $(gh release list --repo PerryTS/perry --exclude-drafts --limit 15 --json tagName --jq '.[].tagName'); do gh release view "$t" --repo PerryTS/perry --json assets --jq '.assets[].name' 2>/dev/null | grep -q 'perry-linux-x86_64.tar.gz' && { echo "$t"; break; }; done)
          echo "Installing perry $PERRY_TAG"
          gh release download "$PERRY_TAG" --repo PerryTS/perry --pattern 'perry-linux-x86_64.tar.gz' --dir /tmp/perry-install
          tar xzf /tmp/perry-install/perry-linux-x86_64.tar.gz -C /tmp/perry-install
          sudo mv /tmp/perry-install/perry /usr/local/bin/
          rm -rf /tmp/perry-install
          perry --version
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Configure perry
        run: |
          mkdir -p ~/.perry
          printf 'license_key = "%s"\nserver = "https://hub.perryts.com"\napi_token = "%s"\n' \
            "$PERRY_LICENSE_KEY" "$PERRY_API_TOKEN" > ~/.perry/config.toml

      - name: Set version and build number
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          sed -i "s/^version = .*/version = \"$VERSION\"/" perry.toml
          sed -i "s/^build_number = .*/build_number = ${{ github.run_number }}/" perry.toml

      - name: Build for Linux
        run: perry publish linux

      - name: Upload to release
        run: |
          shopt -s nullglob
          files=(dist/*.AppImage dist/*linux*)
          if [ ${#files[@]} -eq 0 ]; then
            echo "::warning::No Linux artifacts found in dist/"
            ls -la dist/ || true
          else
            for f in "${files[@]}"; do
              gh release upload "$GITHUB_REF_NAME" "$f" --clobber
            done
          fi
        env:
          GH_TOKEN: ${{ github.token }}

  # ─────────────────────────────────────────────
  # Web → bloomengine.dev/jump/
  # ─────────────────────────────────────────────
  build-web:
    name: Web (bloomengine.dev/jump)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install dependencies
        run: npm ci

      - name: Install perry
        run: |
          mkdir -p /tmp/perry-install
          PERRY_TAG=$(for t in $(gh release list --repo PerryTS/perry --exclude-drafts --limit 15 --json tagName --jq '.[].tagName'); do gh release view "$t" --repo PerryTS/perry --json assets --jq '.assets[].name' 2>/dev/null | grep -q 'perry-linux-x86_64.tar.gz' && { echo "$t"; break; }; done)
          echo "Installing perry $PERRY_TAG"
          gh release download "$PERRY_TAG" --repo PerryTS/perry --pattern 'perry-linux-x86_64.tar.gz' --dir /tmp/perry-install
          tar xzf /tmp/perry-install/perry-linux-x86_64.tar.gz -C /tmp/perry-install
          sudo mv /tmp/perry-install/perry /usr/local/bin/
          rm -rf /tmp/perry-install
          perry --version
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Configure perry
        run: |
          mkdir -p ~/.perry
          printf 'license_key = "%s"\nserver = "https://hub.perryts.com"\napi_token = "%s"\n' \
            "$PERRY_LICENSE_KEY" "$PERRY_API_TOKEN" > ~/.perry/config.toml

      - name: Set version and build number
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          sed -i "s/^version = .*/version = \"$VERSION\"/" perry.toml
          sed -i "s/^build_number = .*/build_number = ${{ github.run_number }}/" perry.toml

      - name: Install Rust target
        run: rustup target add wasm32-unknown-unknown

      - name: Install wasm-pack
        uses: jetli/wasm-pack-action@v0.4.0
        with:
          # Don't auto-resolve "latest" — the action's GH-API call has been
          # returning the stale v0.9.1, whose bundled wasm-opt rejects modern
          # bloom_web bytecode ("failed to execute wasm-opt: exit code 1").
          version: 'v0.14.0'

      # bloom_web is built from the npm-installed engine (node_modules) by
      # build-web.sh, so the runtime glue matches the game WASM's FFI ABI.
      # No separate engine clone needed.

      - name: Build web bundle
        run: ./build-web.sh

      - name: Deploy to bloomengine.dev
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          echo "${{ secrets.DEPLOY_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
          rsync -avz --delete \
            -e "ssh -i ~/.ssh/deploy_key -o UserKnownHostsFile=~/.ssh/known_hosts" \
            dist/web/ root@webserver.skelpo.net:/var/www/bloomengine.dev/jump/
          echo "Deployed to https://bloomengine.dev/jump/"